Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2023, 22:58

General

  • Target

    Patch MB 4.6.x.xxx.exe

  • Size

    65.2MB

  • MD5

    769fa107cac437991936643163307790

  • SHA1

    83404c577b7aadbd7fba7c15e3888ff6ac81fab5

  • SHA256

    64831a005b4eccebf7893444b55dd515b4aa54f705cdebd74443340049ce00be

  • SHA512

    ed8aadd712dd265f30acc2011c16bd0539bd8dfcb4cddb4182ae0c74ba32d490e9c784b41762d70d86961b98ea4300912e9402b9980f7f676c5240886829097f

  • SSDEEP

    1572864:B98OHNqC7bUUm2KFqXGrY4DBMwd7MuRNc772oaoy4TJ1GmwNf:JHYC7bk2Ku4DBMw6uQHnweWdNf

Malware Config

Signatures

  • Drops file in Drivers directory 19 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 51 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Registers COM server for autorun 1 TTPs 61 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 18 IoCs
  • Enumerates processes with tasklist 1 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe
    "C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\074YBV47.bat" "C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe""
      2⤵
      • Drops file in Drivers directory
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\7z2201.exe
        "C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\7z2201.exe" /S
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        PID:4160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\system32\findstr.exe
          findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
          4⤵
            PID:1500
        • C:\Windows\system32\attrib.exe
          attrib -r C:\Windows\System32\drivers\etc\hosts
          3⤵
          • Drops file in Drivers directory
          • Views/modifies file attributes
          PID:2088
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3664
          • C:\Windows\system32\findstr.exe
            findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
            4⤵
              PID:4188
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\pb.cmd"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3460
            • C:\Windows\system32\mode.com
              mode con:cols=86 lines=36
              4⤵
                PID:3056
              • C:\Windows\system32\chcp.com
                chcp 65001
                4⤵
                  PID:368
                • C:\Windows\system32\mode.com
                  mode 70,4
                  4⤵
                    PID:4004
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c copy/Z "C:\Users\Admin\AppData\Local\Temp\pb.cmd" nul
                    4⤵
                      PID:2240
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:3964
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c echo prompt $H|cmd
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4604
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:4040
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:3096
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:464
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:4728
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:4776
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:1660
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:1808
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:1424
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:964
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:1476
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:2060
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:1052
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:3052
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:1564
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:2052
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:1692
                    • C:\Windows\system32\timeout.exe
                      timeout.exe 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:2972
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                      4⤵
                        PID:3916
                        • C:\Windows\system32\tasklist.exe
                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                          5⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3900
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                        4⤵
                          PID:4428
                          • C:\Windows\system32\tasklist.exe
                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                            5⤵
                            • Enumerates processes with tasklist
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4728
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                          4⤵
                            PID:3576
                            • C:\Windows\system32\tasklist.exe
                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                              5⤵
                              • Enumerates processes with tasklist
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3372
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                            4⤵
                              PID:4380
                              • C:\Windows\system32\tasklist.exe
                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                5⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3800
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                              4⤵
                                PID:1216
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                  5⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1444
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                4⤵
                                  PID:4456
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                    5⤵
                                    • Enumerates processes with tasklist
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:676
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                  4⤵
                                    PID:4692
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                      5⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4160
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                    4⤵
                                      PID:4100
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                        5⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:996
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                      4⤵
                                        PID:1572
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                          5⤵
                                          • Enumerates processes with tasklist
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3080
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                        4⤵
                                          PID:1904
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                            5⤵
                                            • Enumerates processes with tasklist
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1480
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                          4⤵
                                            PID:4164
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                              5⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2340
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                            4⤵
                                              PID:2716
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                5⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4924
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                              4⤵
                                                PID:2012
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                  5⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4760
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                4⤵
                                                  PID:5008
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                    5⤵
                                                    • Enumerates processes with tasklist
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2084
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                  4⤵
                                                    PID:2756
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                      5⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4620
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                    4⤵
                                                      PID:5004
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                        5⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4232
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                      4⤵
                                                        PID:3372
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                          5⤵
                                                          • Enumerates processes with tasklist
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1856
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                        4⤵
                                                          PID:3800
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                            5⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3748
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                          4⤵
                                                            PID:1444
                                                            • C:\Windows\system32\tasklist.exe
                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                              5⤵
                                                              • Enumerates processes with tasklist
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1788
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                            4⤵
                                                              PID:3664
                                                              • C:\Windows\system32\tasklist.exe
                                                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                5⤵
                                                                • Enumerates processes with tasklist
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4456
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                              4⤵
                                                                PID:1808
                                                                • C:\Windows\system32\tasklist.exe
                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                  5⤵
                                                                  • Enumerates processes with tasklist
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1680
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                4⤵
                                                                  PID:2052
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                    5⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4100
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                  4⤵
                                                                    PID:3940
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                      5⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1572
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                    4⤵
                                                                      PID:396
                                                                      • C:\Windows\system32\tasklist.exe
                                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                        5⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1548
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                      4⤵
                                                                        PID:1044
                                                                        • C:\Windows\system32\tasklist.exe
                                                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                          5⤵
                                                                          • Enumerates processes with tasklist
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5036
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                        4⤵
                                                                          PID:1376
                                                                          • C:\Windows\system32\tasklist.exe
                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                            5⤵
                                                                            • Enumerates processes with tasklist
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4040
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                          4⤵
                                                                            PID:4968
                                                                            • C:\Windows\system32\tasklist.exe
                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                              5⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3596
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                            4⤵
                                                                              PID:4400
                                                                              • C:\Windows\system32\tasklist.exe
                                                                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                5⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4140
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                              4⤵
                                                                                PID:1052
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                  5⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4448
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                4⤵
                                                                                  PID:4264
                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                    5⤵
                                                                                    • Enumerates processes with tasklist
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4864
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                  4⤵
                                                                                    PID:4580
                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                      5⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4224
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                    4⤵
                                                                                      PID:2764
                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                        5⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1972
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                      4⤵
                                                                                        PID:2668
                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                          5⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2720
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                        4⤵
                                                                                          PID:1976
                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                            5⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1216
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                          4⤵
                                                                                            PID:676
                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                              5⤵
                                                                                              • Enumerates processes with tasklist
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4828
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                            4⤵
                                                                                              PID:976
                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                5⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1808
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                              4⤵
                                                                                                PID:996
                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                  5⤵
                                                                                                  • Enumerates processes with tasklist
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4808
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                4⤵
                                                                                                  PID:3336
                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                    5⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4568
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                  4⤵
                                                                                                    PID:1908
                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                      5⤵
                                                                                                      • Enumerates processes with tasklist
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:3868
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                    4⤵
                                                                                                      PID:3632
                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                        5⤵
                                                                                                        • Enumerates processes with tasklist
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:5056
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                      4⤵
                                                                                                        PID:4924
                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                          5⤵
                                                                                                          • Enumerates processes with tasklist
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2716
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                        4⤵
                                                                                                          PID:4244
                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                            5⤵
                                                                                                            • Enumerates processes with tasklist
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4760
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                          4⤵
                                                                                                            PID:4968
                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                              5⤵
                                                                                                              • Enumerates processes with tasklist
                                                                                                              PID:1960
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                            4⤵
                                                                                                              PID:2012
                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                5⤵
                                                                                                                • Enumerates processes with tasklist
                                                                                                                PID:3900
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                              4⤵
                                                                                                                PID:3708
                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                  5⤵
                                                                                                                  • Enumerates processes with tasklist
                                                                                                                  PID:4996
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                4⤵
                                                                                                                  PID:4620
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                    5⤵
                                                                                                                      PID:4428
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                    4⤵
                                                                                                                      PID:5088
                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                        5⤵
                                                                                                                          PID:4232
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                        4⤵
                                                                                                                          PID:1856
                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                            5⤵
                                                                                                                            • Enumerates processes with tasklist
                                                                                                                            PID:4380
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                          4⤵
                                                                                                                            PID:4604
                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                              5⤵
                                                                                                                              • Enumerates processes with tasklist
                                                                                                                              PID:2972
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                            4⤵
                                                                                                                              PID:2420
                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                5⤵
                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                PID:4440
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                              4⤵
                                                                                                                                PID:1976
                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                  5⤵
                                                                                                                                    PID:4704
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                  4⤵
                                                                                                                                    PID:676
                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                      5⤵
                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                      PID:1372
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                    4⤵
                                                                                                                                      PID:4304
                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                        5⤵
                                                                                                                                          PID:2052
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                        4⤵
                                                                                                                                          PID:4616
                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                            5⤵
                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                            PID:2932
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                          4⤵
                                                                                                                                            PID:4568
                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                              5⤵
                                                                                                                                                PID:4468
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                              4⤵
                                                                                                                                                PID:5056
                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                  5⤵
                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                  PID:3344
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                4⤵
                                                                                                                                                  PID:116
                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4888
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4868
                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                        5⤵
                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                        PID:3296
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1856
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                          5⤵
                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                          PID:2148
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                        4⤵
                                                                                                                                                          PID:4388
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                            5⤵
                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                            PID:1328
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                          4⤵
                                                                                                                                                            PID:624
                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                              5⤵
                                                                                                                                                                PID:2448
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                              4⤵
                                                                                                                                                                PID:1072
                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                  PID:400
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:184
                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                    PID:2340
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:536
                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                      PID:3868
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4468
                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                                        PID:4924
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:3916
                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                          PID:2724
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:3344
                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:4844
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:4892
                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                PID:4264
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:4888
                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                  PID:2948
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:3212
                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                    PID:4868
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2756
                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:4388
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:3852
                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:396
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:4288
                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                              PID:4204
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:2668
                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                                PID:4868
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                  PID:1904
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:3344
                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                    PID:4660
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:2764
                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:880
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:3360
                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                          PID:1504
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                            PID:4728
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:1212
                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:4868
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:396
                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:4856
                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                    PID:3396
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:1524
                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                      PID:3868
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:1428
                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:4892
                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                                            PID:1316
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:3296
                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:1480
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:3236
                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                                    PID:2668
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:948
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:396
                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                          tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                          PID:2752
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:4460
                                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                            tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                                                            PID:1692
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:2764
                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                              tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:3372
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:3596
                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:1820
                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                                                    PID:2148
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:1372
                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                      PID:4208
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:4784
                                                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                                                                                                                        PID:4868
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\7-Zip\7z.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\ck.7z" -o"C:\ProgramData" -pnghfvjdfnhmgfdfGDFGdfkjxhfsdg6ujdshjflksd -y
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:4736
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\7-Zip\7z.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\rs.7z" -o"C:\Users\Admin\AppData\Local\Temp" -pFHFiuhyt6gfhjdgdgfduh675rgkhidfgHFDSSyg6f5s7dg -y
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:3688
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    powershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:3628
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    powershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Temp\rs.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                    PID:1176
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\rs.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                      PID:760
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-VBHGV.tmp\rs.tmp
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-VBHGV.tmp\rs.tmp" /SL5="$16002E,63820596,239616,C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                        PID:3932
                                                                                                                                                                                                                                                        • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                          "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\BaltimoreCyberTrustRoot.crt"
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:2648
                                                                                                                                                                                                                                                          • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                            "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\DigiCertEVRoot.crt"
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:4772
                                                                                                                                                                                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /service /Protected
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Registers COM server for autorun
                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    cmd
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo prompt $H"
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:3660
                                                                                                                                                                                                                                                      • C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                                                                                                                                        • Sets service image path in registry
                                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        • Registers COM server for autorun
                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:4936
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1264
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                            PID:1564
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4936 -ip 4936
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:2684

                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          a2cc0a771f7507d28d4ea0131695186a

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e31043104a102b636374bef2a5f92c75ccc36fc1

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2d9b0f8632c6df2ec2aa1e75d839a6d61128a7724b5509f939078f3a52005e92

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          8a1ec52dafe9c7c102ec88df8a95245956238246e1be89b46361ff6d4d69358b08c7fad8fc50d83f59ea6e887e543f53b51eca58d816c3b2d348e57b6a2f283d

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2.1MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          63df04ba26b4e485e7e6d9acd497dfd8

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          41554bf4069a6e07cd2abe941b7496f5084ba286

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          67bbf76887027a8924ceff2d81f119a36283a882c2611c104f137d8375f10acb

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          2571a9ba4c4101622360bf3cf548cf97f78cd0a07013bae207e45b964a12d822447dd2a1da1f0208029f46b169afe729231374e87aa830f7910f81e3b12ba826

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          5.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          1aa36b41e437501f20ba879d9c23ed3c

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          0f8ec29c321e0c96fb3bd3d8c51945ce70199490

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          86f81665b233c7bb75ea5b986edcb486ce92faf38d670d63632eb23875b32b40

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          2db53b44c47daabf74229755cfa9621cee8bb397042a8b8dc7e0748b366f42ff866a9e97562e5dea012f3d1741debbd5152debaadefa5060eb9f32a4bc1507f9

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          447926609e3228ff943c3cde0ed1692d

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          adbe95d3682677fa6583892124574d0f14ef1bc7

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          a50580cfb78676285130ca13fa052df96cd6d1bf639be78a9739a2db4fab2944

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          a1277c4c5da9f1801308db96365f413866ff250b38a338e8e93565f658bf2d3ea4dcd8f7820194b21eced4778b1694cdece85a51e2380548e5ace8a1a795726f

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3.6MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          907cd3b4605457a0fcc4c884fbb85c80

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          6aeeca92f5ccf58b86bb1d5b2d0babe0b4e432b1

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2a12a8240f416ed00329b6ea3e2d01bf759d758b59c6e87ed22d1ebe71818a2d

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          87251b2ba3f7a2b4e07d9c89026a53707125ce11814131612abf231c6c34239b02e1567eccb8cefededce95cfa70e8501c5c6049f8aa967d7fde917ff13c0791

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          69d87ada8d240550d7469e5ce7c75369

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          bb3422b1dc462922b6a24eee46629b89a590d327

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          b44957becd817bb9febcfc627627709916c82f366eecac6e71e630e5bffafc79

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          bb91fb0540a861155e5b3d28f109b4bb7f6b6f1d3138391bab382d0750c1968672c163c1cdab226fe3a819e36d6307ec2df94e3539918bec5b55c34214437a58

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4.3MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          80a36bcaa9d09595687ff51460676127

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          a00a6ad5ddcaffcfb74e3394e46960dfd5450a17

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          55e3fbf495de13c76b6a715cfb68f2175efd5d9d58776e3b2fa3faec7a1f648e

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          2142b166be03cc0c00a1aa39d1263c26deace2453470c3a2753279de594bea111325b2b933fc8a3f4e9b4fa6d101cd0ad44d3371d590440cba7af7e53513da7e

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4.0MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          55ef5563825fda3ab05cbee48bb5cc99

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          fcb57cb21714edfc7e59671e9b3a6d9842a988da

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          3417da91c99c3a4f99c268dd94ca61e59a76340102af54ff984cbf8f339e24d5

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          73891411be688711ee86b9759eeeb6c66799892f0dc9f668d8233aee95e6b397cf0434463308d6af77c4b592fe5b71dbdd7de031ce3d071657d29dff64c51ad1

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3.5MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          235404716813d5b32d26fd17aed9112b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          c77d3fde646cc07c274cbc2318fd884a6c8a4f36

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          ffff47710970e3bcd5e8c2a28867a2e2dc0c01278a531223e535efabea528781

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          6aecc1de3cb86d25b66e81badc7b6966d42fcc72925414594e550bb7e71d569835001fac2e5b6ee179307545bc395717c963110ca7c69f0bbd55b9132a11e5eb

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbshlext_proto

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2.3MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          439e2f41cc91de42214d5ca2ea69ecd1

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          538bbdb5d0b7e563dbe1b1938e676a64b829b9c0

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          94a820e238024dc5c65785b37141020078eed9b170be4389f085577637b538df

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          8b9ea8e345150a140e82ac53424bf4aa8c5d05879034b7057e453fa3840a4fb4e09998f43c67090084c72cbcd7499fa145141fbfe56599ef25ce62f84092bd04

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.dat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          51B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          bf86796fe0fb92b34e5f1100d5eb3bb5

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          bc10ef8edff446a9aae29a70be7fdb380979f916

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2fc07c3fc5e834495d3f76b3f4b6454c57e78eb928cdd343b863d8170f00ed67

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ef0c5e7ad46e9dd5dbe3741595b5887b34b75eab30de27343b02e68f0430e8a8cc7c79791f3a0ac1871d362eef3bd34f9bd4ac54e77a95ad1d1f2e1c65a10cbe

                                                                                                                                                                                                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\version.dat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          47B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          f87ee333fc7093fb0a7d0bf86acde081

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          8e5634b4eaf7ad9201be8fb04fd3ed734d3c5a28

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          e5ef72fb7af61be42f9f833f5e532ff4128a26e73920832ca87c5f00164e74a7

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          8530fb2efaa8de0c7f2a102a44fd4a035fbe9a06040290820fe0480e8f9bea2295695cce253023b92ad8ac0f2fe9563a6a0cd10e423e1c2e1fa212146276533f

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          5911ef94fd6b13ed00581e68c1888868

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          8b37fd447f0086716482cd17a8266a13e4b04373

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c39c8c860e7d7c27da3a2709fd1c72a196159c1f64efa32cbdab70a71f70b9e5

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          a7b5fc81362287e89360a726225e6ba5789ad7bab10d4051b58038f296affb15fed2a25e19073706daa9d7444c1ff7fc6d66116ab3f641de60bba4ff2ed77f9b

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.dat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          698B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          3f7e99cb253f3210546d94d80422b62f

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          0ae028e55e6a636224fc100f9644e6671b9e9c78

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          3d34c7774585a4979194979c316c6f776cd59b8beee42e4d442f977ecf01ed51

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          a061e2250c48310b425e2dfaa882a400a4f4d41c72e8ebd6aa308177e19befa130daf5a91cb6222f1cc714a3d52fc886e921820b510812dd7ce8f7a8b54571aa

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.dat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          25KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          7dfb5c0eaea1770ebfc2eefdc6c53984

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          cb9aa1c4ef2822804d0bc7a3c82a1c37d5d3e3e9

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          23f940ef5a24cd7dd402acbd2e1af30eca8bef3ab690954b6b42336230c4e2c6

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          3f8777ad4f5e4d8ca6653ec550779493249cc5139209334a928b1e4a9805550b0e63d4d2812c4d642e11749536a8526c068ca2b9bbb3aaa6cbbbf3ab310d3828

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txt

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          19KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          d414dd9460451d48b8855871aa637c32

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          45f8609604413e9d73898213fbad3a642268c0bf

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          a3bc9af123557aa9bc32c144f67716fd0d29182c4417012dbbd633414e4fb022

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          83ed97236658fd44ac4a52a9e5540f9f13f4d4331c23df8a6da7e8f9c526b5002351382fb95db94291fb0a8548880b7fe8174a4952c4f9153ac5a6533c832658

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.dat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          514B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          aa3afff21234e7e02bf403ec37afcfc2

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          33bd8d15a594b7636e9f2700ba9cebb2724b8a13

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          bdaa821c1a821182f6487ac6071e84e8dd556e03a666a6020482857412f5c1eb

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          02ca76bc58391980ce771d28e365c265dbdaf601979c395cae03d4b5566798cf3e86d815eba0b9e894973dac8ce5de65f04dcf8120bb75e666123dfde0bbfd4c

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          24B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          546d9e30eadad8b22f5b3ffa875144bf

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          24B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          2f7423ca7c6a0f1339980f3c8c7de9f8

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          102c77faa28885354cfe6725d987bc23bc7108ba

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          13.0MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          972580b82977e6839c1d9d446aefae91

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          270299d2c7cebbc4aedfc0fb026464173a180338

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          15ebbb78babf27890e1f1a21f19aef17526228c6e3036afed3ab52cf08817635

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          d74ec32a12aa60ba99df74dd0c2739a5c14b3364828edd9d792581b9b6d33641921954de707406f065756f400a3ad289f8a0ad168308d7539fa7278b17a1b3f5

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.7MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          ae319980ed5faee5da8218090dcab76d

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e3ad12b88d75fba177f998980d0bb7c5dc7316c5

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          eb2a5ee0a18ad657857a93c8081135b153c988a5c90c0fd26dce27485007733e

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          e04b4ae6f955e68b3e6fad1ef3335f7c07843fd4a86bc21b70fdd02e6cc651038db73ee2e9a72dcb9eae1e075bc7a62b812ca2e0ef914917c58f91f1b5922779

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          210KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          f6346928fe21142b74e53597202b8f22

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          3ef1040f74dbc827482f36c93dddc25787bce771

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          8d0440bae63e17705df3afc9e6d6be05984a7507acc1e896fc101b2fb3d4217d

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          414496582536af734ceec8dadb3ad6551c8739aa9e37de33a5317a9e7554af2b2d1511af2525c44491f7404d20c673d311de998d2ac182ac2a7d5a19038bbaf9

                                                                                                                                                                                                                                                        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4.1MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          49354a2d3f5aa13590ca9a421a9c3838

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          76603a2f89ca8f7346f8b7508a3f8fbefe768cc4

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          7303fc7c79cddf6ab2f96e23717e8bf352b8cbdf9d063aa62d3c1cf6fdfa09d0

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          efc11a7128bea910d0e17e2429612f5ca657b7fb953ce0439a0cb5e48e6e2a306e28945b29291e0066bd4b6787b89b05842b3d68aa225df9fd07bb48c959dfba

                                                                                                                                                                                                                                                        • C:\Program Files (x86)\7-Zip\7z.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          a65e53c974a4e61728ecb632339a0978

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          27e6ec4f8e34b40f1e08503245700c182b918ce9

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e

                                                                                                                                                                                                                                                        • C:\Program Files (x86)\7-Zip\7z.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          a65e53c974a4e61728ecb632339a0978

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          27e6ec4f8e34b40f1e08503245700c182b918ce9

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e

                                                                                                                                                                                                                                                        • C:\Program Files (x86)\7-Zip\7z.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          a65e53c974a4e61728ecb632339a0978

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          27e6ec4f8e34b40f1e08503245700c182b918ce9

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e

                                                                                                                                                                                                                                                        • C:\Program Files (x86)\7-Zip\7z.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          329KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          62d2156e3ca8387964f7aa13dd1ccd5b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          a5067e046ed9ea5512c94d1d17c394d6cf89ccca

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          59cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60

                                                                                                                                                                                                                                                        • C:\Program Files (x86)\7-Zip\7z.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          329KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          62d2156e3ca8387964f7aa13dd1ccd5b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          a5067e046ed9ea5512c94d1d17c394d6cf89ccca

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          59cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\7z.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          a2cc0a771f7507d28d4ea0131695186a

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e31043104a102b636374bef2a5f92c75ccc36fc1

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2d9b0f8632c6df2ec2aa1e75d839a6d61128a7724b5509f939078f3a52005e92

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          8a1ec52dafe9c7c102ec88df8a95245956238246e1be89b46361ff6d4d69358b08c7fad8fc50d83f59ea6e887e543f53b51eca58d816c3b2d348e57b6a2f283d

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2.1MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          63df04ba26b4e485e7e6d9acd497dfd8

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          41554bf4069a6e07cd2abe941b7496f5084ba286

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          67bbf76887027a8924ceff2d81f119a36283a882c2611c104f137d8375f10acb

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          2571a9ba4c4101622360bf3cf548cf97f78cd0a07013bae207e45b964a12d822447dd2a1da1f0208029f46b169afe729231374e87aa830f7910f81e3b12ba826

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          5.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          1aa36b41e437501f20ba879d9c23ed3c

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          0f8ec29c321e0c96fb3bd3d8c51945ce70199490

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          86f81665b233c7bb75ea5b986edcb486ce92faf38d670d63632eb23875b32b40

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          2db53b44c47daabf74229755cfa9621cee8bb397042a8b8dc7e0748b366f42ff866a9e97562e5dea012f3d1741debbd5152debaadefa5060eb9f32a4bc1507f9

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          447926609e3228ff943c3cde0ed1692d

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          adbe95d3682677fa6583892124574d0f14ef1bc7

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          a50580cfb78676285130ca13fa052df96cd6d1bf639be78a9739a2db4fab2944

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          a1277c4c5da9f1801308db96365f413866ff250b38a338e8e93565f658bf2d3ea4dcd8f7820194b21eced4778b1694cdece85a51e2380548e5ace8a1a795726f

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_es.qm

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          256KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          09a3995806569a7d3fdb05e54ea815ac

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          f6ea0bd03ef8d01fe92a63c750586b86ccdf7253

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          9e8a6672431aa5b805091c3e08f89417b7ba9ab931a031f3ff9641efccc6ed3f

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          0d76fe4b70225bbb2bcbf6734ae0a238a9b5b93eb53c6ed5feee30674c5dab79deb0b222100cf27bb8a1035832c3be153e900fe6a6703829a133126a57a76144

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3.6MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          907cd3b4605457a0fcc4c884fbb85c80

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          6aeeca92f5ccf58b86bb1d5b2d0babe0b4e432b1

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2a12a8240f416ed00329b6ea3e2d01bf759d758b59c6e87ed22d1ebe71818a2d

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          87251b2ba3f7a2b4e07d9c89026a53707125ce11814131612abf231c6c34239b02e1567eccb8cefededce95cfa70e8501c5c6049f8aa967d7fde917ff13c0791

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          6.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          327cb21b41ce523e2faba8e17ab24404

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          6dcf3b4a21433b7f365e16a89a131e17e1de4cef

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          638d1e4201f7e8e0f5aae7d880fda02874cbbee98eff48e9e1fd0291451a0ac9

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          f445f6020997ebbf513f9a470576a84d4b93823e2e143daa7408e7bac83276cb75f8e37c31046482a1aaf1380d6b27218be5b85b045ad6c3200baa7855e68028

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          6.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          327cb21b41ce523e2faba8e17ab24404

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          6dcf3b4a21433b7f365e16a89a131e17e1de4cef

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          638d1e4201f7e8e0f5aae7d880fda02874cbbee98eff48e9e1fd0291451a0ac9

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          f445f6020997ebbf513f9a470576a84d4b93823e2e143daa7408e7bac83276cb75f8e37c31046482a1aaf1380d6b27218be5b85b045ad6c3200baa7855e68028

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.cat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          9KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          988b553a227f7f37f14abb060a320b6f

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          f8244956defa0241dca4a6d5e5ee159b5ff96ecf

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          42b5c504cfeb02e7d12526ff5398d6063f3e9b3661bc4fb2ce312c7c6213af84

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          4c080c853d9a9265ea80fab43cea78ed9230c7be7977f84bea98847792996a9434dc8cfeda96ab2f357eb86134cd81681c6b91215b3f61e89dc96fcdb15e4324

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.inf

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          c481ad4dd1d91860335787aa61177932

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          81633414c5bf5832a8584fb0740bc09596b9b66d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.sys

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          20KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          31e4ac0c3d3bac32082304bd43560760

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          ac98325151661fc73674bfde8f40d2322b6f6f86

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          228ca2a510bb8bbf0e0ab29455bb0961b82774ff74e664bb20a864758b8b0904

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          2cfbf89ffecb1a001b8cd4f61d02681cac5900ea3166825cbe77982cf5cec40dff1cd0e2c17d3fb73842273e083b60683baa94dbf995c65d42300c4741196a64

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          69d87ada8d240550d7469e5ce7c75369

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          bb3422b1dc462922b6a24eee46629b89a590d327

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          b44957becd817bb9febcfc627627709916c82f366eecac6e71e630e5bffafc79

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          bb91fb0540a861155e5b3d28f109b4bb7f6b6f1d3138391bab382d0750c1968672c163c1cdab226fe3a819e36d6307ec2df94e3539918bec5b55c34214437a58

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          606B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          097b3f9a5494de8415a2937847e5497f

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          72305cf56312a479a8c2401bc4b9f1964cc8e0a2

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          d87407c34491330117030ea9b66a70db1fa974aa7e39e0e5b777d4b3da49bc76

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          d10d4185d6df9412c0a1fb6060de280f511829cdbc06563dd4900cc750081a22d452a6397e5d7e4e1ce7591db295db1f901254b4fabef5c212d537832555b9b0

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          607B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          973681d048e869da489a36cbd0becb2d

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          7f07781addc4b743bc3d34417cda43eab1b1ff7a

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          7b2ee3212e3c338f88bda32033d5e7934e02d82fc5db81e7c038ab1287588700

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          812aea70da28817993b2916555c5973e466c1c03ae84d3b8cbfad66d86347d08577fd11be1df5a64e93d07bd7751224934ab47ffbe96f07f6724cde3e056b9c0

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          607B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          973681d048e869da489a36cbd0becb2d

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          7f07781addc4b743bc3d34417cda43eab1b1ff7a

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          7b2ee3212e3c338f88bda32033d5e7934e02d82fc5db81e7c038ab1287588700

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          812aea70da28817993b2916555c5973e466c1c03ae84d3b8cbfad66d86347d08577fd11be1df5a64e93d07bd7751224934ab47ffbe96f07f6724cde3e056b9c0

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          607B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          973681d048e869da489a36cbd0becb2d

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          7f07781addc4b743bc3d34417cda43eab1b1ff7a

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          7b2ee3212e3c338f88bda32033d5e7934e02d82fc5db81e7c038ab1287588700

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          812aea70da28817993b2916555c5973e466c1c03ae84d3b8cbfad66d86347d08577fd11be1df5a64e93d07bd7751224934ab47ffbe96f07f6724cde3e056b9c0

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4.0MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          55ef5563825fda3ab05cbee48bb5cc99

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          fcb57cb21714edfc7e59671e9b3a6d9842a988da

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          3417da91c99c3a4f99c268dd94ca61e59a76340102af54ff984cbf8f339e24d5

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          73891411be688711ee86b9759eeeb6c66799892f0dc9f668d8233aee95e6b397cf0434463308d6af77c4b592fe5b71dbdd7de031ce3d071657d29dff64c51ad1

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3.5MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          235404716813d5b32d26fd17aed9112b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          c77d3fde646cc07c274cbc2318fd884a6c8a4f36

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          ffff47710970e3bcd5e8c2a28867a2e2dc0c01278a531223e535efabea528781

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          6aecc1de3cb86d25b66e81badc7b6966d42fcc72925414594e550bb7e71d569835001fac2e5b6ee179307545bc395717c963110ca7c69f0bbd55b9132a11e5eb

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          8.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          0ef8c690deab2e93b2cff1aaa5302065

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          469b8673542ae6bdd6467d0a83123704ea6a0306

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          0dc6596eeda04c2f82bf232059aaf675d461d6302710a14fbf0b895ae44bac6e

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          3244b549381d7e9db957f1c06f2c2b81be0fdaf67e5c706f499d80819e016841e19cc55e252adef29e9b95007f8bd9ddb5bdae868bb98fac31e0ae5da1c87b6d

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          6.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          327cb21b41ce523e2faba8e17ab24404

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          6dcf3b4a21433b7f365e16a89a131e17e1de4cef

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          638d1e4201f7e8e0f5aae7d880fda02874cbbee98eff48e9e1fd0291451a0ac9

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          f445f6020997ebbf513f9a470576a84d4b93823e2e143daa7408e7bac83276cb75f8e37c31046482a1aaf1380d6b27218be5b85b045ad6c3200baa7855e68028

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2.3MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          439e2f41cc91de42214d5ca2ea69ecd1

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          538bbdb5d0b7e563dbe1b1938e676a64b829b9c0

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          94a820e238024dc5c65785b37141020078eed9b170be4389f085577637b538df

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          8b9ea8e345150a140e82ac53424bf4aa8c5d05879034b7057e453fa3840a4fb4e09998f43c67090084c72cbcd7499fa145141fbfe56599ef25ce62f84092bd04

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2.3MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          439e2f41cc91de42214d5ca2ea69ecd1

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          538bbdb5d0b7e563dbe1b1938e676a64b829b9c0

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          94a820e238024dc5c65785b37141020078eed9b170be4389f085577637b538df

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          8b9ea8e345150a140e82ac53424bf4aa8c5d05879034b7057e453fa3840a4fb4e09998f43c67090084c72cbcd7499fa145141fbfe56599ef25ce62f84092bd04

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          0ff3f3ba83e1dc78aa42e205e1a01867

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          0a557f31af77bfccccd9530227d593efb4809fd2

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          9c5dad17bd0878115a88a4c94405fbd9048294462eea474f265ddddedc90771e

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          80543530d28722b926d3aeda4a0c61fc5bea1812e38a3a1b7b84a5a1803c078bc54c32eff23b96766fd5e27301818f105d86235cdddbaa0dc51ac347ed3d7dfd

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          268KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          303f8c619d472c98754b369e582f8e17

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          71b32fb7b9faa4747be0c98a41fc88466e981b08

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          1d5ec9dd832ea97b5984939605897749c786094460cbd731ac2c44712b65cf0c

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          72241900cccbac3c19193f54649ff9bd89537a29df29d859f1358457ec9976c4b2a5ce8362b3438c7ad7feb8fb3c47cee00dbddb6e408259f8d45d7d9f30dda1

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sys

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          219KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          e271a915b084d17c4b18c26f8eb62ec9

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          28638ae1c1cc5b04fb0f13d7b91c32847c2ae8bd

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          1d498436bb314813551704a3e46570cb3216224d6dae5473598df0cec3c5577b

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          66edec305631440f8f8ae3b75eae8c165b5d8c86e7cb3ebb947e6517c6fca45c005f6f7f77adec6f2bd2e7e9c55dfeaedfc2f10c7187a64904062b2d124ed8fd

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          195KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          af6d573ff797ace9f62cf693a18ce8af

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          c947458393289e420762f005bc8d8a7e8c905f3c

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          0c7c976d097788650cdd4440a421fc5f80e6a3ab33445e7e8ac49bd0d999fea0

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          5284ce3a008b4d5504dc17c96510aa0df416c08a9b57206982fc2b1b190535c52975827fded4fce7f09160deb8edf7417be665656145b085b4ecae7c503e950c

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.sys

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          113KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          792f29fb1d0efb9410b26601772e2ba6

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          2cf7b518b3be82a9cc98b9d8d83256ae156c34db

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          aed5fd68add4ab2e602c3dbb7956b83f6b04be569ac8910781a07cd4ff1d9a3e

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          88e3c9863bbf2d104d893f66568b6c264a6d1131690c1caa22c68cecbcb4837d461144c831f3d9e824a3e882cb2485fbaca9cebca9edc1b319db6d278807c2a2

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\suhlpr.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3.0MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          b55493d2b5f93a41c51811448ccd6975

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          584dc786acbb05e09062b98a7d976c9da17aa3a4

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2cbba30b1ab1713a9320c18f9bb0c396f89fdba9ccb89f34dd9a12de2c81f405

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          e8f1aa0efa5c7fc3cfe6063c2600d70db1c7cb399b11f443c2575d054b531b856987ca19e9a4ba63161270046ac4dfe85e5675af0f49b722af0071629c0eb8d1

                                                                                                                                                                                                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          84c6d2d33ed6f1aa356bca1d354448ab

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e70b4058ed0389fb8482ee3cb2dc04334b6bb053

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          91e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          994B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          18dead91ccbc89a137828dba9efe8a45

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          9d59f2a4c7bfe4f76db3b53c6391e70f1c8bb498

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          b046974c3ef5f126411572b8750cb28ee834315b3d8faf79ffe346d5b6d58707

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          8568810d656e4e0052523d27616670c1aec7a46cb8527a7d4d07ab0a37a88086886db2db786643aeeb5d84b540153390267bc720130548d4d89f9142ebc90f05

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          41KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          9f70e622f1e4226daeaf7402e486f19a

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          09ef9016d1ef4c92bde6e27825481cbd4dcf7c2e

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2d93f05cd125517cd0d05299450c22f54cb9caf4ce15f2756cadb58d34b57bba

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          0976309e03d99972c971835079d5d70e2ad2408101299568c13d8c870b64f8ce6dbff7fd01ae6a57cef90d015b73889f153d51637e605a98e699eb9248442b6b

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          53KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          6f8914de563de585b780cc7e6d74b64e

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          32b146462c24a7f53048dfc1f1a86a30a7bf42d7

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c28ebc331c75ff28bd3e62028b607d53083f71297f8eb382df7854b49242a680

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          4357d6152bf7a04d1a844fe050dc51eb0e581e5ebef8023ea967439033a9ff91fa1646487ae778a087641ba214ce5d945b30ade666f787db68dad88a59a99a55

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          53KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          15137758f1126da045e2c04ddcbcacd8

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          3f2085b3b1ae7ffe9a1cefb66cea0ff63d1e68c6

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          ed61f066850efe628942d3c51b8eabaee9101a0bc6455fc9505b331611b295f3

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          809a21591e3fd3a57549c808bd3dfead674770305ac6837bd8c90d85b38e560b1af30ab725c067429a75b87774be8c804efdc196b9241c452eb9ace94c6228b0

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          69KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          f5f7a2d91be1da5ec574287d47298ce3

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          b899d4abd475cb519c4e93df52da2ea5f4f0079d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          1056aa96c1dabf54c79f04efb246850d8b7ab9cb8f49167b528f02fd46a3cec8

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          b5f6f96c3b06a7933c1df8ee1a3d25c904fc3d406f3d77c3442622124353f35fe30b353d63a63d911f401f851781b8603a3f6484894f0a9bd016161f12e72d22

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          243B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          31a32e9c4c972ddf63cf1798a435cfd0

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          2ae42a2927c87e1b1c059ff37a552c5a7f5ca507

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          719eeeeda2bd5892aaebdb4d744a072dcf2e49f503f731d2e39f914f8bd9c035

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          886385a9c291a22e72654de8ff496689cf049dab3d932cbb6962a1a43b9cc49b6b777a5dcb4cea3fea444c2f60568c8ef3d438848e0cdaacc081a7daa2440971

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          497B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          b36eaa57289e6ee774d6a2542cf5e0e9

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          bcd0323794c6c461354875a38ab256489cc1a709

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          a82b1c05f1e562ff553df4159f5a9dbfb0d793dbe2c4f4facd1ea8428f385023

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          0af959eea28cd9eb97e64b16cbaab0524626a23cfe43d75e5ff711971de1fb237cf343f71a24d4e31ad78c02957f6ec88eb98c9aa944d80a599e924f0c78eeb5

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          344B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          c1a7e7aa8516ad292c1632d3ad2d5667

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          6b1a3abf1d24586e237840504cf921b423554ca2

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          d25171440142f6b10d71040482ce0d004a778f61d8f495d0805c7b9ef5fcf726

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          8c8812a16fe5348427ef25f7f8d34cc9da0f14a033e52291d25a06b8ba67aeb9de50f58b06bfb95edd07fc71af6c4a5e6b9f82b76797eb318db2f09cc7fae521

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\InstallDataConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          107B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          89f496e7bdf1e0105e705f07d4ef1f14

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          ace32c8cd9a6185629cbd198ee6637fddb41275d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          7355726b34985c75f388fef5b413a9143385014002737484a4cbc98feb97ea62

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          4789e18db310007c1974022be3e34abaee763f7c9fc52dce2e7ba3247d9365aed2fbd2e6d0bf22bf3a68589b6cd6cfa1a20f2c1a02daaee792096539d2dfab61

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          10KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          da3c59d783a11f33cc8f70ed36f3731b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          ab6e92e2653c56d6dc86bda76d525e3143970513

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          1aee2d165fd5d792c27cb4b8efd3dfd280f23d4c706e014970dcf89c0d51290c

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          a2b430459355d45a6a2c82ac5ef805020534b6a115ed6d57e1043946088527b932ef5e3edbbc0e6477b167bc85845f5e39c5b460ead6a6576ea6a63ff08d31f4

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          b54957409cc86c4b583bafc1958bd4e9

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          9f1c962edba838b6b293c52c581afb9ec584abe3

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          51554a70efca8ae14f6296b2fad1752f7f362ec79410421cf7eab3fc3c001464

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          b8a87ef80c535dd1369935efaa63fab82a5114714bb48efa016bebbc991e823ee73df4376db527448898095f943571664f34a1627d7cf261e2896a4285d46887

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          803B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          521df93cd5e538cc995d389a72f2f513

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          22b537f38470a3b1bf7eecf00907092c2719120c

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          8ae33013ad6c7f9f7951ebd077c9044937f64f2eb8fd2ce2416b89b5c839d9c9

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          0f816de8f620db8ccb8bc86207515b2f01f04b467e5aa365eab938a1448e0a8dbb136f3fc07946643e835531dd396df69b823cd099accf90653d26cf8773d0d4

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          802B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          b2fe2a1869de31b05aa6a294dfd0be66

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          d36b0c8f8744f8188a655dde5ef26278997b3863

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          debc11e0421b861a94a11c0241af263dd7e555d2fd4dee3a4b7ff1e0ee16368e

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          376fff9bf55efbb81e0931df83cecadf6ffea42f2e7274227e5d559c33e1938f380cd7c81c934687bd2e71b8ec5f4dd360a3c00625df4bfc25f92cb1fad4337d

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          447B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          c9f33cbce0bf566c2b9874022d1b36c4

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          bfa668715cd1936baae84bb0d3cb00bde0e9e599

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2b2e9d9c62eff74b8f3b70937628e0e5c560803464c930553a590111259c1763

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          530fae236614f9e93512fbbcf409201337b44422744480b419fcf24c1d6a71caa8a53761574ae69ba9b1346f3580ba1555ca468f2350a5726cb52f8a3e5f4d84

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          645B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          e92ad8a58584d683e0692d93bb0634de

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          b579af0e9e79105647013b55cbd14237a07a6bf6

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          a79717231352f3005403bb0ca76e3c5e6c7520fd90de5a75e7e07011bbb19e3a

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          d5d41affb2e34fc22fc9bf6f6641f3c4152aefb099c4e386a2881847659ca8b62e495c699bce3a4a5d7b034e29612343d1be47fd481617ce6e03674449162c42

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          8508834a8a12b39a19e82bacab268bd4

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          117eb496ef70ba8e0a524b15a9292e539f1451b9

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          63f92f37f0bc5b6de4105a2aad0bcbc1251bdca3537b6c790f62bd57022a346c

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          4f2bb721033c158efa943cff32c1d401e0fe0c9d150827fdfb28d90247d0fab54cd07ded1273249101f264776cdcb48bed061fbb35221f7654e79a156cf01884

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          5KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          a1f6caad9038ac5f445c14c32de83f29

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          2e52d392da016021d52533b86e9038baea854c21

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          a8964cbbf2c3843e7916dc78c93c5b07fa5fd591a822a115a0699a913f2be88c

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          1110fe28740455fd60097a09a234296036a15dcb04aa7320ebd828b251313e245547fd0f098685ee9b0e5ee993efe80dc3ec0d66b4ae0ad578b14c8781518b6a

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          5KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          a1f6caad9038ac5f445c14c32de83f29

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          2e52d392da016021d52533b86e9038baea854c21

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          a8964cbbf2c3843e7916dc78c93c5b07fa5fd591a822a115a0699a913f2be88c

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          1110fe28740455fd60097a09a234296036a15dcb04aa7320ebd828b251313e245547fd0f098685ee9b0e5ee993efe80dc3ec0d66b4ae0ad578b14c8781518b6a

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          2c264d7228c60e67637d79ff81c25291

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          af978bb887d89a3ce3d6dc09481dd1d06adc1ad9

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          623c5e98b111d38b890508823a8fc678713dfa07eeae25ea5c01fa37f40ffbb9

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          632ed154910c1385dffd88d65ae4b48e9ee12d50474596754016ca1bc7a99f0f12fb053f0e376ffda25892d022395588ab40d5bbb506250fbda3915057a0d04e

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          8799bb0d1186337ba794e7068ecb09a4

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          f6504e45dbbea11c94f9378a40119e1f7a2992a7

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          b537a68b14ed922370af2080b942bdb448113d64dd217be44457b0cd1319fd77

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          c0d701135247dc728cbef0d0ea90ac12f0ed71a6623631dbef98bd672a159fb67d84f3be7a1854a0b5e0b570a44342170e57596b3cbdef7acda8c6b3345e833f

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          28644fd26a90bae0879424436a65120d

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          5e21fcf27cac5a53dd15eeb7a5e72d7f59fab108

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          90b1e7716626e808d5645de58157f9ee46cf4313c8503499f9b9490b05b26ef1

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          b8ca2ab3c601e2575ac5777729e8f766ce42b7c2b772a35cb8413a1975d76e0e58b129f61f5669bc6faac78efe00383e03fec8f2bb5f4de47f5b5f5297a4d20f

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          9cc7399d366f57df8551abe94a65c1e1

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          84d6aa6a2fa5ad0abd0897565230b732aa889a31

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          7fe2d74e78fefe3b759df009fa333dc5af9cbff024e9cd70d6f99d8c72c45727

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          40ec3935b07381b6be0c86bd378ad38d8364768d15ce1bfc64000eb656d8fb2c1d1021189a65111c4c99858faf9b412fca8598f26835b3733a9879027d7cd398

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          033f2628fa3b802fbd768465f12c1228

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          632a83cff9ac4ec0e9549e22eb873e87be4f2524

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          3e8e63899ba77784909a4a5ed2d79b612eec19a1d7e9ba729b0ec663a01c0b5c

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          f34f9eb57429d7b5b498a38df0bfaca3a7cdcb6ea29b051aa84caad6e749824a622cfbac60d8c6060c4b336717efd3a1222b49357460d3b2d7abffdad078bab6

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          9222589b67f653f8990d87b29c0b4963

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          84480322778a0314632f5931af185c09c67ef747

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          26459bc947b586c265404c08f3196a3e424321c61c019fc973d91efbb1f6bda8

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          e71ff53325d0bf0725e639d1810ecd7ffba6d728c842703c3f1ec3f3d6bf1dd1fd1f35041eaa59d78e32aa105f0fe8c31d1df1b92309509b5444b7fa5463ec17

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          90e2c4f106c051120358c01d2a208b56

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          2e70d4609a834756cea40d80449e6fd7e2af3792

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2847594d75313d7eb930367e9c1b8807f341a12ef1afa8e86b4db832973e8690

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          7def158c2efa9d9af90b5a29510a7d4f16b37b8c20b5b97db6267b6d0d154cbf2a232d96a04d3de63f3a24df123b0e49a96e011266e1c7f8bab7c04c6acad24b

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          475165f28e35ac73998fed9af028a83e

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          3cdd64e05688cb75d5cd6119b7cda9ed55890f9e

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          f79e18846828f4bc37d3b570913356d531bc18c4f54174af105dd6a1b2021b0d

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          1169bb16cfeb11d21b0e944bed4b0b6e3c7113ad739afcbcbf6db3f8453f74c24952b95536c6fe049df44113f8364e5da09421c032df6243ff1ab631a51aa7ff

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          0a73863b3ae70f9f93bcd362ec4c0fed

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          a318818cef735cc2b0e574753ce578c92e1545c4

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          cb1ae2a5d1883e73de96899aad3dbcc6b791bb23ed243b4848ee06985aea01b6

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          6ec740216a888219a610449a54e31c31a6c1c2aa1bcc4a2ab7da7a98476cc855f01901f895f9be4bc489ad6bbb3d61a8c94a0b85fc985a17ff35a84ef394002b

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          3b1dd9020412483e31aa4fab899aa09b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          94be7baeafdf336b7c3877708056422d33c69b23

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          648fcc55e17155ec9c1ceb0dfdb037c44360545f1907b9e9079d26febed52f25

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          35ea97582c09c7b27a05dcbb6f3ddb5c749937a6a9f669df2f7d0593adb50b44080681a8ab4d755de92ce78d1089468af17bda03a6c097ede9ea3f665edab73f

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          3b1dd9020412483e31aa4fab899aa09b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          94be7baeafdf336b7c3877708056422d33c69b23

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          648fcc55e17155ec9c1ceb0dfdb037c44360545f1907b9e9079d26febed52f25

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          35ea97582c09c7b27a05dcbb6f3ddb5c749937a6a9f669df2f7d0593adb50b44080681a8ab4d755de92ce78d1089468af17bda03a6c097ede9ea3f665edab73f

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          3b1dd9020412483e31aa4fab899aa09b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          94be7baeafdf336b7c3877708056422d33c69b23

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          648fcc55e17155ec9c1ceb0dfdb037c44360545f1907b9e9079d26febed52f25

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          35ea97582c09c7b27a05dcbb6f3ddb5c749937a6a9f669df2f7d0593adb50b44080681a8ab4d755de92ce78d1089468af17bda03a6c097ede9ea3f665edab73f

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          3b1dd9020412483e31aa4fab899aa09b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          94be7baeafdf336b7c3877708056422d33c69b23

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          648fcc55e17155ec9c1ceb0dfdb037c44360545f1907b9e9079d26febed52f25

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          35ea97582c09c7b27a05dcbb6f3ddb5c749937a6a9f669df2f7d0593adb50b44080681a8ab4d755de92ce78d1089468af17bda03a6c097ede9ea3f665edab73f

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\config\telemetry.json

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          338B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          0033c62afd33e8f87b542de0bf289032

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          f3a4c38889612e11a46cdcb1362055b6ef1ca4a0

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          570b95d2de5e6aef7a7322ef4c0ea24a156eb54e5bef8dc98e6dd7732255de43

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          345bc6529e7746050a053a8aee18fc6f9aa08d843349be285bb62bf408559b4f57f194a6683a750db0e8d69ec5d9421d19cc2b76de9f873f0f85fcdc4f1c1f4c

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\logs\mbae-default.log

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          3a6b2f3ec889273efb5fcca0dca06e13

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          4f8bc08c9c7767a1c28c70e5e84de693e387a356

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          d6d0e7a3e0511d30ac0256b9121285a3f15acf9dd38df2da557379e9fc3767e4

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          2f66a3642b6f8958b125fdaf799b837bcbdd352be9b0ce8fdbfaf924265d933d6109323d8a79043266f3581d8cf7ae9bde7b75752bf1dc95d280e9e00ecd909f

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\clean.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          5911ef94fd6b13ed00581e68c1888868

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          8b37fd447f0086716482cd17a8266a13e4b04373

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c39c8c860e7d7c27da3a2709fd1c72a196159c1f64efa32cbdab70a71f70b9e5

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          a7b5fc81362287e89360a726225e6ba5789ad7bab10d4051b58038f296affb15fed2a25e19073706daa9d7444c1ff7fc6d66116ab3f641de60bba4ff2ed77f9b

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\dbmanifest2.dat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          698B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          3f7e99cb253f3210546d94d80422b62f

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          0ae028e55e6a636224fc100f9644e6671b9e9c78

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          3d34c7774585a4979194979c316c6f776cd59b8beee42e4d442f977ecf01ed51

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          a061e2250c48310b425e2dfaa882a400a4f4d41c72e8ebd6aa308177e19befa130daf5a91cb6222f1cc714a3d52fc886e921820b510812dd7ce8f7a8b54571aa

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\dynconfig.dat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          25KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          7dfb5c0eaea1770ebfc2eefdc6c53984

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          cb9aa1c4ef2822804d0bc7a3c82a1c37d5d3e3e9

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          23f940ef5a24cd7dd402acbd2e1af30eca8bef3ab690954b6b42336230c4e2c6

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          3f8777ad4f5e4d8ca6653ec550779493249cc5139209334a928b1e4a9805550b0e63d4d2812c4d642e11749536a8526c068ca2b9bbb3aaa6cbbbf3ab310d3828

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\exclusions.txt

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          19KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          d414dd9460451d48b8855871aa637c32

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          45f8609604413e9d73898213fbad3a642268c0bf

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          a3bc9af123557aa9bc32c144f67716fd0d29182c4417012dbbd633414e4fb022

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          83ed97236658fd44ac4a52a9e5540f9f13f4d4331c23df8a6da7e8f9c526b5002351382fb95db94291fb0a8548880b7fe8174a4952c4f9153ac5a6533c832658

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\mbdigsig2.dat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          514B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          aa3afff21234e7e02bf403ec37afcfc2

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          33bd8d15a594b7636e9f2700ba9cebb2724b8a13

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          bdaa821c1a821182f6487ac6071e84e8dd556e03a666a6020482857412f5c1eb

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          02ca76bc58391980ce771d28e365c265dbdaf601979c395cae03d4b5566798cf3e86d815eba0b9e894973dac8ce5de65f04dcf8120bb75e666123dfde0bbfd4c

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\prot.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          24B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          546d9e30eadad8b22f5b3ffa875144bf

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\rdefs.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          24B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          2f7423ca7c6a0f1339980f3c8c7de9f8

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          102c77faa28885354cfe6725d987bc23bc7108ba

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\rules.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          13.0MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          972580b82977e6839c1d9d446aefae91

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          270299d2c7cebbc4aedfc0fb026464173a180338

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          15ebbb78babf27890e1f1a21f19aef17526228c6e3036afed3ab52cf08817635

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          d74ec32a12aa60ba99df74dd0c2739a5c14b3364828edd9d792581b9b6d33641921954de707406f065756f400a3ad289f8a0ad168308d7539fa7278b17a1b3f5

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\scan.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.7MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          ae319980ed5faee5da8218090dcab76d

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e3ad12b88d75fba177f998980d0bb7c5dc7316c5

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          eb2a5ee0a18ad657857a93c8081135b153c988a5c90c0fd26dce27485007733e

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          e04b4ae6f955e68b3e6fad1ef3335f7c07843fd4a86bc21b70fdd02e6cc651038db73ee2e9a72dcb9eae1e075bc7a62b812ca2e0ef914917c58f91f1b5922779

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\tids.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          210KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          f6346928fe21142b74e53597202b8f22

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          3ef1040f74dbc827482f36c93dddc25787bce771

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          8d0440bae63e17705df3afc9e6d6be05984a7507acc1e896fc101b2fb3d4217d

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          414496582536af734ceec8dadb3ad6551c8739aa9e37de33a5317a9e7554af2b2d1511af2525c44491f7404d20c673d311de998d2ac182ac2a7d5a19038bbaf9

                                                                                                                                                                                                                                                        • C:\ProgramData\Malwarebytes\MBAMService\tempdb\wprot2.mbdb

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4.1MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          49354a2d3f5aa13590ca9a421a9c3838

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          76603a2f89ca8f7346f8b7508a3f8fbefe768cc4

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          7303fc7c79cddf6ab2f96e23717e8bf352b8cbdf9d063aa62d3c1cf6fdfa09d0

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          efc11a7128bea910d0e17e2429612f5ca657b7fb953ce0439a0cb5e48e6e2a306e28945b29291e0066bd4b6787b89b05842b3d68aa225df9fd07bb48c959dfba

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          276798eeb29a49dc6e199768bc9c2e71

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074YBV47.bat

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          68KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          1250c076f0abb5150ed5fe344aa5c277

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          4e3a74baa775dd7198e474c439004b709028a61a

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          a549b1b87a55f34fced5124fa8fe05fd818fe98d89cc3e0647c6c06c4bb127cf

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          c41989acfc2fd67391c3bb0bb9e5d264e0cf9e4d0ee0288caac16f6f930956eb92355dff3ae4c89eedd6bc2dbef64b6e9fb60226727ad3c5004982621a2fbabc

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bktp2jhw.bh5.ps1

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          60B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\BaltimoreCyberTrustRoot.crt

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          379a301592736712c9a60676c50cf19b

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          c103790503bf8c2ff3f119adee027ebb429b9d21

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          cc7400692bd90e1b5fc44e11c8dd7c788cbb462f52ea3f3decb579e4d51eb268

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          dec25a31f2930eb575a43e654c29f170c261c1c4516767c0e71cc172ad6ad115914fb58d9cd79f681ff3d7c6baa6b7c0d6de99de09d7582c9807ae436f15572f

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\DigiCertEVRoot.crt

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          d25e0f479b9601edf2c9c2dad7ba2706

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          2f1d0001e47394f4c4deec9645c5f2df99f91a95

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          63ff360aafde5ff959fb9671ec27002f99cbfae4907b410046b6a1b0f51cba9e

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          3ba164dad3cadf1ea9f0c555695e4d39cba47612599f547d0d0d59014577995c0ddbff0ef6a5e436867454da02d500136b54c034c2223586271b26108b2cfb5e

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\innocallback.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          63KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          1c55ae5ef9980e3b1028447da6105c75

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          f85218e10e6aa23b2f5a3ed512895b437e41b45c

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\innocallback.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          63KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          1c55ae5ef9980e3b1028447da6105c75

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          f85218e10e6aa23b2f5a3ed512895b437e41b45c

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\mb-header100.bmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          4f8b110e37a818130310f0c34ec90dc5

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          3bef6199fa0ba4c7b98d9c6a6c5a29c52ef9f3b1

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          db72101e43020be81ff304f50cf593497d66073be946502c16bcd64e7b2adcc3

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          d998b6f09e8750f8f99491e2c2dcbb0cec4a65f8154d795ca070eb131a4f88a30116715b67d1904a0b774e77d0b3ffdb994d10de5688e47f1e2901b10202402b

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-JF4BM.tmp\suhlpr.dll

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3.0MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          b55493d2b5f93a41c51811448ccd6975

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          584dc786acbb05e09062b98a7d976c9da17aa3a4

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          2cbba30b1ab1713a9320c18f9bb0c396f89fdba9ccb89f34dd9a12de2c81f405

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          e8f1aa0efa5c7fc3cfe6063c2600d70db1c7cb399b11f443c2575d054b531b856987ca19e9a4ba63161270046ac4dfe85e5675af0f49b722af0071629c0eb8d1

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-VBHGV.tmp\rs.tmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          84c6d2d33ed6f1aa356bca1d354448ab

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e70b4058ed0389fb8482ee3cb2dc04334b6bb053

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          91e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-VBHGV.tmp\rs.tmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          84c6d2d33ed6f1aa356bca1d354448ab

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e70b4058ed0389fb8482ee3cb2dc04334b6bb053

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          91e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\pb.cmd

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          10KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          2b7e63e10972a243646d24bc3c399fe4

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          13e3a7517487457721f44a4444c7b4221c11dfda

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          03be37f2a49ceb431e4dfc2063af4345fafb014d84f6d417e38ae622ad7e3ef7

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          41320a54ddf250770f0447da6938813ed45befb0098a3c49ce225a0469e61d33eb4e00b606c3bbf683c4bdcac4397e72ef18104ca1b757d24d531da9bd39c887

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\7z2201.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          734e95cdbe04f53fe7c28eeaaaad7327

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e49a4d750f83bc81d79f1c4c3f3648a817c7d3da

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          8c8fbcf80f0484b48a07bd20e512b103969992dbf81b6588832b08205e3a1b43

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          16b02001c35248f18095ba341b08523db327d7aa93a55bcee95aebb22235a71eae21a5a8d19019b10cac3e7764a59d78cf730110bae80acc2ff249bbc7861ad7

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\7z2201.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          734e95cdbe04f53fe7c28eeaaaad7327

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e49a4d750f83bc81d79f1c4c3f3648a817c7d3da

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          8c8fbcf80f0484b48a07bd20e512b103969992dbf81b6588832b08205e3a1b43

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          16b02001c35248f18095ba341b08523db327d7aa93a55bcee95aebb22235a71eae21a5a8d19019b10cac3e7764a59d78cf730110bae80acc2ff249bbc7861ad7

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\ck.7z

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          3KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          f7d105bc543ec2a1287a7ea80b88c7b9

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          b9dc5795e8c1f4e5caac1807d043a70251566861

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          b07af96d70e23bcd2ce87eb9b4951752ad2c34396e58a43d89671553243d835d

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          6e803d3ad0d04ec9fea69b33cda7d0ed4c3ba010c9ec52ad5b02aa2fd54f96ab3176ec3c9e205b4f02c5b09db5ccec102ea0c8435097beee85211f659496ac4a

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\cnf

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          51B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          449247cf18c57cec44da5fb96db3d91f

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          cf297809e4d45be8bd504e25bbb9a055210f271e

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          ab6c905f3c6dcb36bbc09104c253b5ef1f7755d08691e3f7c85ecb8d96b18ebc

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          d13e459854cb7656d746bf4ae2b1c0d2a1559d1c11a99af7bf04b93bdfb2adceef3a7982ffedd5224b8f5a2dd5719ae73bb1b10aff5dfe69e0780895ff8f9aac

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\pb.cmd

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          10KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          2b7e63e10972a243646d24bc3c399fe4

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          13e3a7517487457721f44a4444c7b4221c11dfda

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          03be37f2a49ceb431e4dfc2063af4345fafb014d84f6d417e38ae622ad7e3ef7

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          41320a54ddf250770f0447da6938813ed45befb0098a3c49ce225a0469e61d33eb4e00b606c3bbf683c4bdcac4397e72ef18104ca1b757d24d531da9bd39c887

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\qbE57D7A3.D4\rs.7z

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          61.2MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          d847826fbb082c31c95db5fb98f0b681

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          9f08cf5b2541f642b23419bcd582405cfbd3d522

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          80f01b431ab44e3e12c4352b6995720782f9377648f432f20da30325b4d435e8

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          8b9ecea8861c2cefc44c1a749446c7be6a12241cf0a853ac9629d05765af000e5c11fd22636112174b785e90b5cb7043845d06f1379683c189057646b109ff16

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\rs.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          61.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fb815f174914d3d9d5cf27a24fd94dd6

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          3cf5d9fe7346cd1eae4467eea591d0e95a9492d4

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          0dc3c0f89bfd3abdf7dcdf737eab0995b8e0fbd374ec6a5db3a4881b6f6b2d5f

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          74e6cae8dc24b70406b2951cb6c61718b162101f96cccb93e7d4b93cb90bcb8d65ede77232dac23a5942d2c9cecfcedf1b6a2ca9f304f93241117c56b565b7c8

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\rs.exe

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          61.4MB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fb815f174914d3d9d5cf27a24fd94dd6

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          3cf5d9fe7346cd1eae4467eea591d0e95a9492d4

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          0dc3c0f89bfd3abdf7dcdf737eab0995b8e0fbd374ec6a5db3a4881b6f6b2d5f

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          74e6cae8dc24b70406b2951cb6c61718b162101f96cccb93e7d4b93cb90bcb8d65ede77232dac23a5942d2c9cecfcedf1b6a2ca9f304f93241117c56b565b7c8

                                                                                                                                                                                                                                                        • C:\Windows\System32\catroot2\dberr.txt

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          146KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          95fdd5a4c3971865ada490c2dd7ed5b1

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          e72b9e12593fd43da099d1dc52eebed4b78f26bd

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          0a752dfd1ccd61612edb4f2443cfb925f9f6752ae57247d52e438aac2d25a6b7

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          c45ee460460744be79e0bcec78800c83f69b4bfa5eb42f22d8b394197692a5d916a8d4152e11ab57ddd5ba5475bec7dea766252c60295aec026d6edf82919d27

                                                                                                                                                                                                                                                        • memory/760-287-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          276KB

                                                                                                                                                                                                                                                        • memory/760-336-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          276KB

                                                                                                                                                                                                                                                        • memory/1176-271-0x00000142722B0000-0x00000142722C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                        • memory/1176-283-0x00000142722B0000-0x00000142722C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                        • memory/1176-272-0x00000142722B0000-0x00000142722C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                        • memory/1176-331-0x00007FFEB43E0000-0x00007FFEB4EA1000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                        • memory/1176-334-0x00000142722B0000-0x00000142722C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                        • memory/1176-270-0x00007FFEB43E0000-0x00007FFEB4EA1000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                        • memory/1176-333-0x00000142722B0000-0x00000142722C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                        • memory/1176-335-0x00000142722B0000-0x00000142722C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                        • memory/3440-332-0x0000000000400000-0x0000000000499000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          612KB

                                                                                                                                                                                                                                                        • memory/3628-268-0x00007FFEB43E0000-0x00007FFEB4EA1000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                        • memory/3628-263-0x000001E336980000-0x000001E336990000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                        • memory/3628-264-0x000001E336980000-0x000001E336990000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                        • memory/3628-252-0x000001E338A30000-0x000001E338A52000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                        • memory/3628-262-0x00007FFEB43E0000-0x00007FFEB4EA1000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                        • memory/3628-265-0x000001E336980000-0x000001E336990000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                        • memory/3932-343-0x0000000002440000-0x0000000002441000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                        • memory/3932-350-0x0000000003E60000-0x0000000003F60000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                        • memory/3932-1350-0x0000000003E60000-0x0000000003F60000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                        • memory/3932-303-0x00000000034A0000-0x00000000034B5000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          84KB

                                                                                                                                                                                                                                                        • memory/3932-293-0x0000000002440000-0x0000000002441000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                        • memory/3932-378-0x0000000003E60000-0x0000000003F60000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                        • memory/3932-376-0x0000000003E60000-0x0000000003F60000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                        • memory/3932-370-0x0000000000400000-0x0000000000549000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                        • memory/3932-371-0x00000000034A0000-0x00000000034B5000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          84KB

                                                                                                                                                                                                                                                        • memory/3932-934-0x0000000000400000-0x0000000000549000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                        • memory/3932-349-0x0000000003E60000-0x0000000003F60000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                        • memory/3932-345-0x0000000000400000-0x0000000000549000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                        • memory/3932-670-0x0000000000400000-0x0000000000549000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                        • memory/3932-1035-0x00000000034A0000-0x00000000034B5000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          84KB

                                                                                                                                                                                                                                                        • memory/3932-338-0x00000000034A0000-0x00000000034B5000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          84KB

                                                                                                                                                                                                                                                        • memory/3932-337-0x0000000000400000-0x0000000000549000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                        • memory/4936-1159-0x00000000038E0000-0x0000000003D20000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4.2MB

                                                                                                                                                                                                                                                        • memory/4936-1164-0x0000000004320000-0x0000000004321000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                        • memory/4936-1163-0x0000000004320000-0x0000000004321000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                        • memory/4936-1161-0x0000000003D20000-0x0000000003F20000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          2.0MB