Analysis

  • max time kernel
    38s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-02-2024 18:09

General

  • Target

    MBSetup.exe

  • Size

    2.5MB

  • MD5

    7ce024e6e2248ee891248469894d8a9c

  • SHA1

    13db96c5e8d67b7f1141d22567741cd45d659c1a

  • SHA256

    377ac497bdeb20e13ea84ca1eab709946535b77d4231007a7646509386a4af33

  • SHA512

    ce5b6e7b7da5d3d00ad1df64006c24c291e24cb63e855855375e52e7a18ea7b3d283fababb79046a59533bcd80d8c18f604d9ace64af7e712f18020e5b351eff

  • SSDEEP

    49152:YXrcUh6gxrxD0Xc3StQyfvE0Z3R0nxiIq2ddIAuSF:4rNRxrxA6KtQRq2SSF

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Downloads MZ/PE file
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MBSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:5100
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:2556
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
      2⤵
        PID:3740
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
      1⤵
        PID:2024
        • C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
          "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
          2⤵
            PID:5480

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dll

          Filesize

          41KB

          MD5

          8105d61fc73ec99348bbdc5d7447fd1b

          SHA1

          4509517aa333a4d666eead4f0f9f68c3265e7714

          SHA256

          328773a06756b2c9683ff1840bd41d1e4cbedc9ca5fcc8eedbca8c12a140d1f2

          SHA512

          b18e4d80a86fe50bb80db5c54c2101990e71ec8a6534fc3c9f504d7b44244a08958bd03c49c240d8983e3db04f84ffce51d4732ae3dec7060f77fd52075c85cf

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dll

          Filesize

          192KB

          MD5

          56da0609a571ed70e2d97f9ab6b51cef

          SHA1

          25046bed44af6014f559725a4b37117e654667a9

          SHA256

          6cbaa55e3f3dd79884843442676a287da533d2821f26d0a2c534fe71dc1775b4

          SHA512

          8d6e6bcaa128815f56fee35431a60f6b2f06982db874ba2775052a2809cc29020ea5f70560f25d1ad2adbadcdb82b8a13be56c03093f26bb675cd859d291a5e0

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dll

          Filesize

          115KB

          MD5

          e2847456ffc065358eed8c8ac068c2b1

          SHA1

          3acffd8f1c85a3df1ab9bc8be16da8f577dbfac8

          SHA256

          1b27cac8ed3c27f36dcf06a6af6ac4f774a43f844a3172032f31d657f1a83478

          SHA512

          cdc25e4b7c5d1ae6fdd85bd31312f3981bcab90731e279a415f5732d6a9ae52edf620cdea5bf06d80a08d4b81b1d06495c51b713738dff65fbe53f3f2ce010c2

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dll

          Filesize

          149KB

          MD5

          633898d344f22738597fb69f8e905c38

          SHA1

          27d611f9141f310f8b80b6d4b634b90c2ffa2cbb

          SHA256

          ba974181bd096a3309b26d14676aabbcaa56eda92b49e9445ca3dbed811f5598

          SHA512

          d11f211e813b18b1a11c0f6e8dc85d5560dc6792c1b4fdbd8bf247c2039ba456a59cc666c335cbefd87c97604ac6c79f383c86ce86cee65c0a15cb516ca60a6f

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dll

          Filesize

          85KB

          MD5

          128cefb3340504e76c1c7409a4a244d3

          SHA1

          a7a6c71404ada18f6bd694589fcc47f64723f38d

          SHA256

          51e8aafcfb91e6dda822535b17e05d3a13d0b6d4a8cdf8a3e0bdbad2d539caa9

          SHA512

          703b47d57ea192918a4e7d33d99f36614aa2f04df1b2a6f8a8dd4b40057e40e16d0766ebc1437b625e0e0e6b46ae5aa000e35e58a218f62c5159a995652df38d

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dll

          Filesize

          5KB

          MD5

          9af6ef0c0a1e2f8dfea548e42cd6a556

          SHA1

          898412601f41906d5deaaa61ec02e8ad5894129b

          SHA256

          882a5cbfe1203c0eb9d47494b731ce90bf4db01717c207686191a816d28be554

          SHA512

          3ebb17896449fd3a764ad5c88916ca1ca5cf53e6533d6a1c9978aadfefd60cd63e2a79308fecd3afde3aa137d6a5fcc70ebaa99a85f48174ea7b2aa1ef94dc02

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dll

          Filesize

          199KB

          MD5

          030d9d065b5204c4688646018a176eee

          SHA1

          781d1a9bae4e3d13c19b3e1b8e2c08eaa20ac304

          SHA256

          08dfd842223e931cecdc39ec904a8dee66b713caec6c67515bbb472526fd1288

          SHA512

          c00ab528152c45ec23308fa78a0fdf7be699476b1235f6670d861acf192943a584ccc269ed40c0bd960e819d2c3b35198faefa31b3aa57ac6ff260436a70aac7

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dll

          Filesize

          68KB

          MD5

          7001724e757accde1106963c02f7f1b5

          SHA1

          b74c97482c32a22f723ebf4b6b5c8c04bdb6cf85

          SHA256

          b5a09553889646ca035a5ce5830e8773ba5d3523df7d95c3b26a5f0dadaef96d

          SHA512

          5c1ac360325b922e2e772a8b911eb7a28b6e03f657c7d96b9b2b87a3a5c809d8468c528a230a5ae40558bf3ed0f611bb694e0f20f92362dbc549e5baac1c8e20

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dll

          Filesize

          129KB

          MD5

          0dccb64fba6795253dd3417dd72107ce

          SHA1

          54ed00dbeb55ef6bc3c9072222d0d5aeed77e76a

          SHA256

          0409ed75cda2d000b37f4ad94b2750658f243305d00b5992a6af30a40dd753ae

          SHA512

          f761f0652b0c4f008530435796393c2de964993002c9263ef3ff4f3fec3072b03cb1fe43878eb8da2df1b88ab448f4c90cb5845572a88e876a3bf685b8793580

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dll

          Filesize

          124KB

          MD5

          7cd4a5d2ea0b98e3d39faa96081cffca

          SHA1

          42e9f2e6a1ea65905cd940461ba6715d2f02d386

          SHA256

          dab6603947ee1d75a4a47b08d501175805ce3381ac39548cab2a6e7459778e99

          SHA512

          87a7d9b1a46235150761c1eae923d2d34cef1c47f08b40c7e6de845b994c88340d14e942e3bd0d90a2f9704f133f28d482ece4a848111876cd639da6af4e4b37

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll

          Filesize

          154KB

          MD5

          02ceca6fb9b2d716c8cbb97833738f84

          SHA1

          54a3c4f730fa3f59e677e1056ee4e97cb52c7bc8

          SHA256

          4fca26e13dbccb61059751b083b5fef1e02b389b039ce02942648d5fb3288fdc

          SHA512

          923cf84811b808fdb90d916d1f70e276a0cea8b9651a8399762f974e8ca5857f51701384afd6e15d92360c6e026066c34b437c4a2bfd1864642866383a6a14b8

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dll

          Filesize

          189KB

          MD5

          cd20baf0903340e415ef0bf7ae5a8583

          SHA1

          a50c25b6cd156ce083a62f473fcece9a1d538b47

          SHA256

          e411fd9ddca749b5595845a7d4c2d3b3ca67ef98360e61f55f93bd25a969b3b4

          SHA512

          cd61ef0f83ba49c653ca97293ca7870a167a160263d3e097b68bb21ff9fac5453577bed76cd4b5892fa77b01b3e25e481a2657bd8283d59ee284eb95ab778b13

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dll

          Filesize

          79KB

          MD5

          eab6c7e8554a1ead2d6cba032cba50a1

          SHA1

          db3499dc801490bda89735c11f3aaf92975a9313

          SHA256

          6fc144cc2d97b85a0fa166670849f3c68c2c290d96007a328d18d9d2206f27a6

          SHA512

          87e9bb4d362e6be414b4df3a73070c918eb1d93ed96c5a24d02b2124b11a41c31ee3197520461c9c7568d8d21de7183536138f943236a74ba6fe998393cf7be2

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dll

          Filesize

          82KB

          MD5

          44daf49d4e22067e47afd2812c6b4226

          SHA1

          1be780918fe3ed0658f8886e109f09695a565ab1

          SHA256

          f554ba660eb30eb88838821f6201d8c8ce7647a62473e9095b2709945d4bfae8

          SHA512

          9ddb3525283848df0427c62fbe977c4617d81c99d85e60b14dbe6729730f916c30d6907556281d80095261619f7a56e8bccac457d09955208f4f9bb51b764979

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dll

          Filesize

          34KB

          MD5

          43c1fe3f811c988ed4b49e42f0c8681d

          SHA1

          d917fec9583438e2c568ae5be8194384c5c0dd9c

          SHA256

          3afc515cb16498eb8bc7318ccf1cfab9f1f1189f6edda61189ff606164aef351

          SHA512

          b3a06c99240891f3071edc23c71ad7399d5ee22a214728c4b3051910bc961964bd87f0126473402195806f0db8082be36524532fe98137bba9119413a994e725

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dll

          Filesize

          314KB

          MD5

          ccb4585bf4d70d69f279d7426e2fab58

          SHA1

          d4f1ae987fd8af10c309214565cf8c209f3cbbe8

          SHA256

          93cba7ccd2fe18d67424b73774df723dfd43a9052dd283ec4c3e32ab1055a5db

          SHA512

          199ab8e67c933a2cb55b5bd0c696b99cf58ed41b3bc64c551477d365db7d6bc5587bcc83fbb6cfc80e3199f8cc9c4bb3767830e7fdb6dcc7e02b4b79fd735d80

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

          Filesize

          259KB

          MD5

          62ba2c7b2e5e50997421a6d271adae55

          SHA1

          ce4b4aeb78f02fb6814d84fed4172153b5ee9a96

          SHA256

          6c26937194c09e6ad01e2a6f5716f7a7b342befc9419c74e56f3d4546a077061

          SHA512

          559638dd421065afa67974a97d9a21dbc5db793d97cbe76c0da522c2041a6c4b334c895b74f173344a320d5d0b866404447863591c93249df240b6f38404e237

        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sample.dll

          Filesize

          223KB

          MD5

          c4b97834ca54b8bceaf721be7f942b4b

          SHA1

          590d5b283193c33cf4ce1d2fa3644d65f7342b70

          SHA256

          51bb918aa57fee03f5fc5e20f9c0dcf6202794ac58bfe866475a91ee987b0b3d

          SHA512

          c38becd680327e66622f2429c0a867c420db07c8be0d25d796f98dab22791d6f8d0875944decb9b26f7c3a0294eb04689f7c767faf4eec2e3b36a383962afa69

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nm

          Filesize

          120KB

          MD5

          739dbb2372e4c7acf8cb5e4bd6b4d28d

          SHA1

          b4e63ee5387bb0925d23b1871116078a7c1d38f0

          SHA256

          c963db7520a129aa7af3df78b93bf2b44255deae177e1a8fcc5bb0dd4b2cb357

          SHA512

          135a9b98dc87f01118cca23d3fa620f9e1ae5ff5bb1605dd5bb03e9e4c676ece5aa76ef801b9cc5188762d899ccc2777b08766bd209f9f0f72562e0bff38b8b8

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.sr

          Filesize

          211KB

          MD5

          c539ad329ffbb83106be2427e54a5ef7

          SHA1

          1b77f2cbf9744214cef8bd373e800392843d6aec

          SHA256

          b19c789105159f689a95f81ec171c488d0c74984e00df98eb53ecdc06bde43ac

          SHA512

          7b468abef9e33056279085ee0584869df8925502ad65219f530fb986574046b4871153b7c685643c7602b6a283346cf6ed9e3b6ad56f46ff3689bc5ae5b7c9f0

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdb

          Filesize

          10KB

          MD5

          6b5c1f69dcb1ae890b364985a6eee9f2

          SHA1

          fcaca779615dd805834fe06ff916db888346c381

          SHA256

          3ea70451f03af6921e1d51f3162ed11e89f159e8d58892f987bc70602876f542

          SHA512

          e9fd5154973e28d09d330a8b26a390bbdc896a95d8169c7f335be70514df628c3a7fcf5cae82f17779634a3c774f82b6fd7a51b063cbba15fd9da3c56b2bd31c

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.dat

          Filesize

          924B

          MD5

          b2e676b7fc17a34f59ea9730b2c7ddcd

          SHA1

          bb917eab88c84c0c249083b44c4b8fd1ad7f7a94

          SHA256

          c9d1bb16e539f2dc50327d4fa8fa3fdba10744e9334d8bd255a10f9d9526f94a

          SHA512

          8c8871367d7bb25132d64f8b25cdcf7d1d408e45686d2922dde9830bea313295d18818a90f342c8015f2f91a6a2c6aadc5c949a09caf270a7462258e01cfd396

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.dat

          Filesize

          39KB

          MD5

          10f23e7c8c791b91c86cd966d67b7bc7

          SHA1

          3f596093b2bc33f7a2554818f8e41adbbd101961

          SHA256

          008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc

          SHA512

          2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txt

          Filesize

          23KB

          MD5

          aef4eca7ee01bb1a146751c4d0510d2d

          SHA1

          5cf2273da41147126e5e1eabd3182f19304eea25

          SHA256

          9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f

          SHA512

          d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.dat

          Filesize

          514B

          MD5

          ca73143736254f9accf99f428b50fc31

          SHA1

          b947df109291e50caef692f0d6e17d55b87e46e8

          SHA256

          e3b71e6ba309b4ac19205473999ff2c7cd01f90f6365782756334b06e60e24ac

          SHA512

          7ee4b496511357689b72fb6ee2670d1c5131bde63f80636e0e0cb845d68dadfd3710bc6f7a4d0257617a3370b6f5f01aa9e049289ee55c212c9a0b5eaea0045c

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdb

          Filesize

          24B

          MD5

          546d9e30eadad8b22f5b3ffa875144bf

          SHA1

          3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

          SHA256

          6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

          SHA512

          3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdb

          Filesize

          24B

          MD5

          2f7423ca7c6a0f1339980f3c8c7de9f8

          SHA1

          102c77faa28885354cfe6725d987bc23bc7108ba

          SHA256

          850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

          SHA512

          e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdb

          Filesize

          369KB

          MD5

          c3b373ee69169f02a99f840979c883d5

          SHA1

          09842bc0b08e2363b23a96891fa76a1242c515d6

          SHA256

          b192b74025def8858a81bff50c1ea9b0088cd92d9b37f7d56ffcbbe63af9813f

          SHA512

          344ac9cd5e812624f18ddeeb975045d6774fdec5fb2507e37b2da284cd6ea71a1087b4da691fcde1b87935f9c2ee7a5aae9d3854fbb75afd147cb273f8205b31

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdb

          Filesize

          194KB

          MD5

          2547e5e7087e17582f71b30f70bbb847

          SHA1

          c8759e2f3a0260504cb38c4fce1d92ef8460759a

          SHA256

          ace46deb20b2fb43047b8b82ee8ea46517d988351cbb2a3333d274cd9eb323be

          SHA512

          7f7b54e223713d7142ed73d4c1227cce28dea4e5a60ca1b999b7dad540dd1de1a08f70229dc78b7064fca4221046c9ed2a959f944c71618fa85384f8ec3f117b

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdb

          Filesize

          177KB

          MD5

          7b6bd5cf4cebd1b536aa540a27280a06

          SHA1

          d1562329e126a14ed5b84a65893436e553550ecf

          SHA256

          da0046bed172b9e206751a034981884c99b34e76286686a387c0e501b8f2bccf

          SHA512

          77bbc9c5f4e0689e02d4996368be3076456f45541a86d0b4ed4415db4ce0cbff0bde3cef8a6a06cef08d1639bd58fbd1546e91b87f67a841831cf11a78e97bb8

        • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdb

          Filesize

          270KB

          MD5

          c21f73e4dc88c307fe3c769ea5b59c9f

          SHA1

          03274a76b1dc96001068e6277f1ffd3c6df2ee6b

          SHA256

          eb2b761c4c617f8421f3e3596e3cbcdb5ae948f1298b01a6e1e8edf735dc5720

          SHA512

          49af0e45786aa7069e6753cd39764b1bb65048ab459dea9b5662e13fff60ca5be701d990cd2be5c9cbb3b09d31f31f444f7b6346427e8944ac93f1f23bbd9687

        • C:\Program Files\Malwarebytes\Anti-Malware\7z.dll

          Filesize

          81KB

          MD5

          d5556de36a806bbec11eb6829e997ec8

          SHA1

          fba4e0542dc70cd9fb3f1483010f896e6ce78754

          SHA256

          4e5bf99ea4a2905fa4c73caecdadcbe096b2e823c87f15fb0797e8923ed325a4

          SHA512

          62fb2d220f7176c6b985e3b1d96457908dd878f8b7913cf799c50322706728a5076cbef92e116fee1247e5eaa9a6f2a5371b61bfd4f0f37e2084ae40be6f47a8

        • C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll

          Filesize

          118KB

          MD5

          2ce5c0571c59c7bf7e6366a924125465

          SHA1

          5afebf1b601a3619481034f06e6a5b472304615b

          SHA256

          a05f3d3bb504f21fb8eace046392ef58cf4b9dbd9869dca38ffcfdc2f29eac32

          SHA512

          89630d9f68efb3bcb5ee32fe5eb58bbbc5a4eba1f045dd474912d88e86c46723eb122b46138f77f26560ce45a353c9783e3fdb5a09cd64a4c2e3692063f7a1b4

        • C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll

          Filesize

          156KB

          MD5

          31c1cb55df50bbd34eb3ad1f17711d0b

          SHA1

          b7ea0a17019ac9e8d27cf6915db10ca7c181fef7

          SHA256

          63d818cc24057ea808e723d10198c6bf85af77c10a64021d3582a985780bf16b

          SHA512

          2bb22b130100cc6a6b865f0a4394c15b48c918dd68cd2af9d93fccb5fa9b92ff31789c0bddcad23e957b8616eaad8f7bca288f9e551d932e76192a19b9cf0c35

        • C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll

          Filesize

          274KB

          MD5

          7300e64ba987361fbdee0de84ba55931

          SHA1

          eb902d4c8058bc69944420ac80d1919681ba63ab

          SHA256

          6585a810d26d9299ae73c8125402a1a13a817800cfd8b7f940ae6061d021e3b5

          SHA512

          82c7053e13c7bf134be7e772f4e1c3d940ba99ebaa6f94498df217441ffce148b9a8308c2256b5de4479403e7ff598363587f0a263f96601743454d49998cb36

        • C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll

          Filesize

          74KB

          MD5

          b7b3b5b95da0856cda0ef90d5de1777d

          SHA1

          ee1175d035a519dc05da33112f5547e5ebdd71da

          SHA256

          138e1d600b341118ddc74a3ba648c52c4b5c02fe0a7556d60e2139355f52a0ef

          SHA512

          73814194670a6e73536f3bebab8dca5fd3f1cb871814beb28ac820cd39a6bb86b6c4fc7600c95122ec7231cd9d5b3f41b566656f24b25a8e97b1f0500406e3af

        • C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll

          Filesize

          116KB

          MD5

          773b580192944e3f1d45212e18f80ffe

          SHA1

          0a7bf7d6f0d6f63779933221e0712344424c8019

          SHA256

          ee25bd1cc382643f2798d27e0f29684bb656f42dc3a95350d665d1be3f1577a1

          SHA512

          7dfe065c4c62c5756b766734d88186f962e47a43dc34f829195d71861bf6ed86daffab00a73a1a833c9ae60ff520952def8decea66597eef1c93c304ef6148c7

        • C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll

          Filesize

          65KB

          MD5

          c34b34635bd7b1cc15d3bc6a3e8e024f

          SHA1

          56205cbe3487edeeda7d4d645403b6f459a3fdbf

          SHA256

          7bf8d47bc12b9014b17e4c753d61049956b9eabe9cee338157220374e1b307ee

          SHA512

          d73cfd79a23de77cf453db78b958a67025bc43aa6d7dc02ebd3d880f45c9c1a77de62532cda04a0eb4d5910552319d6057f62e79c1f4fb98e4cfad9bbd38423f

        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

          Filesize

          972KB

          MD5

          4d05628752666b1c409acce7b0d44c21

          SHA1

          74ac95242daf9ab6712a2dedf6998c3940ec3c74

          SHA256

          d9449474ec22f731791c553a36a7c62b3ccc7d91c740923264a092710131a1a9

          SHA512

          3b236d92bd1f6e0cb4c37cef2cd4c627645f3a7404cf1c35c0b3b581e2602c5372814ed3a2b4a252a1e305869b53f1d37a9d305164abb18247b9d03bab0b0627

        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

          Filesize

          1.0MB

          MD5

          48eeb33c632498543628aab5a0f8a94d

          SHA1

          e57b2752f584623360827b2211c5b36e8a06672a

          SHA256

          a7de5a227fde616ddc8834152e42f4c002a28122c1b466cf65b10ceef68a978e

          SHA512

          17eb48f1ae2b144024b98387dbf82ce9a3a8b98c99320fa3134be6738580873b2faae7aea90292b1296c218047569087c3aefaaf1313bdb4bf92d11a6cc5d5a9

        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

          Filesize

          927KB

          MD5

          b605c00c588938c96b95a9b12bf4d0ef

          SHA1

          acf24cf62cb5c0367c001048e7b66c3088fde74a

          SHA256

          9e700b1d702b156c23c82121aa75067780b6cb4c671537c5c2c854195cf926e3

          SHA512

          f4c9824f84338385cc08629f60ae60bb9ad7d598ebd6a2697f98e7a4326d3d479a78f6a5e9303e37704803a0817ce7a876c945271999621f83ae1eb0f06f416e

        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

          Filesize

          503KB

          MD5

          e475f8291f0fc5a8da7f01f1cc86e7fd

          SHA1

          18494ee7126feab71b3ca31a5e1233d17d7112c2

          SHA256

          e7d81dd07c62620d48e396c00be82b6ada48b98f423c5021a38dcc25bb7de48e

          SHA512

          08cdd5f51efabcff1a1be6734b2391bfa86ee05d2c77939726b1784b492737bb7ee082efd84bdb4a949052e3c15e3e36a1b89da016073fc7f6ad639bda9aff33

        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll

          Filesize

          99KB

          MD5

          4ba7526846d454e111ae97886b721567

          SHA1

          188818ed885ee45f482f1a296290418820db60e1

          SHA256

          05a00e137640284e8fed93efb64eb081be79ce42cd2149c4773fb0436a8b180c

          SHA512

          3be99978788e295bdcd191dcb03130a4132ec9ca080cfabbdd8cefb1d00badc91e46b0943d78a72457b8e02dccd44d10f948b47b245e9ce60e58440ba1140332

        • C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll

          Filesize

          72KB

          MD5

          615594d5887230c04853189e66e71cc2

          SHA1

          c97ea1ab9df3f6ae5a90cda9bc5f216a199f13e5

          SHA256

          651a05f71bb291032e0a8470b7d71495e6bd177a16a3b43bea86f76f7a26356b

          SHA512

          483bec2cbb6636e9c451d35d9d7e687b66d07d2d0113f84839ac4a7c6406d10b7c36c544be7c93da9e9f3ae7b20f3bab31a9d959df4c87ea5f2985d129888daa

        • C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll

          Filesize

          182KB

          MD5

          6df2fb367cae18ebea285318e86177ea

          SHA1

          c97a58f1c1904061296a3ef738b43d4d7fda2163

          SHA256

          3e1b16d095f6e89c82ae301172e6b0ac096dfeb98b22f2b54fcf655d1d7740a1

          SHA512

          37292f94ff57fb1e43735f0ec1d055272fbf29471207e6f8f8c2ca18eaaba1cdbff30fae21a784e3a93cf3d2ea5bc04dfd59a08231eecf837d1893656856e7b8

        • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

          Filesize

          592B

          MD5

          24a453ddc67f3723e6fd334f2e83a476

          SHA1

          ecda0917ced411e3b2bd54aafd6511eda6b8f6ca

          SHA256

          ebf37f062e7849e8eba0d8dbc912e5da23f11d726522ec24b98652312df7553b

          SHA512

          05bb5a4a42a958afbba8251d8ce3c02e1a4cc00887f09d24f1fc0040ca3ddfd42aa7e6d3de9fc503d389b1e4bf11222efe64f6545d2b6818c73de424c4ca8e98

        • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

          Filesize

          654B

          MD5

          4fa3a3a5c7385bb83a81bac77c4d9ee0

          SHA1

          d3b235a6ed37a767d167e7486dacd2ef7de4c1d3

          SHA256

          16c513b83b2c87c75a32a1fcb9606dd529fc85f587986ef1ffb4466b0f6cb466

          SHA512

          0b9b5550ba649ff83efe32d5c4195aa8494ab207711f967437320042cb93550f3ade06b9ed90a053d40117af1e9087608462a38d1aecd447501742618fd614e7

        • C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll

          Filesize

          142KB

          MD5

          4ca89f813c0ed666145c11c1e486a56b

          SHA1

          818f5cd6c8a3bcd9b1a6a03321f33aadedc693fe

          SHA256

          ac0c267f93c53191e6f3d67ac1cf6a3ead306bfef5318f4457b2c1983846abc8

          SHA512

          e0f981afa02107d0ee096129c7e1296686f80ff9cde97e6f1f4b9eda3e180fde4cb6e771d82deccf48c716d5e7da79270766065e6ca92a176cf0203bd9632434

        • C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll

          Filesize

          244KB

          MD5

          25d0251708fad6481bf025132d967ba6

          SHA1

          0aa6ea9bdd36fe680a8aa8645126ad0caeed1138

          SHA256

          19c3c5118c45bf60355a89dd9df0dd010a19bb1454b579dcacd871f911f13336

          SHA512

          977336def4ee464976f014964ffcf1302c81224f48d7ebff29ed9cddc35b93f4fd342639c2797c0c1d096a109532a9b677f591506bc0892d822a316be98b75eb

        • C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll

          Filesize

          61KB

          MD5

          87fcc8c767b14cfb9694f1b44e53ac12

          SHA1

          ffdab636340acd70adcf5dfb3ef0b18f96fe6773

          SHA256

          3084a2b791363e0e337e0f709b609a40d2a6fa372a3c309858b486df473b744a

          SHA512

          87aaeb890a840e38838661401527e3b8ad3272d0b53bc88bac5c1097c0809156096080542fbf600a1ee0a4dbd05f99c722df993587c7475a894e54dfe1663fa7

        • C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll

          Filesize

          396KB

          MD5

          8bd1ac5c0a8485aa5cc28466e9b6f608

          SHA1

          d2a449d8f94854b4b27228de075a3ed4a6728283

          SHA256

          fdbac57ee45a4a26c0415ccbfd9d6290fabf01bce415ddef06195b8f87d017ea

          SHA512

          bffd918ff4354f7eeb64867230db18216452a313acfd0ac8000b56a2447eaf59d41d4956d43bd336d4a07f4bf309999949bd01949e26b942c015985a418b5898

        • C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat

          Filesize

          8B

          MD5

          1ce34e67180e7f2d233b274457cc1c65

          SHA1

          451a6c7c2ac52cb903d5325acccb52d29d92fe5b

          SHA256

          d7f50cd5214d75cad9d919e64c6c6e7e75b1a62066e6f09ac7432105b4c33e3d

          SHA512

          f969f37de5af5d033798a1824a8d7fcbc71e78d31c00d3995426c7004adf180b970702921c8d05f5a42f65e46223a9e606076c77db47720beb2bf02aeef221dc

        • C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exe

          Filesize

          115KB

          MD5

          b4ae238b4cfc1d258d6a210dbd58a063

          SHA1

          9e8f03864fda301715d8c64b8ed4f6ae92656387

          SHA256

          9fc877923d410fd78c82f0229e66bbb5a3963fbb3aa4132347bca0fa8d5c497b

          SHA512

          6ef0c3117bcb120be30c8d65a6d201492fce6ad22bee73cd9d8a6bbc3af524880b963519d6ca917991d4de5ccc0dd7bc66d28a663483c1f38a951e8d442346df

        • C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe

          Filesize

          51KB

          MD5

          eaacd7fe44a489ab8cf9ed4c0d25bb67

          SHA1

          f2e9d5c17dfc12c209ea0983fe6119e1c89f80b3

          SHA256

          ad54dfb579a0be80d2e284c614f90c174434cc27ec7f62a0dd28f5bd43ad1caf

          SHA512

          3e661349071fc5b922014723756321bb52ab7813644df6bc4ceb466b1b2918174e26abf5414b91b771cdf99673cca338e23afd0a9d7866d3e8749350f59ec98f

        • C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

          Filesize

          149KB

          MD5

          439ba76ebcf8f580f3f9992e095e6eb5

          SHA1

          10e228d683f64a7751b6c8ad7c776816dd35bbe1

          SHA256

          eb1907cb8502971ef485652a72d05b62eb9b758ba88125664405e47cc9adb0b5

          SHA512

          15a57ecb00a8aed4b0e42cb0c5a17dce6c3edc94d28c529ae631cb61add475e249a862ab31d2a46225017834d7d473a37b0f4324ce5f73aa32e3077427c87df9

        • C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll

          Filesize

          122KB

          MD5

          aecbae19ee26047b6c9e114c1ff794a3

          SHA1

          a73c5f3162df13675838b570800ca993b3c1a4ec

          SHA256

          ab8245767c2258174ce3f472338e5c3f7cf7d2c1115eb0f018508b4453345592

          SHA512

          6a8456c1c6e4aa675339871a0097cc88d6b80930ea022217d7f375ec49278b4790adae4a8dcd40d7f4b3717ec90ae131a87c32a7e415ef821022b50dc0761804

        • C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll

          Filesize

          167KB

          MD5

          d6b9def94d4c38adb3dd9a1a48a59e28

          SHA1

          a0357a88ccd2b5d276297eed365a4afa88e40c20

          SHA256

          52f65345a9764d55540103b67ab70c1e46f3ebe5840e4c825b22c13022719540

          SHA512

          912ad0966b3d1999f1d0257ce9221ee36e36ab900fd869511d46dfe60a7c5b2a2c3a7e9045e3ce326705fcd43a8cf283db3d355c1b07f33e7bb8d7a3e4d7224a

        • C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll

          Filesize

          114KB

          MD5

          f782f049b0e8c13b21f8e10e705bd7e5

          SHA1

          5c11f955e3983c50ea46b5d432c97c9148ac8e9f

          SHA256

          16c450a310edbea07f578f31368f168ec338011cd117406898593e86ebb83dae

          SHA512

          eed29c42b14ff26a030f53d61d6dc8e3971e478dc7646b26189f14f16699b6bedc170c4bcc37efe2e8f3048bde37480033b49eaf1a4712b88464f5da0efc18f2

        • C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat

          Filesize

          9B

          MD5

          f726542aded84023a13eb78929733a4c

          SHA1

          a6e6cc94faa58f8f9de95d6fcdd6a7ef8a86565c

          SHA256

          ca8a93db9b23da70acf8913f25b52c74ba3cb9a705de99e8cffeec3053c97316

          SHA512

          a0c11b133436d6f186c7ad44e307b7c7190b7c685c9e750e4d8eeb90e1c5efb9a6397ff575c998cf3d334a670b331b1ac5e30d6524e6c051e9a3fa5ddd367673

        • C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.dat

          Filesize

          6B

          MD5

          74c6677020fc6b6c867aab117078bf5f

          SHA1

          8c46db37dc0b39eb963d4144539c8b591e122400

          SHA256

          cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708

          SHA512

          3f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0

        • C:\Program Files\Malwarebytes\Anti-Malware\version.dat

          Filesize

          47B

          MD5

          a8961d95c4d25d8755dd1b7cd9663174

          SHA1

          866c1e29ed0b11c7b481a5c9ec8102657207135a

          SHA256

          2599e93ff1902d1996a2133d755241f17fceac539d2b287cece1636ecf98d97a

          SHA512

          6055491560e014dcca780879d3b5afe0db80cf904e76b83b3f867e02563b374a822e0fa1ae55d659d4e01ea22544868231dbb41e03d598bd0db963ad4a5fcc82

        • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

          Filesize

          1KB

          MD5

          1d02266e19e67b80b19bd8c66471294e

          SHA1

          09148eed2805db8aca5e84522601877d2e3a025b

          SHA256

          7e327003dc0b21671fd9144e4393842e757645e0d6edff7267cdb43fa4d8a7bd

          SHA512

          8c39c58707d3f81dc7a7991d89eb5d74400e6a89540190884f4f5ee94ab2b66d9cf13fee0448099fc904936cb05dc8623d67c17482ab7c39af8daf6000288498

        • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

          Filesize

          47KB

          MD5

          26ebd79b33d478762f2baa2c43cf3aae

          SHA1

          c00c419823a06a33a811d4af1f375573d469fcb7

          SHA256

          48d0b6815f5c3bde84dc11b67f51bf400b4a5c1cf721ef24f7dde7277cfdb92a

          SHA512

          b7d98aab25346bb3e8e1bec50c1eb4d54756c898beff25b2475a91e447b111a7be7c2294c625ce89dc4ded69f936306f37182155874bab892cc102b7e51cffb1

        • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

          Filesize

          66KB

          MD5

          3d106015e9b1c0f9baf2cbc124444925

          SHA1

          b899c5e0ba680c0e6b03fe8ae35b370ebf64c07f

          SHA256

          790cd92f0d034383e86a59e86539861041b78b002873882f7faaddc9bcd88490

          SHA512

          967bd352105ad5be87bd085f3e9e1b395088b5aa340972966f3c8adc71ccc1cad4fb2a94f3a20cc4c1ffb2bd5ebe91335d184b5960aca73d396d2f156c8a9000

        • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

          Filesize

          19KB

          MD5

          3f61fccd59b5912492d349c3a3013aa8

          SHA1

          7d82423e17f38f9e715e6a44be715f763f413a72

          SHA256

          d770156269e13c023ee21b863b4231cafab211ad7ae286db87003ca3fc8af14f

          SHA512

          d86167e5b43875a3ca50369ece0ac3002a294addd16e5b78be6062b40391893f3c514b51f6afd4d2b08e3bcdf12caca8ee2734de4cd167bd09da1dffb2fefe53

        • C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

          Filesize

          607B

          MD5

          9d71105678f4ae984db0a7ede526426a

          SHA1

          2e73d3ef5ad08c34f8e1675bc16bd615f5f3165e

          SHA256

          b5acebce7cabe137f7f750bce019bac742aed2ea735384bb35997550151f09f4

          SHA512

          51165a7f88eb93e3d87f06ff05c4f182583f1def7252e4decfa155598bc3065db3848cd7fa0ebb07127b724b2fa1eb6cbd8f5d6ec7fac74aa96e23bc3ec2433a

        • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

          Filesize

          847B

          MD5

          570045e8e9ede1d55f0f7f37b2dd1ced

          SHA1

          1a56e321c578c4ded3923ab516df427967827daf

          SHA256

          a9cde4f5d76a42a6a4dcee2130cf68163956d929780e85c1e15573e159f9cea5

          SHA512

          ceb9b7d23ccf57f8b72210c4f30feed7a123c53c52729224a7266c2e734869a131783eab32fdd2aa2e27ffafbdec4c3cd628e3686375cfce5a0cd87dd273f430

        • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

          Filesize

          846B

          MD5

          9c2086468c1c2a6674b8ba9166fd737a

          SHA1

          a2eff886be3adc298fee24c3fdd1351197c95182

          SHA256

          b4f586e9892e8c7a84cb416725ef259147333ee2fc1bc11a02d4d04a78abc46a

          SHA512

          66ec1e511268ec619ba16bc950b784f748d83bd65579d91b196f10fcf69b6e7eb2da7cdc7d8ed62e86037ce0c43a691426d3d693b88ac24b6414bb3c2d082716

        • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

          Filesize

          825B

          MD5

          690db695a5a2adb313faaa789425978b

          SHA1

          b9e15931bf5143fcbe1b4ea521b3f72035812e1a

          SHA256

          8eb973d73a24eccff06f159432b3304ad7ccb9d7f86fbb9c65306cc535bb5dfc

          SHA512

          03a719feffe8e5296ca3843c1460dc8139317d0b43929008f2f4b3bf27988774556f382bc59346a458ca9371a35fa415ea6b6998ecd5bdcd8d6d5d94b61885de

        • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

          Filesize

          15KB

          MD5

          054d10a118fd54dc3b1b99e4c3911a01

          SHA1

          afe28d58a39450c2e533f3494c55d08172637699

          SHA256

          c6b2ce0e20431b9de84691d2f31e84a8f2e29dded57be470632fc4f1115a31cb

          SHA512

          9e8834955b957a9b6c8c5e5202fb3b738cde54c2e005cc5a7a47e24355035c49b65bffbb226bcacc0d0cf68e8a0307d0f4787e2cabe77409224fb3f75509da50

        • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

          Filesize

          15KB

          MD5

          f2c0d88715712e50de8ad362e77f78bb

          SHA1

          7a55f9208af2cf7f5c1970d1a73d506e374dca25

          SHA256

          7f413d01e5897d3bde715424ee471ac1ab1ffb3bfec121b579c10757ae7c34ea

          SHA512

          2154a0a1ced46e05778912fee559cd02812ff8a478ea9e93a44f096165ce0287c0ef3df478ec1b4dd9d1cc91fb47a7acf146531e37875fc9ac227e843d52ee55

        • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

          Filesize

          1KB

          MD5

          0b0217a420fb20c7aaa61042cf7fa4fd

          SHA1

          81f2c931d22dd7a9209733f1d6740d58fd85ec47

          SHA256

          a6047e0026e0364e9e75219fd1507b0fb560411714f7733db17d8a6e2aaac2b7

          SHA512

          502f388def36d78b13ba97d3d79330333d581e05c3c685b0ae525e8c751c9cd11cf10e85581b97e9f072cfcba47a7e369c6ff1f5a819d9ae7c44723eb4c419a5

        • C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.json

          Filesize

          1KB

          MD5

          19e0815d9f8a5d00854de1fcb3a3a513

          SHA1

          457f4da922501198dcb6c99548a2432353f30dc6

          SHA256

          fc6e2a9e3b152e92b48ac5198b35673b8cea65045694979998fcd8cea0534912

          SHA512

          44a508b9ee60760699af9c6dd3e2a8c174505aeddb03bfe65e18d3a5ddb83282ef7cd7eb787b3c6377f119f7f6ac2d510c6ba313289e9e89905c9332ce2fadf1

        • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

          Filesize

          1KB

          MD5

          c60ccaf5af394904d23f0f6c0dd621cf

          SHA1

          531fbecc130db96e6e5d2ba6b15983040eb013a7

          SHA256

          1a528f0dabc8325715d4eb1974610808b08d8d0a1ca8d881a37c917292294c90

          SHA512

          8c8f4dc972ce06ceaac2afd62ef4b6b04462efbbe6135be8bcb0c66ada0ecf6ebf1b8a2ad3c5e12ef48e42052be0be57a3c3390c9384bfe7653edf1831dcb03c

        • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

          Filesize

          2KB

          MD5

          5953ea5e0103156b4709fd4588f705d6

          SHA1

          5c3ca4b4dc8067927c81298162e4ef6798cbe498

          SHA256

          69141c1eff69d48ce6bc9d958d937a0ac973459f2c08402f5cc7bf7f9db6f009

          SHA512

          269b859b44b5ec7fc6d18ee401e77f5040c6c6ecdd196de3b1a1a465c6fda4412c1b55ebf7063765feefc37a4ac132b34ab5011f6c2448fe671f722c3a86ee4b

        • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

          Filesize

          903B

          MD5

          329f682be71111a8e651286fa4024e1b

          SHA1

          ad0ff8bc473b8be05067b752945d9302c88c1ed8

          SHA256

          f7c41d10f4745222e71dd18b9152e1e091dfebb14f79b681c9751830885c1ac6

          SHA512

          1e346bcb1eadffa2c710044bca42a6796aa94de2b4f9d1bbbb598b6c80df2a71b18334cb7fdd81afe9aba1d9c8c94a5f2fe41788725d60100a7ed34c7132937b

        • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

          Filesize

          1KB

          MD5

          788f5c54d2eb520001b6dca723951934

          SHA1

          dc48cea99088319a06796f8e25dedc0391b2b4d0

          SHA256

          e1f535211945cad226b15c253839e81c44ed65252f31006d798c62c3a11ffce8

          SHA512

          51ba90009ca0dc97d8fd7dff917835272cda1a4a4098d648266193e467c51f63fe1f55636f0733f22a3e5b6f949d369b1fe88947a713371f3c6d41ddf4d94667

        • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

          Filesize

          2KB

          MD5

          5704b0ad64d6b74c12a71f59ffceb33c

          SHA1

          39612894c79f7d0d5f88ab79120f2549ac958840

          SHA256

          1014bda314e98fa65927ad3092ea877e725e87320fd73a4a6b447d05a962ea70

          SHA512

          39ea0d365cc4d2e2eabb1519a7bf2e37da504497bac54efc2ede2aae3455187dbd91db7b4f109621f6dc456690ada75e58a428feec41c35d97a7ab3d32296a76

        • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

          Filesize

          4KB

          MD5

          1aa9efd978f190ae3fcd47249bab72e0

          SHA1

          157db294acf7ac53467ea8366868aa8f8931f282

          SHA256

          1e69d3e7c5d63ec0a3e3f9d8042f2b6a83f4f17e60efe25e9fb8ac2679d5ce8c

          SHA512

          4eaa8b066e0d4f340c9030232bd2bcc2b55455b6e134759a9e43715f6be80b229ac7c0f17f4e9a56ed51fc425b7bafe38e4b2cf92600db266c8465cb952765a5

        • C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

          Filesize

          11KB

          MD5

          3c11f5ad1e83ed63e8897b80924d58e9

          SHA1

          fdf6e89c188534b44474c30aa825ba60256eef9d

          SHA256

          75a0727f4b48942acfe03b5b3cf8977ef56d368beed50baf922dab9293dffe29

          SHA512

          bcda196ff10eb87e7c27f0582eb6db7b8fac7bd2bd86e5f8b81635bf11e8e88936515925b2d977b50a8eeea89d8bb354d5e0bdc11e1322edbc49b8abaeffe895

        • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

          Filesize

          1KB

          MD5

          fb9e15830ce837f44f3ca109715718c4

          SHA1

          56cf3ce6256b2d8d49ad12d908a7730bff13f84b

          SHA256

          6c65181b8bf7cbdc31a9a131f5841b2893860568c02d5c639c6a8bfc0f548902

          SHA512

          4c2d47b926c0619ef6f922987e1050e15ec5f93d5fed6fe2d9700d1ce3ff83055b3b0f74aae0c0d56ab259104d286b87f8a393bed21453676481e08ae1aa19b4

        • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

          Filesize

          1KB

          MD5

          a63867b70080dd5f74369cf98bc9b59e

          SHA1

          029d552695f20e6bcdbbf4e375e29fd5191e9bb3

          SHA256

          93c44816f68554459832963dfc7c80e7e43af9d3e891b0cb9fa768f5c5b6b665

          SHA512

          b33e861010ad70743ec4c9624ac101e642635fbb4c16e57eddc0b795ae1e199df2f98c1073f7a4369ed0be6cac3d58373fb172fd937fd0dd3a3044854e70de4a

        • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

          Filesize

          1KB

          MD5

          72c64e9f3a98a5106c6b1cba4d9ba00e

          SHA1

          f42b27acafadfcc24dbd879ae601e954b46987ca

          SHA256

          35c57c8f7fe5024fa1b538bf7639945dd4e6e7540b2c9117424c0a32f91226b1

          SHA512

          9de2136be78e54cfaf7ca4aaf9894dd5c895ea34225bf88f074895b56d47b1597242a96b1b07ca1782d40cdf191c73f54596a193e7708e7e24b6ea61aa7f8b64

        • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

          Filesize

          1KB

          MD5

          da90d571e325bcbf52af28a595cf0131

          SHA1

          8c6970c2ac4f8ee030694e1b07c613ee44090aed

          SHA256

          bf9830aa27a84db2e67cdb20c4d5d16744cb0ba191cd7cdb15d8c4bf19f65d55

          SHA512

          a6f8a0ab6b58505d317c44eaf2c504a8e56c76657d27b7f2d5edace880d5420e574b07a03503e15851fcac7a606868b6f348afe03178de2ddb50ab19ca117a1f

        • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

          Filesize

          1KB

          MD5

          c68abc3183ba33a4b2b492a66316c41a

          SHA1

          2e6f37750927f9cc0ff618942482842bc1ad13f2

          SHA256

          b44a3a5ed697a7d849778c9474f68832992f3b60137a74857dd9bacc43a11d39

          SHA512

          1d69c53f0bf729955b19b5fe99e9bf7df5173e0f576124a686ed31a30d30d30d6711182ffb8fa3737706a15379c64a70a7503a02a74cbb03f4efe0ced53158a0

        • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

          Filesize

          1KB

          MD5

          6c830139b0a5e91bbf9d90f085f612ca

          SHA1

          8a483f82c9ec9c0bd916aa90fe535850c9935825

          SHA256

          a80060848f1ecf6d008f77b42bcab03706732caaa806ce8ab924a9c6961d9a3f

          SHA512

          04fcf8bdda2ac870b35e811a81c917d9f00ddf7d606ea37c9f1b0047d331c831614b411ed2794bfd71f466dbcb0b3be532087d91bb5d37c0d58d960eb3db303f

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll

          Filesize

          101KB

          MD5

          c18cba4e7e5ea7dfdc36bd5e3e1bcb78

          SHA1

          83218ef2626a4c26b7a7d47c6184927a7f6f13dd

          SHA256

          481f16ebe98fcecf4b0c5ba42762dcd4fe9cbb106643f798ddb473d1512ba647

          SHA512

          a78682d7efe11c67de418dd7684270ac69d5d78598ce886c09a4c80887308153d1eaf3d1d84c7356765db168561fd4dd84fd0ddc8da2bd5bb0071b78dadb1818

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll

          Filesize

          242KB

          MD5

          9df6a27ab94c7ad420b9a6d4d5ee1c2f

          SHA1

          d9838e42660be7d20bdaa5be93c31ececa750b94

          SHA256

          d2fd6e7ba6c4ab5198071d74baa2e9dfb85a5d4a861b362289879cde14511c12

          SHA512

          ca35468330df579f715c2bebb3add49fb714cb218b246180a6fea3e04a3b017c2727f1124f9003139f84b01cecb9abbcb46f154f465a2ec693059952aa92c4cb

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nm

          Filesize

          188KB

          MD5

          083e4a45ce48c397a5bb420d1f9f241d

          SHA1

          7086a4ecb2c2ee63c175cb605a020c206ba49920

          SHA256

          366bdf435ab5b6150984ca3935b2d19899146af0490055cea17cf1a410b3917a

          SHA512

          677fa9391758384522bb5070c69938e41377792bdaf0fd20ed1d88b4b2b32a66f83c0b309588a4a140d696cdaa4b5b97d35fb424fb92199ebc28db381ded6035

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.sr

          Filesize

          289KB

          MD5

          62b9366315846b9343d3bd4904574c7c

          SHA1

          94202fd156af82e276e626a3dfabbd9734eaab5b

          SHA256

          a41a522cbf7163ee067904d1f687bb856907930eb5e5bcaa3975c45cb2455614

          SHA512

          19c3dfc082f73b9978fae871ef8a66da24cecd0631235b5f123cba43a45899c584929812f4de0388a5dda90ad1f2ebf1a7585664b7a1ae7c41c88a40a165c474

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.bin

          Filesize

          1KB

          MD5

          86e218784196fe0b6472cd0f20a85069

          SHA1

          8a5404e5b49624a5a6c289b299f98c4b72720968

          SHA256

          9aa9ffbaf7126a0b23ddacfaf7f576c85b5a3c3a7d57eac636e73af8842c0902

          SHA512

          1db35f7d6414fb6ceb486c0361ad394dd4f75d73925b17ffedb07d20b2cc264da33a1e9ff2306dc87ddba81099d5dd2c06b0e399de912d6bfa464c62c9ad777f

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe

          Filesize

          149KB

          MD5

          5e3576fab7ff547b829eb31069d7c623

          SHA1

          0e80ba34efdc2f31592abde44ba088a63a09912c

          SHA256

          7a6e884c42f0f8994abf481918c45c515d176890269feb693a78b5aa4f7baea4

          SHA512

          2f613b705ba920e1e6fec4eea03f714a6fbb2d882fd7f223d7584c072f1929cd2f64082cff85194f15488cc340a22db8c665933f5a21bffcd4339eae56e61e9f

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdb

          Filesize

          110KB

          MD5

          0dae53f7fcf6dd988e46d7ad0433ce94

          SHA1

          ef658cb48239fd4a7974696110aa68672973fa8a

          SHA256

          a01e0acd66468c2d896801de8e4a99ab3cd92803a3910c1960ecf23cc3fe4a5d

          SHA512

          144922e03e85c7c082e798be06200acd31bbbd8bd51e4bb81c608a4358f2a8ff67841a7cdc0e5802102aba76eb7d9a6d461d97d2ba9572ad5f1d6039bf0b989d

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll

          Filesize

          211KB

          MD5

          c50df600d88b240e0e9de1d8b81911ac

          SHA1

          674c6ccb6be789cc2ef04f1e0170bc843b07e7f5

          SHA256

          c07feb3b610a2957faee4ba813ba9d3ed6473719551bb960cea10a59b1a4af3b

          SHA512

          2dc701766068008e47970d8732c01c41fc994ec04f5ec8fd7b217975df3c991fcf8cbc4d8b05417946d74a930bd348601d293880bc69726b10da3398e3eb23cf

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdb

          Filesize

          159KB

          MD5

          3bae4377013da0b2325e99b8045bbcb5

          SHA1

          42bfea9eeb523b01ce0634b193cc95e93341e2d2

          SHA256

          53fa4da3cca0d6617c2b25882f5025bab5a85d43129501cb84d3f8d1fc1ea07f

          SHA512

          d32f2706954118817f214a7ec63a59faec3a7fb265fd489ddc56d2c31ce5e1d501a09cdd1ae5746d6b69a5f180620360855a984de2dcb6f12e5f8af825103c3e

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdb

          Filesize

          166KB

          MD5

          abe4b26405e9daeecad97ab201f26c5a

          SHA1

          c6570ccf4d3d22474ef281ed423319b234719a9a

          SHA256

          2f52521deeb40ead7e8a6571147dfb4a60c7f003885ba54fb4677d8743abe207

          SHA512

          7f9a11353b9330e55ffa2e521d5a2c4308b891862f1303da2102645c55e7c7d327c051ce411c42e867ff88abf83e3374ca1763338e7239e495d92cf65995374c

        • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdb

          Filesize

          166KB

          MD5

          e4d0f8db97a4dd2f129bd0f870eb81cf

          SHA1

          92524698a8bd28db377799352acafdbe333377cc

          SHA256

          5eeff2d566abc0004eb6dd6e01cd0d9fdd7e36a23b1e833da0afe457a6cd24d4

          SHA512

          d1c328dfafb7a4aa6552c61213d25fbd2a97ec659cf860cbee21758a7037abbe67f0f05a0cfc65b528f2efccc52b1de25a4286af43f3ff1e724f60187f82a17f

        • C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat

          Filesize

          74B

          MD5

          d99b2a7323b0076d0ccc240c912c04f9

          SHA1

          2f2b002c26b839aac354231f6418d259fceac41b

          SHA256

          062137d54fca0232f1e38ce49dc8a081ec845b7671245a9ce918d8fb2ed1b76c

          SHA512

          e3fb27e7f90fb54f7fb0d5483ff89918e4549b32ca6342ea06593decd9fecd94bab0dc44d2d2894422925b2e0de3f75d4450ecd0620c81e40fea2fb3e346038f

        • C:\Windows\System32\CatRoot2\dberr.txt

          Filesize

          149KB

          MD5

          b0fb9e628234c892bb8a2f5ce30890ea

          SHA1

          0ec85fad4b8172c2905114846d140f85b0aa16d7

          SHA256

          68cd3fa3144587b1b1112f2097fd9e257f13e46db14509b0cb74352d37ba1607

          SHA512

          f07f2ede46de93dcde4d126f9b4a1e433b87a0f450c5a197ae0cc0889fb521a375a2bcf1c47aeca0b9f8d4d82e831befcfbeefa77ba7ed0a4e3e1ba1cf6ae8cd

        • C:\Windows\System32\drivers\mbamswissarmy.sys

          Filesize

          75KB

          MD5

          5e39424faa300d30a26e7a16f3074492

          SHA1

          ce62181dafd78bf497a943bee5518742cfcaa9fa

          SHA256

          fada342a85aa9a7db377b9f047d34769a0e4705f714c71f54bf420fc055013b4

          SHA512

          cb4244ec1eddfad1e4279f9ef3e7b8b6ae17f04f017e702de9c85bef25d36c7b8256555f39626aef0828601423f9649ee998fd7f3f78613a5b26a9bfac312964

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\7z.dll

          Filesize

          1.6MB

          MD5

          ab8f0c1a37c0df5c8924aab509db42c9

          SHA1

          53dba959124e6d740829bda2360e851bcb85cce8

          SHA256

          6e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5

          SHA512

          ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\ctlrpkg\mbae64.sys

          Filesize

          154KB

          MD5

          95515708f41a7e283d6725506f56f6f2

          SHA1

          9afc20a19db3d2a75b6915d8d9af602c5218735e

          SHA256

          321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6

          SHA512

          d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\dbclspkg\MBAMCoreV5.dll

          Filesize

          4.3MB

          MD5

          394e873ee2702dc3a1db16a5f4c50500

          SHA1

          f03ebec702e229602fe719b2d73a019aa6532182

          SHA256

          b7ab4ecd13954ea2017e4141f861bf2e4747215d65c82cc419c278de5e05a2af

          SHA512

          7a154ed1a2ae705c808b6531ac8b2aa0c843e6d21e54319b4df59d4f54dae9c004364c5e20ff1850d134f177db6cc97d0933d5e7d97f41dfa98cf0a91c47c499

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\servicepkg\MBAMService.exe

          Filesize

          4.5MB

          MD5

          27764a5062d133aaa39ec91f5d816c69

          SHA1

          8d55ca536990c068d38c9f0cef0c53ffd785e620

          SHA256

          cbe950298ea427c7675506a441dba24a4213714f34415be85554f417cee33bae

          SHA512

          c6cf76a9de54fabb61e5addf16b6c59bb7876d88cde226f159223faa72698241333afc070b5d95ebe8ce4b81ce3f73d35dac8bc785e48a8a6caf10daa9c9c9b5

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\servicepkg\mbamelam.cat

          Filesize

          10KB

          MD5

          60608328775d6acf03eaab38407e5b7c

          SHA1

          9f63644893517286753f63ad6d01bc8bfacf79b1

          SHA256

          3ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59

          SHA512

          9f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\servicepkg\mbamelam.inf

          Filesize

          2KB

          MD5

          c481ad4dd1d91860335787aa61177932

          SHA1

          81633414c5bf5832a8584fb0740bc09596b9b66d

          SHA256

          793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3

          SHA512

          d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\servicepkg\mbamelam.sys

          Filesize

          20KB

          MD5

          9e77c51e14fa9a323ee1635dc74ecc07

          SHA1

          a78bde0bd73260ce7af9cdc441af9db54d1637c2

          SHA256

          b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0

          SHA512

          a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\servicepkg\mbshlext.dll

          Filesize

          286KB

          MD5

          a17247ff9f5c6ea69f58d2070a65c240

          SHA1

          5c79a32c283b6e22f404ff597e8427b7563f5315

          SHA256

          384bcd255a1f0e45b33332fe36dae42d461759989bc4d10311944826e1f6dad7

          SHA512

          47cf10ba62bd6672d3bfc45bd664fa2c3d7093c2ec7c54b32de5516db491583f5140fb8a7b05551b3b7d514b0140bc2c39db002b88190727ea671a94b201a111

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qml

          Filesize

          1KB

          MD5

          d8c9674c0e9bddbd8aa59a9d343cf462

          SHA1

          490aa022ac31ddce86d5b62f913b23fbb0de27c2

          SHA256

          1ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7

          SHA512

          0b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82

        • C:\Windows\Temp\MBInstallTempdfbfa458c45111eea6baf252aa825e28\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qml

          Filesize

          1KB

          MD5

          829769b2741d92df3c5d837eee64f297

          SHA1

          f61c91436ca3420c4e9b94833839fd9c14024b69

          SHA256

          489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0

          SHA512

          4061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521

        • memory/2024-4039-0x0000020AF6E10000-0x0000020AF73B4000-memory.dmp

          Filesize

          5.6MB

        • memory/5480-4036-0x00007FF8F0020000-0x00007FF8F043E000-memory.dmp

          Filesize

          4.1MB

        • memory/5480-4037-0x00007FF8EFAB0000-0x00007FF8F001B000-memory.dmp

          Filesize

          5.4MB

        • memory/5480-4042-0x000001DF3DE10000-0x000001DF3E010000-memory.dmp

          Filesize

          2.0MB

        • memory/5480-4041-0x000001DF3B3D0000-0x000001DF3B3E0000-memory.dmp

          Filesize

          64KB

        • memory/5480-4038-0x000001DF3D9D0000-0x000001DF3DE10000-memory.dmp

          Filesize

          4.2MB