Resubmissions

23-07-2024 17:59

240723-wk4grs1hrl 10

23-07-2024 17:56

240723-wjg75svcla 10

23-07-2024 17:55

240723-whgvzsvcjg 8

23-07-2024 17:52

240723-wf3pns1hll 8

23-07-2024 17:45

240723-wbtafa1gpr 10

23-07-2024 17:42

240723-v97eaavane 10

23-07-2024 17:40

240723-v8625a1fpm 8

23-07-2024 17:39

240723-v8bafs1fll 8

23-07-2024 17:36

240723-v62dvs1eqq 10

Analysis

  • max time kernel
    236s
  • max time network
    333s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-07-2024 17:45

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 6 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets service image path in registry 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 13 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 19 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3140
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
        2⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:588
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb64499758,0x7ffb64499768,0x7ffb64499778
          3⤵
            PID:1896
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:2
            3⤵
              PID:1288
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1912 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
              3⤵
                PID:1412
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                3⤵
                  PID:508
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:1
                  3⤵
                    PID:2280
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:1
                    3⤵
                      PID:2296
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                      3⤵
                        PID:4464
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                        3⤵
                          PID:4704
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                          3⤵
                            PID:4868
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5288 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                            3⤵
                              PID:4964
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5336 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                              3⤵
                                PID:2480
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5556 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:1
                                3⤵
                                  PID:1276
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5548 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:1
                                  3⤵
                                    PID:2916
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5744 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:1
                                    3⤵
                                      PID:1148
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3096 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                                      3⤵
                                        PID:4700
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6112 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                                        3⤵
                                          PID:4228
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                                          3⤵
                                            PID:1756
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3128 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                                            3⤵
                                              PID:4000
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6092 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                                              3⤵
                                                PID:4144
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                                                3⤵
                                                  PID:4376
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3096 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                                                  3⤵
                                                    PID:3800
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3672 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                                                    3⤵
                                                      PID:356
                                                    • C:\Users\Admin\Downloads\MBSetup.exe
                                                      "C:\Users\Admin\Downloads\MBSetup.exe"
                                                      3⤵
                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                      • Drops file in Drivers directory
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3908
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4492 --field-trial-handle=1736,i,13272842327112909730,125616362115436564,131072 /prefetch:8
                                                      3⤵
                                                        PID:2144
                                                    • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                      "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:4220
                                                      • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                        "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:5400
                                                    • C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
                                                      "C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe" --ContextScan "C:\Users\Admin\AppData\Local\Temp\mb_C2C9.tmp"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3340
                                                      • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                        "Malwarebytes" --ContextScan
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:4244
                                                        • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                          "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" --ContextScan
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:5344
                                                    • C:\Users\Admin\Downloads\DeriaLock.exe
                                                      "C:\Users\Admin\Downloads\DeriaLock.exe"
                                                      2⤵
                                                      • Drops startup file
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5488
                                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                    1⤵
                                                      PID:5104
                                                    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
                                                      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
                                                      1⤵
                                                      • Drops file in Drivers directory
                                                      • Executes dropped EXE
                                                      • Impair Defenses: Safe Mode Boot
                                                      • Loads dropped DLL
                                                      • Enumerates connected drives
                                                      • Drops file in Program Files directory
                                                      • Modifies Internet Explorer settings
                                                      • Modifies data under HKEY_USERS
                                                      • Modifies system certificate store
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4156
                                                      • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
                                                        "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        PID:4764
                                                      • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
                                                        "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
                                                        2⤵
                                                        • Drops file in Drivers directory
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Modifies registry class
                                                        PID:2092
                                                    • \??\c:\windows\system32\svchost.exe
                                                      c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                      1⤵
                                                      • Checks SCSI registry key(s)
                                                      PID:2416
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000168" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:3972
                                                    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
                                                      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
                                                      1⤵
                                                      • Drops file in Drivers directory
                                                      • Sets service image path in registry
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Enumerates connected drives
                                                      • Drops file in System32 directory
                                                      • Drops file in Program Files directory
                                                      • Checks processor information in registry
                                                      • Modifies Internet Explorer settings
                                                      • Modifies data under HKEY_USERS
                                                      • Modifies system certificate store
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1788
                                                      • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                        "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow
                                                        2⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:6064
                                                      • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe
                                                        "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no
                                                        2⤵
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        PID:1872
                                                      • C:\Users\Admin\AppData\LocalLow\IGDump\sec\ig.exe
                                                        ig.exe secure
                                                        2⤵
                                                          PID:5160
                                                        • C:\Users\Admin\AppData\LocalLow\IGDump\sec\ig.exe
                                                          ig.exe secure
                                                          2⤵
                                                            PID:500
                                                          • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                            ig.exe reseed
                                                            2⤵
                                                              PID:3476
                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                              ig.exe reseed
                                                              2⤵
                                                                PID:5628
                                                              • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                ig.exe reseed
                                                                2⤵
                                                                  PID:3048
                                                                • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                  ig.exe reseed
                                                                  2⤵
                                                                    PID:5888
                                                                  • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                    ig.exe reseed
                                                                    2⤵
                                                                      PID:1408
                                                                    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                      ig.exe reseed
                                                                      2⤵
                                                                        PID:1904
                                                                      • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                        ig.exe reseed
                                                                        2⤵
                                                                          PID:2964
                                                                        • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                          ig.exe reseed
                                                                          2⤵
                                                                            PID:2168
                                                                          • C:\Users\Admin\AppData\LocalLow\IGDump\sec\ig.exe
                                                                            ig.exe secure
                                                                            2⤵
                                                                              PID:4260
                                                                          • C:\Windows\System32\rundll32.exe
                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                            1⤵
                                                                              PID:5608
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              • Modifies registry class
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:688
                                                                            • C:\Windows\system32\browser_broker.exe
                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              PID:1324
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:712
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              • Modifies Internet Explorer settings
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2528
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              PID:4720
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3116

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dll

                                                                                Filesize

                                                                                4.8MB

                                                                                MD5

                                                                                215eb0aaf99043f36c9132cbe49204e5

                                                                                SHA1

                                                                                2db6e49c8c32cbfc560f2d24f5223ff23d18b12d

                                                                                SHA256

                                                                                15855cbcfd3188012c3748991041c4b7e8f65ed3278f0ad74aba1a1bb9ce0bf9

                                                                                SHA512

                                                                                4bc9084e61a52cf8ce189bd7234d29f3105e4baa9854296eec51b2e892031a12a36259c3e94aeed404fdaa887b2abfe95d6b5af686704c8c9dab7d7303b3871d

                                                                              • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll

                                                                                Filesize

                                                                                4.2MB

                                                                                MD5

                                                                                03d6455dc6934a409082bf8d2ce119d5

                                                                                SHA1

                                                                                995963c33a268a7ed6408c2e6de1281e52091be2

                                                                                SHA256

                                                                                82ca2aec64fe151efd59a838c1845111bfb9f94ff277be3afae4e3f684ef3a62

                                                                                SHA512

                                                                                a0ff71bc01a11c9a95c1a0186a7bbfec9c3f84d7e600d0bca877934fa5f84053627bc59bb355f53ce9e3c9e4c6a841b8f5cb7436fe7f43b63426a8a851392c6d

                                                                              • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dll

                                                                                Filesize

                                                                                4.3MB

                                                                                MD5

                                                                                26e2306862a3e09489e224b8c7c08b4a

                                                                                SHA1

                                                                                31b054b957d27ea4b2e3270ebfe7cf62e32890f8

                                                                                SHA256

                                                                                c8aca420097260a96d04398a90f7c346f0b1abf94a44ffa539050e4dd06259f0

                                                                                SHA512

                                                                                604c980476b386d5efad2ed273a840fb92dc40bcbee78c9f2fe9d300437978c8b47b2d44e903b43c3b1127c276fbf58fd823342850e6d3effc038acb0f6b1202

                                                                              • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdb

                                                                                Filesize

                                                                                14KB

                                                                                MD5

                                                                                5b41dd0854cb72af6ed577845f90219d

                                                                                SHA1

                                                                                bcc21ab1fdaf1a8c17aeac4066c71b6b1c62fcc7

                                                                                SHA256

                                                                                0522cc557d2c96457a07009faa40dffc414da8f27f5aebd953448a6dc255210f

                                                                                SHA512

                                                                                c1eb45a5708bf892644a8bb3c016a59fb26401e879335a29d0c879f37db604679e5abcc59bffd8163c9ff3e76c783e98dff701943ad1ee99915e04ee87b55755

                                                                              • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.dat

                                                                                Filesize

                                                                                924B

                                                                                MD5

                                                                                2258c5ca4a829f25716f6a160aff7055

                                                                                SHA1

                                                                                ad73eb509001256d0e01a099b43077b8cbf607a4

                                                                                SHA256

                                                                                a4a35a22fe9ee3379477f2eb0bead9d8e30016400813b8a5cec76505837f2b95

                                                                                SHA512

                                                                                b1b5dc5e6302ae8f008eb9f352b8dbb9e31ff2c10c64eb316c6957856d7ea1b234c00fb407be69df08d4e4b718e8a51b46cbf28b4b10d659742bce40ee05c063

                                                                              • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.dat

                                                                                Filesize

                                                                                514B

                                                                                MD5

                                                                                cb4133e97547f2211fd2a54290e9dd79

                                                                                SHA1

                                                                                f7e22acec333d249b92cf7cdc8acf757bf24a0f2

                                                                                SHA256

                                                                                e00ab646b7ab927dd1ba7445ccf347449c06be99a72f76f68b96544f64abec2d

                                                                                SHA512

                                                                                038c743359cf6e20dda518d1c054817359968bf1d15596a6b1a145757069a700a2eb19a9e2c821098c4cd0b25ff0bc430a0257fad4141769a1df62e30b207bc5

                                                                              • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdb

                                                                                Filesize

                                                                                24B

                                                                                MD5

                                                                                546d9e30eadad8b22f5b3ffa875144bf

                                                                                SHA1

                                                                                3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

                                                                                SHA256

                                                                                6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

                                                                                SHA512

                                                                                3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

                                                                              • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdb

                                                                                Filesize

                                                                                24B

                                                                                MD5

                                                                                2f7423ca7c6a0f1339980f3c8c7de9f8

                                                                                SHA1

                                                                                102c77faa28885354cfe6725d987bc23bc7108ba

                                                                                SHA256

                                                                                850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

                                                                                SHA512

                                                                                e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

                                                                              • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdb

                                                                                Filesize

                                                                                9.8MB

                                                                                MD5

                                                                                6d1883e6aaed4a55eddb4f68bfead38a

                                                                                SHA1

                                                                                8dc8dd3d270aa8c6cfb3a1ccba948b3e67b109dc

                                                                                SHA256

                                                                                4721616829bd155f77890a6e164ef0cc2ffb68d243c9863fc2f7905ad94b6c54

                                                                                SHA512

                                                                                cb206f623c5a5d36d12676d7921a4a9ed651ea2e31eca97e74c92e25a2fb08bfe71c797501f8a171f252c501c446a3d835f8d014c21379c99fcd4084c2f72fcd

                                                                              • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdb

                                                                                Filesize

                                                                                855KB

                                                                                MD5

                                                                                d94ffeb3c87c18339024648cd7b00204

                                                                                SHA1

                                                                                e5fcfc0ecdc58362a9a2760fa0e3a93c5e81c542

                                                                                SHA256

                                                                                78b5bc7f75458b6fd63f816e63cf64dab063ea28ee85037860fa7fa791257b35

                                                                                SHA512

                                                                                4aff140452c640c15251339649653e04907f2ad47610832e6c2573e87bbffdef15ea33d05bb0ddc756feae0fb376c22aa1149be43582ab70a27edc4b401cd9cc

                                                                              • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdb

                                                                                Filesize

                                                                                169KB

                                                                                MD5

                                                                                015a876591dc3e66749f2ce074ccf2b4

                                                                                SHA1

                                                                                1ae93ae81013fe7cffbb8e02289f40b6ae09bd0a

                                                                                SHA256

                                                                                d42e60a73b6b149de9b1ebc2bae038f5dff19daab4c9d6330901e965dfc1daf8

                                                                                SHA512

                                                                                2da065c5be0496c7a55a23885ace2710061f73c7906ad6d3c9d7a0ed58039c3b0cfabb8137d7e8ef288a810b63a714397093f0e1d0e58510db149affbb539659

                                                                              • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdb

                                                                                Filesize

                                                                                24.1MB

                                                                                MD5

                                                                                cae93413ca7d40279c27936499697df3

                                                                                SHA1

                                                                                e4c50d86f05855db03a6da6d11aee011342552ea

                                                                                SHA256

                                                                                5c63a63a6b94795e2f9fe0c3a009b6734100ed8895a168ae611d323f25e55d84

                                                                                SHA512

                                                                                0e7ef9311ac6e9d02433dfc9a5499a82deb4214d9c1dc92257cdeaf732562265e9235d33ddb940f5c5f04dfcf403b7cb4ae685ea69f3e66b2c84e27159bc4396

                                                                              • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat

                                                                                Filesize

                                                                                10KB

                                                                                MD5

                                                                                8abff1fbf08d70c1681a9b20384dbbf9

                                                                                SHA1

                                                                                c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6

                                                                                SHA256

                                                                                9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658

                                                                                SHA512

                                                                                37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f

                                                                              • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys

                                                                                Filesize

                                                                                107KB

                                                                                MD5

                                                                                83d4fba999eb8b34047c38fabef60243

                                                                                SHA1

                                                                                25731b57e9968282610f337bc6d769aa26af4938

                                                                                SHA256

                                                                                6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c

                                                                                SHA512

                                                                                47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\MBAMCore.dll

                                                                                Filesize

                                                                                6.3MB

                                                                                MD5

                                                                                0ccbda151fcaab529e1eeb788d353311

                                                                                SHA1

                                                                                0b33fbce5034670fbd1e3a4aeac452f2a2ae16eb

                                                                                SHA256

                                                                                2a6ac5a8677bd1b410420183169b9ca9ec87dbb78ce0f11ebac2bfa022df7c70

                                                                                SHA512

                                                                                1bf9b8849b27491ecadfb4caf4e61926f9a0a8479c247a2281ba2d7c1ae0587251330ee29cc053630047e279ef6b52d3a125e21144b9688f1328f101bfc3c2e9

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

                                                                                Filesize

                                                                                8.6MB

                                                                                MD5

                                                                                6ab839ac143e5f204717cdb18cb6791f

                                                                                SHA1

                                                                                6fcdb9bec5c4a88a86bd9968b5c7dfeb2ecce990

                                                                                SHA256

                                                                                c11b797ea3c8542cb9d4458db0aa85a72751159ea9c909e5392feb7a822b6188

                                                                                SHA512

                                                                                6efffc2f48a078407fdec98b89dfe821e2a1ed49902c72e1b3bf3fce316cc1a7a9cf4813425a35beb86e937f17c559bf82bf26baed38834b1a9b03c125b30cd2

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

                                                                                Filesize

                                                                                2.9MB

                                                                                MD5

                                                                                46f875f1fe3d6063b390e3a170c90e50

                                                                                SHA1

                                                                                62b901749a6e3964040f9af5ddb9a684936f6c30

                                                                                SHA256

                                                                                1cf9d3512efffaa2290c105ac8b7534026604067c9b533e7b7df2e017569a4ec

                                                                                SHA512

                                                                                fdfb348061158f8133380e9a94215f4bfc0f6ce643a129d623cb8034c49144f1489de56cd076da645478506d9fbddc7590fe3d643622210084b15fdf0d16b557

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

                                                                                Filesize

                                                                                289KB

                                                                                MD5

                                                                                7860e3970ea0b5feca1d717352d8f5b2

                                                                                SHA1

                                                                                3e983bfc91cfa0db588b48cc8eb5bdb139a989a9

                                                                                SHA256

                                                                                6838db5da53801d4c6e11a5a2f736ef241e18a973cf058805ea8e1818ddace22

                                                                                SHA512

                                                                                5f34d0a53df82b9383b11eaddb3e90495d7c5d51a8ad9911c51057e5234d5ead11861538b106e4f8f43a90cd416f7198a7e67d46261f2135518b5b221672d644

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

                                                                                Filesize

                                                                                621B

                                                                                MD5

                                                                                77864ff38f3a0fbd684e8abf12b9a9c3

                                                                                SHA1

                                                                                ab7a402820d225a59a4aae323ce5d357a9502277

                                                                                SHA256

                                                                                23dcb6c76fb0cfa4dd40f3d8205dae6fcd7e33eff3d8e3c146603547bc38d88c

                                                                                SHA512

                                                                                b05ef2d699941d3665628d27b37b9b1377ae7e8b864ab5d3c2ea2f0db5f06198831ecbebf9ffb56e9beb78cc14e50cfc8c868a626d7a7f66b15e404aa39bcce6

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

                                                                                Filesize

                                                                                654B

                                                                                MD5

                                                                                d3036af7e4e6cf9978c0a87b93e4ac48

                                                                                SHA1

                                                                                d26bded0b737e0712191dc9dde1926e1bde5d918

                                                                                SHA256

                                                                                1d604cd707de8cc6265a5e2d03975a78364e2d5fe0cc55398a4255d7cf9aace3

                                                                                SHA512

                                                                                d4e65f59e619d3cdf5592e79bcbd869264a92c7862d93560f565d087df88d94baae87972d72856d16ebbc69b734c9768d678666dd7545a51e603844792ed64dd

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat

                                                                                Filesize

                                                                                8B

                                                                                MD5

                                                                                0b674601f7b05d903b1fd9240dcab05e

                                                                                SHA1

                                                                                967d0951906268c1de5338c22c8f717a6842c37c

                                                                                SHA256

                                                                                993410fed220fad8d480d612bd871002bc5999430cca7b43d96bf6dc7ad1a611

                                                                                SHA512

                                                                                f421035305f6caf745c5c4b0a72cfb6495c13317cc5eed2de3f55fb5329b2874bc0bb399562c9d0763d6230c22dba09fc43f1f64c8d77438ecd86cce1d780ee8

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\expapply64.dll

                                                                                Filesize

                                                                                473KB

                                                                                MD5

                                                                                76a6c5124f8e0472dd9d78e5b554715b

                                                                                SHA1

                                                                                88ab77c04430441874354508fd79636bb94d8719

                                                                                SHA256

                                                                                d23706f8f1c3fa18e909fe028d612d56df7cd4f9ad0c3a2b521cb58e49f3925d

                                                                                SHA512

                                                                                35189cc2bf342e9c6e33fd036f19667398ac53c5583c9614db77fb54aadf9ac0d4b96a3e5f41ec7e8e7f3fe745ae71490bdcf0638d7410b12121e7a4312fae9e

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe

                                                                                Filesize

                                                                                3.9MB

                                                                                MD5

                                                                                dfd900def4742b3565bc9aa63ec11af5

                                                                                SHA1

                                                                                c1cefc356045ccf20ebc98f6c48b2a85f0d32465

                                                                                SHA256

                                                                                eae4a33cfa155a9f5f520816b42dc4f4012d5c7c916dc756b3de025a3062a461

                                                                                SHA512

                                                                                bb2b4daa121dab894ad036648eff6f81e9be97840b4be7ba54b7df0383cf863b157d6088814a0d63c7523751f8c68d9b5c1f247512d7587348750c1b71ef3b3e

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll

                                                                                Filesize

                                                                                2.7MB

                                                                                MD5

                                                                                b7e5071b317550d93258f7e1e13e7b6f

                                                                                SHA1

                                                                                2d08d78a5c29cf724bc523530d1a9014642bbc60

                                                                                SHA256

                                                                                467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064

                                                                                SHA512

                                                                                9c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll

                                                                                Filesize

                                                                                2.8MB

                                                                                MD5

                                                                                2bbf63f1dab335f5caf431dbd4f38494

                                                                                SHA1

                                                                                90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0

                                                                                SHA256

                                                                                f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364

                                                                                SHA512

                                                                                ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                5d1917024b228efbeab3c696e663873e

                                                                                SHA1

                                                                                cec5e88c2481d323ec366c18024d61a117f01b21

                                                                                SHA256

                                                                                4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8

                                                                                SHA512

                                                                                14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll

                                                                                Filesize

                                                                                113KB

                                                                                MD5

                                                                                2ccb84bed084f27ca22bdd1e170a6851

                                                                                SHA1

                                                                                16608b35c136813bb565fe9c916cb7b01f0b20af

                                                                                SHA256

                                                                                a538caf4ac94708ddb4240d38b1b99914ca3e82283f0d8a2290be28fc05eaccb

                                                                                SHA512

                                                                                0fd66d241bdebd0052f4972e85b42639e3c5a40affe23170b84bc4068dff8e84446898a77ebf7cc0bef97454abb788faccce508a68bc5e717980ef26d8436986

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat

                                                                                Filesize

                                                                                10KB

                                                                                MD5

                                                                                ddb20ff5524a3a22a0eb1f3e863991a7

                                                                                SHA1

                                                                                260fbc1f268d426d46f3629e250c2afd0518ed24

                                                                                SHA256

                                                                                5fc1d0838af2d7f4030e160f6a548b10bf5ca03ea60ec55a09a9adbbb056639a

                                                                                SHA512

                                                                                7c6970e35395663f97e96d5bf7639a082e111fa368f22000d649da7a9c81c285ee84b6cf63a4fccb0990e5586e70e1b9efc15cf5e4d40946736ca51ec256e953

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                d87c2f68057611e687bdb8cc6ebea5b8

                                                                                SHA1

                                                                                27b1311d3b199e4c22772fa1b7ea556805775d37

                                                                                SHA256

                                                                                ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8

                                                                                SHA512

                                                                                4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys

                                                                                Filesize

                                                                                233KB

                                                                                MD5

                                                                                246a1d7980f7d45c2456574ec3f32cbe

                                                                                SHA1

                                                                                c5fad4598c3698fdaa4aa42a74fb8fa170ffe413

                                                                                SHA256

                                                                                45948a1715f0420c66a22518a1a45a0f20463b342ce05d36c18b8c53b4d78147

                                                                                SHA512

                                                                                265e6da7c9eede8ea61f204b3524893cf9bd1ed11b338eb95c4a841428927cccbed02b7d8757a4153ce02863e8be830ea744981f800351b1e383e71ddaad36ad

                                                                              • C:\Program Files\Malwarebytes\Anti-Malware\version.dat

                                                                                Filesize

                                                                                47B

                                                                                MD5

                                                                                165aa2c2c3713c7b402f640542001866

                                                                                SHA1

                                                                                c98742f08dc426fbabb7796487d6a6da1c121c2c

                                                                                SHA256

                                                                                585c0b5b2da564da335c938778050f718ee7fa747a90164582f9c503e195eccc

                                                                                SHA512

                                                                                28db917f9015b3ef08d2a8772ae2fc223372e6560431ca6f6a9e3aaa1e4ee28ae3691757cf98b4477a191bf70ed826506ddba50723dedae9abead797acf39d3e

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\AdsInfoCls

                                                                                Filesize

                                                                                72B

                                                                                MD5

                                                                                7dcf7f16af4c24d6fb2956354c1161c1

                                                                                SHA1

                                                                                1bd2c2d1b06cc38064464ff488e6868f6881c903

                                                                                SHA256

                                                                                513eea9388ec8cf174cd3123815dd84bd421179e7c0942eeb6e0a51759dbb1a8

                                                                                SHA512

                                                                                523d52774ebbe2a432511b8068f53365ce99f1e883543a041f75e70cbcfc452389c0eb19726cc6a13fc5aecf4402d9b799970418b9c3e1c51171fd47321023d9

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\ScanResults\b9f4e138-491b-11ef-bfa9-c2153342db40.json

                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                39efea2c641a7e60283588decfc56e93

                                                                                SHA1

                                                                                26e2ea0eba8d08ad36358057e1f7a36d63fbabf6

                                                                                SHA256

                                                                                f39975ba525e561e20cd81e9c4e70b412e1f5d1fac37ac361384fbc0408540e4

                                                                                SHA512

                                                                                43a59b4c4f39192843d2984c9d95b498fe4abd3c3c310fb50d65a6b2b1cf93ad71aa442ead3386ef66cf740340bc575feff6972dafeffb192b962289be259f7b

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\ScanResults\e81ad892-491b-11ef-98f4-c2153342db40.json

                                                                                Filesize

                                                                                22KB

                                                                                MD5

                                                                                b0c17eea094c7266b876735ca2f6914b

                                                                                SHA1

                                                                                eb57cf7a31b8f9bb3b6c8a8e76001202d52eb581

                                                                                SHA256

                                                                                d76b265115ab8da9029441d19b376950cb9755021ea93933a5102c312737cd5f

                                                                                SHA512

                                                                                770e12390d4614b7d03ce966048d18c39739e6a89801bc538d712507c1294fdd6d601bb4e9b5f8c2b386723b1ebaa6564f46bc1b8eceb28bee72ce9f3cabe028

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\ScanResults\e81ad892-491b-11ef-98f4-c2153342db40.json

                                                                                Filesize

                                                                                22KB

                                                                                MD5

                                                                                af573e15c159e042f515c07883054b29

                                                                                SHA1

                                                                                80444ccd68ba7cc7e768177d7dc08d0b7a3ffca5

                                                                                SHA256

                                                                                2c74ebbd681193c1bcda03c1e14761a63fe1f5332c791b7ad9e75d92c01cfc72

                                                                                SHA512

                                                                                80f0be11526a811b31d7c69d2c4b5e3a30284c82a1a9d5cedf9ac1587d0dec532473c44e35d518bdecb706e799723eba168c73990a464816ddc0cee8d81a656b

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                Filesize

                                                                                47KB

                                                                                MD5

                                                                                640ae789b9e9a80c9e1110e9164a3a7c

                                                                                SHA1

                                                                                4209b82528bd2a3820354c4e920fd92e5df77a83

                                                                                SHA256

                                                                                11a4f8c4f6455afcc217e060f44c286684836fd5b5fe12fbe608650b22ff5750

                                                                                SHA512

                                                                                0df564057062fce7c0f5ba9ca85a801118df62387020ad6f0a03df67d323d502b927e04787e739da917f11cc099fd9da5a9244241178faea71c62b2b68ddc016

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                Filesize

                                                                                66KB

                                                                                MD5

                                                                                ec45dd5b3cb0b5c6de2c9a7f2f4f17fc

                                                                                SHA1

                                                                                4cf0532099f6ad7d4e12f957c0c77b3b2146c42d

                                                                                SHA256

                                                                                cf5846fcb38793198eff8e683cd0becd4338750c604408ea48778a9eb0e92500

                                                                                SHA512

                                                                                ed4bb049646f0db9a5f7a8410149adbf29fc16b4a33ef69bf4e8597816e25daaf625687c05cf556c919c8c15721777888c6812b599212a0acb4548ce1aa0242d

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                Filesize

                                                                                66KB

                                                                                MD5

                                                                                016233c4de96b109e76936798caf0fec

                                                                                SHA1

                                                                                e367cfe8d925d419df87abc6b33ab57cac9ccb82

                                                                                SHA256

                                                                                fa85ff7d147e917beef85240ec7c008aa60bc4bc99a5009c111bb6948e619de5

                                                                                SHA512

                                                                                96da2bfd9ec8844f7b54ff8ec023f315ffd7ead8416ec961329dc960d3d0951d67c49dec64d153644fff7349a4047cbda149a4cf87f8e968d4be6de6904c95ed

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

                                                                                Filesize

                                                                                607B

                                                                                MD5

                                                                                72b09d91de401fddfc0ca94e600e350b

                                                                                SHA1

                                                                                7582187fd5dacd9eec330349db3793b44b714b9d

                                                                                SHA256

                                                                                71166ba0f28bda88180fdd923c71bb9711fbeb8f08f84f126ee87897b1083445

                                                                                SHA512

                                                                                976cd463bda310946bfe607d47e7bec09b6436063ade0ee84cbbfff385f9b431f221cf5fd91c7bfc125b308710c8a8166626c703178c1462253cda87dad81ab3

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

                                                                                Filesize

                                                                                847B

                                                                                MD5

                                                                                c1ffc12813ba6a14c50f542b547d3008

                                                                                SHA1

                                                                                2bab2249dcc7e99da1a44c0c778808fc0a306ce1

                                                                                SHA256

                                                                                c3fe227071f74265343d3822443a60deb9388b02c0d67985e095e2b90b493640

                                                                                SHA512

                                                                                19da55f9f801c35c45cb56ae6ed0cfef2f3e8a1de9c65e5ae06f1ed6a15d37781c2932ba0233ac2c1751bb1342e881e5b989170f799ca225590e0734f792a97a

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

                                                                                Filesize

                                                                                846B

                                                                                MD5

                                                                                0d85f92dd6dc9cb8ab63000353e01022

                                                                                SHA1

                                                                                a8c1700d200cb70981f54c7dcb8ec9359d3e8b0e

                                                                                SHA256

                                                                                257156369e8ba82b4c8fb4af12357ec54e0204af2893266b31f26a4fc3975760

                                                                                SHA512

                                                                                c269e5469c7f960337abffb4d1fbc0cf51cf6b22d75d044dfcbf1343e7905f76e843a8b99d5884dd6d979c73fbea54a9ecb4a264cf177006aa0de0e2ad5d1db8

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                                Filesize

                                                                                827B

                                                                                MD5

                                                                                a8eec3d6052f19f8f2cc15697e344fce

                                                                                SHA1

                                                                                4de4b63b84aeec2ea98408d700643f672b2a951f

                                                                                SHA256

                                                                                dd1f56854ee92add67eeec8af7f27c66fcebb1c9141d91ed292165965f89102f

                                                                                SHA512

                                                                                954fa8b61ada5fab66e9d50350370fa6c9d66d2202853f3e8f7070418f8030ea928efc9cf4ad5cd2b0509a1e52febd2267dfe778a959be715313c31c33e59488

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                f48102cbaeba2a0f39bae257e0a2c13b

                                                                                SHA1

                                                                                0787a4823197194d75a818a96f81f3ffad49a4a9

                                                                                SHA256

                                                                                de2e4efd85e3ab77014ba9ecbf89c776d1642bb10ed26d5006378c8afeebfdd0

                                                                                SHA512

                                                                                13d91292839acf15494a8cb3e13c9c175e9e2506d4586b600b03755fa02b59d8bcef2c1d91bdf35cf9721d31b1a4efd377a44d93c1dece4a0bb78ae556c55612

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                12802501b5b3335c3902ec8f1807ee80

                                                                                SHA1

                                                                                537d5c5366e1213afe198a01e42226e04c24f9e8

                                                                                SHA256

                                                                                62a8a2acf5cba2003923d8b86b04b1d88d543b1e478ebb4c98c71da916a7ccb9

                                                                                SHA512

                                                                                f8cbc9d26b4bae802a15693dffe057c41400ff24fa06e19dd65be9c55c7d334c9c1db0021e3c4b57b572f41fc3ab5495540dfcddaa60c01e4d915044e39dc583

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                fbb100431ca8b03f9b98b767d96912af

                                                                                SHA1

                                                                                56b6e3dcc0416a4b14595ad133779010803fc09c

                                                                                SHA256

                                                                                fad78ebe8ddf29312b1b34b6f91fbba15ef5d9dc6c9180a3711ea17a8588d520

                                                                                SHA512

                                                                                7f419fedf5a701735305eae2e4abb3e149c8a0069eabe49b0ddda81c495cfa38387e6ae9b5333881d575092b48d410649e234715e8e7b1356cc426fd107aa8ca

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                d9baf7407998af59f2b0238c4ff94017

                                                                                SHA1

                                                                                2a1dd483c88bcfc2844b35a3d07841c2917da42a

                                                                                SHA256

                                                                                757e44c68f3a567c341ee0d8611550fa969dc3ccc2a639491b6756a6f6fb6d39

                                                                                SHA512

                                                                                09668d615ed019a7f2c0134ce44c3921ed0035388debe28d49d0967d48d076fec503da6ab0dae302ee25ee69c2e57deb9b13d2890a7cfdbcd9576864b3c68e86

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                6fd757b30e265673ddb82f73d2870d22

                                                                                SHA1

                                                                                f042705d91fb4e1e6c4871dafa32262efcf4db91

                                                                                SHA256

                                                                                ee5af7d3e37165f3e5b732a53ee589e25e638f221c07c0a50544b212d0c67ed0

                                                                                SHA512

                                                                                8ce3bf61efd48b81ad9a37e812f5ccc0e588785085c0684d31ec55d97d67b93b0992da2b4e8e25ebb9d5663286deed9bad8780de931f5cfc4bdccbf382cff023

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                4c2936c31fc7e81cf38ed4a42ba367e3

                                                                                SHA1

                                                                                ad8acdc94f62513617ebdf683b6ecc0b2e1b4518

                                                                                SHA256

                                                                                e1bb5dbb0d5b75e0aece6fb1a2ae283c3eaafcfebf120b140ac6451c77da8287

                                                                                SHA512

                                                                                83d55d774ea63c1ab96a5a3b429307c384492f9315dc04b5655444551fdecb1aefb07f9d40e58b05266db1fb6115c74981b093c2875b9b077959d5305f5d8d49

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                3f636681a66fa79d891817efa8d1b147

                                                                                SHA1

                                                                                ce57b8c49b3351ad24bed39a9e0bc4607315e217

                                                                                SHA256

                                                                                7f3050ccd964140aa9ce6ae2e755166363fab04e1ea9dfcb61ecafd3b070713e

                                                                                SHA512

                                                                                032200baf39d179efe2dd21262d1486bd3b1a94f76cc789a6aaa272db860d3bba4e623c256ec70a1e6530f13776117882e3d57a949ada6b50f5ae89e31e42ca9

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                acae1628fded1d04b22e130f5e625c77

                                                                                SHA1

                                                                                5a71f1fbe4c645c6c962c798944c366de4484307

                                                                                SHA256

                                                                                7cd06bdd945cfc28f63c4b3581cbff581ebd9b2526b8e896b5dfd632e3a7f692

                                                                                SHA512

                                                                                68946afda3613c03b0ec3faa730a59f7707348bec0967997a548db34ea82d7a882a9062419824fb5837201c69cd348df1ea649a13194388d12b64339d7ba6041

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                7ebb5364dc4e143bfaf950090c5262ac

                                                                                SHA1

                                                                                452f53855057dd9fc93b29a91b782e68ae8117b2

                                                                                SHA256

                                                                                86431334102c18909c56f3dd2cd63579137f14718524e9ea8e17b95d7d031549

                                                                                SHA512

                                                                                fe8c21d35e096664ac3467e7ad2ffef2116d6b384aaa212cdaef4a51f589988646f668a3728df8d644ff109a22d0ba8b2b75034a140b947e2a3ea9376e310c9d

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                11d78a7cbc654a35b28ffba545541158

                                                                                SHA1

                                                                                7e4a6dc5f6eed12d2064e7a1b0a8be0795d9eddd

                                                                                SHA256

                                                                                1813e3e6bfa6725335a7197b804950b42a8102b35511442569df8506f752af6d

                                                                                SHA512

                                                                                5fa499a52a0356e7a914008e80be244bf7b7f68bcd27359b0789bf77e1c4d8a50acc9b131997a7e88d8be32de1a4159ab351d80ed415377991b0402026b3008c

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                7babc43dc2f79c264bb1476def2f736a

                                                                                SHA1

                                                                                533c702c56899e99f0941e4d3301d33d5092574b

                                                                                SHA256

                                                                                4ec3bafd24a36566dfaf7f7395d2170afab774f379131197ac375f6a35fa3225

                                                                                SHA512

                                                                                7d5cf55890e84efa1d679d5e1227bd9c95f55d503522ca676beeed5731bc6ad80ee586a530bae59123b14822640d4fe214cda2e0f082230ea1f310b9cddefb39

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                ff2cb46d4c5a95e6552431ab95f06e96

                                                                                SHA1

                                                                                c1c147327718a0fa25f3e0bc7aa1270e63ad49ff

                                                                                SHA256

                                                                                b6da5dd1cd1a1588f2456d80e907585899443981801277aad75644e01547b977

                                                                                SHA512

                                                                                bd8eceb1763aa07db9121d33f9a0a41c083243d67b35b6335c07987c835ff167a4a699a92c5aa393a5de7d398a10389753b822ab9ee9b4015daac183e3b2ff50

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

                                                                                Filesize

                                                                                814B

                                                                                MD5

                                                                                4ff132c9ee67755eb219fcd2f0cb7d62

                                                                                SHA1

                                                                                f9f4c2db89b2e30da2a2ad82e29e25ff08dc5b08

                                                                                SHA256

                                                                                83308e7f6fd379d5ea014ed16e51664b772596d0b70840656c99115c6ac84d78

                                                                                SHA512

                                                                                3b50d019cf922521152d52592958e3419f7176d68c4e26907a04b0a8500011ffabd882f7ab966c1ad942af67f93d7150501d266ee48881572f1df4ced433fe94

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

                                                                                Filesize

                                                                                816B

                                                                                MD5

                                                                                5e04eb463dd6eadff48ef59d225e65de

                                                                                SHA1

                                                                                4b7eb8e378564385779c9d24dcf0c33eaef9127b

                                                                                SHA256

                                                                                391d3d6c96e1e5f2799a129777b33ea907a010281831564f2d1eaceb9cdc8af9

                                                                                SHA512

                                                                                eb4114dd5a387cca9268793542a5ace540cf27de2a9cd5c7e3fed470c5f3967012fa6496362a9b761556bd58390f82ada3542daf9912c54b6aa0a6f8b8b07d8f

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                b712bd146bc91e38ce37087a6d6cde3c

                                                                                SHA1

                                                                                da7e50c78e6e00e87d7b93de67049eb0e89dc9ad

                                                                                SHA256

                                                                                f01f7754bc61275c3faea22d7fea683048a979ccd2ee17afb4050b766261c128

                                                                                SHA512

                                                                                5e76e6a1a54a2f183bfd81d6d3e481e885ae10eb646adac489f8b9e0b83749f838cbc88386221c362ae3ff0f892eb30b865afb7c6a925065faadb4159a99223d

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                0b57cd2a7d9a7d2c530ceb06a602ac78

                                                                                SHA1

                                                                                ac96dbdf86983195aff1d77bbe339c2e545b477e

                                                                                SHA256

                                                                                9d26b949bb21ab11c2e5d44aa43c7a097d26e6274c54d0098242c9a52cb0b7a7

                                                                                SHA512

                                                                                ee7ee1c5ed86117fb50e4758606b7c16f07574132a52e2f7a50f2878d9ec28b695af5c9b70270b852578ada78c9ed1b7b57fa1cf2ea53762254daf8fea36291f

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                6be67453d035a2e452f67f0e72800114

                                                                                SHA1

                                                                                17a745848607f72066c5649e0c84566d20b9aee3

                                                                                SHA256

                                                                                f5a8b74df365027607a308749bd4e9d2425b7c69af47a489bddfa29b91863171

                                                                                SHA512

                                                                                4f5fbfae5fbc81e7ee0f5d0e1a3c064cb114343e253978885f158327aeb3fd7365ed5b9deda376f53976bfed41b009b448d4188cefc4ecc1785773efae50798b

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                a816550b3a9789aad956ccf033beeaf8

                                                                                SHA1

                                                                                899fac51ff1c798c2bf9f26ef65f9a07c773e06d

                                                                                SHA256

                                                                                eab9d8b28f9969c68bbca1065742772bb88735d7b6c08a119aa35bef13099dd0

                                                                                SHA512

                                                                                7d0227dbac35a06f40d6903a8504e33c6b00efdb896484b4b3438e559c0d6ed7ef81c8882158c5b1a9982169686321284a4dbab41c71ceacbf08d399e5c55e29

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                fbe4caa0735d6439dde054803c66f9f2

                                                                                SHA1

                                                                                5d99f64bdb9b1f5cb7b314688a7eb37973e09979

                                                                                SHA256

                                                                                1598821ce7dd71d7765c4c498d89cfe20f25789c15bef5eb39493db7d5772f97

                                                                                SHA512

                                                                                c7909e6b7bb40b69ef96047a40364c2ce1008e0b0e201bb6a26a4eaedf1ee5289f03fb57d969755eeff008405463bf2d49f71ef41dc8e914585daaab3c98e5bd

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                0c8ee07dd3a70e5f42f20f9cf9c3e599

                                                                                SHA1

                                                                                b1b0565669117aa13564054d2798d6373e11b801

                                                                                SHA256

                                                                                060067b6fd41d8983378666ff6aaa9bf9328f51779cff6c981a599c53f9a1fb8

                                                                                SHA512

                                                                                5485900a16d5ac38e62380fe5bd974a26c8e97e99daa50713e46cf082641b43996dd316baa2d555a56d3fc9e3d352ef5a009b2eec03b60abefea8a6a56a4db83

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                6c0b18d0c3e7fdc2afcc7eb987553087

                                                                                SHA1

                                                                                bc49309c6772afb431bf68e1470044e85d6a3a63

                                                                                SHA256

                                                                                afa1084e3da10fa91e06e60c81a3e52dddb6b54c8a00764acba3a20f150566a3

                                                                                SHA512

                                                                                ef100014e23825c768b30c898f76c1d26ad13fde0b86703bdaffb953d34f5b05faadcaa28bf4c19efcf4998138eac39b17114e3859e187419e38c72296ba583b

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                562cfd3420463b16b73cacf7f3b660b4

                                                                                SHA1

                                                                                597bd96abce8fec4f3954b4400763895cd28b724

                                                                                SHA256

                                                                                7fb50727442d6105c2bfdad7563335d1556fed79205ceef4f6fdf5517c61c089

                                                                                SHA512

                                                                                f0c150f3941cbed888a0c6d4a1e7f747cf227877b2621c21473d6af7adf17e5b5a8a370578e413fd19bcc2b37f568e26614148e96454210ac7d251b63aed63c4

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                f106166012a68d5ca3f18230d4e79f33

                                                                                SHA1

                                                                                539233a10aaa9c1393c43abcad296183e51c12ae

                                                                                SHA256

                                                                                73418e162916464d0a18c8fa261a1c8d8437e6cefe9c25abde591abb3905f284

                                                                                SHA512

                                                                                10a4be60176477f237cb38b07674282fe0cd0cb3fabfa099862e8f2bb960c6697f24d29efb2c9cbebd2690b9e14442456c3f6bb45f617f0bb45e48379552ef4c

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                ab23b207784c37d7622c13f83b7f88ce

                                                                                SHA1

                                                                                73c215e22052c4c7775b7dd7f5bbeb68ded029c5

                                                                                SHA256

                                                                                21933a0ab4561e3d806228172688eea138f1a25865d11361d3497c1e3d8d4f76

                                                                                SHA512

                                                                                dba6f70eafa08aeee5cdeaf7c046af7813c1120c20c376b85e3d01871bef193d3244f9d5146ce9dbb8ff8a647590b4c96bf8612cc658e354c2fd977ad14df61b

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                75ab6085b4245d83c51493fca86d374e

                                                                                SHA1

                                                                                740f778bbe757e62070a2ba28a6b4ef495829982

                                                                                SHA256

                                                                                5fadd75a07a1af15f6d993e66dc89e279fcbb3af771fc83e144c3db5e7e3bf01

                                                                                SHA512

                                                                                cf39eac1ab9001b09b6dc3d9fc834cf9d304312c56a6791b2db08a943722ccf79d41b8e7ff2605f4bd199a72a3b8f4ef6f20417728a4a75e3a1272e30dd58745

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                99bf390ec6ca2242b243bc1669b3a91d

                                                                                SHA1

                                                                                1f39b5365e098fc1ab1df983180bb7a8146dd732

                                                                                SHA256

                                                                                eba626178ece87956ce4b81a7a49adfb03c23e18336b8120b6288e0c8985f34f

                                                                                SHA512

                                                                                2fcdb126bbbe1200e6a4de3d7c266015913837404e04e7e0ac351e35544ef0c7f530084e459a8fcfe6ea4da975d268e575e62b094f817a75e0a8f02d64eeded3

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                951ff122f9f4b288d7ad6c970107630a

                                                                                SHA1

                                                                                9b31407cfc29f4808baa8f5c058194f93eb92164

                                                                                SHA256

                                                                                120f30578a51740dc06c8c28d4fe414326163ee8e03260eab0bdb64498328667

                                                                                SHA512

                                                                                38e8c6d4a692e39881dbca25ca77099b3a7dfdb9d4171ef82b926b831c9f2644911ad9b2411f1eb779e687c278225e89ec8ae7a59d855c59c023bf6a5c73d274

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                11ca9ded69a748842cecef84368467b5

                                                                                SHA1

                                                                                f766f16e1f4c83b050dd7707f6599c8a77b536c9

                                                                                SHA256

                                                                                a99fdb7b95fc2c9cfe2433f7874e14ce1f3e5aded02afe3755e2dccc34508940

                                                                                SHA512

                                                                                25db11d2c52a565c5a4044e01825e298af3b6a652850fe95d1fbbcf2f5237e8d795c7f096e8e8c7426dcecb21cdc44234da28eab0a8b5ad0beb5106dfa1390de

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                9a404ac69d0061ebc5c1f77e9cff0ecd

                                                                                SHA1

                                                                                adfcdd0a306079a7ca4f589c66257fd25ea54d88

                                                                                SHA256

                                                                                1993975eb42f203c56946e56c9edc4c55f9d655c67884711fd73cb1009e835df

                                                                                SHA512

                                                                                f5e84e50204e79204ba383a4da4205666e5277cace478e32ef4d6e831dffe0bf28a22f65ccf94d0b5c07e95808b1b8da875d30005ce52e9e7c722ba9f4852d01

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                7ff292db8e6492f2f2a5df6d38ee8440

                                                                                SHA1

                                                                                4bdcef5bd4fc12fc9d40410827dae8b94b06b2d8

                                                                                SHA256

                                                                                520fec1474e5101fc8c4dba062e88f8238ca31f1d5a64588a0e1645c5785128f

                                                                                SHA512

                                                                                699072f13be9b4e4d7449839527587bdd42c0cd1cb124c6c55f4a73b7c8462cd74fdf1882ef170e650df0140d90bf0b406fb5aec8b0557be6b013461cd0ef332

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                0180bca49bbb59a6594f28725bca1d67

                                                                                SHA1

                                                                                6f035ffd3f17783e1fcd265f8b4fe3cebb1cc1f9

                                                                                SHA256

                                                                                76c7abbe636ce7721dd22d615deb36c384445b49e64802d421f602ba7b573df5

                                                                                SHA512

                                                                                bd16c64fb225ef9c4efd64fe9306599cdb9c8d8d6c5c68f7d11190bf0915d06f87b1733835494da0d8ca72e4c253e7a55871cf29b637440f83119b58a5619914

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                f7b224dce47f3fd3b4e871a2c5512d77

                                                                                SHA1

                                                                                3e6e7a3dfb7ffdd79ee0f423754c5aa03451a9cb

                                                                                SHA256

                                                                                77d46f7d5344dbfec245a4676c807d319fcca512bb374d6ac5c488915b6a4ed3

                                                                                SHA512

                                                                                222cacb30da79d960cf0ae30cb8b60dd1b92df58b11c82620a30e4750b45b17a17edbf411e6bd0d75fea72da65acc7ca108af1b02d1b09455a135ccfcd65399d

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                4b647a74ba4608d4000111902e206ee0

                                                                                SHA1

                                                                                a383bd35953abc8b7cad1d38146265d73d3183b1

                                                                                SHA256

                                                                                e1c3553877102bfafb5af62e7bb61d3bb5a171abfc80a9ff348d5f44d90ae2cf

                                                                                SHA512

                                                                                c858013b7cb3910bb7b857a30cfc5d510fb2997964a8316790a8818e9927b14d1e67f36b036958afa054e1431d6ce5ec2d90c3235ca950f0101d7e49f91a30c2

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                c4f6478abe52a818836cbf9150275daa

                                                                                SHA1

                                                                                24d06206fce67af3d1e6336a96c8a88f616c06a1

                                                                                SHA256

                                                                                b92da190ac22a595067fa74bc927595f37af0ac088d2bea9152e41eb3be91ee3

                                                                                SHA512

                                                                                4e8b7a3589b4db37cfc4353711ba7b2b5bb31bce47ccae9386c3106927958bb7184a14dd4286922050128df70636a2c07f9b8703811d881df7b71df94f989e73

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                30887997cc1f0ecb0d4490dc9247459f

                                                                                SHA1

                                                                                39784867984a8619a69292e530b61e012b22425b

                                                                                SHA256

                                                                                8f06f53e24103934ffee69a322dffa0d1155ffb7d8ae14cb3e980ecb2ac9aab2

                                                                                SHA512

                                                                                952334b766ebf637f46c84ce62a8478cf8d3bc9883077f22456ebc372c83dfb22a6cc61fb4f8db8af28e62bbeb67c1aba2b2eb6af2c4684894242238e7e5f752

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                cb4e2752024620d087220a91d860f041

                                                                                SHA1

                                                                                b781c022995e7b6576d97a446357315b9b0c0563

                                                                                SHA256

                                                                                c39fed5d52cce3db35247ebac7838d22415fb9a2522dc826a0e0ab64dfc09ee8

                                                                                SHA512

                                                                                6f7c2be162b02cfc2c952923fa4cf416e4823f80983598b67eab3b88e6c9385e124b0c08cfc431b2a753765d0c38116018cd0c2f63cc3955bb0b490d7c6114ad

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                76b73bd2f03d8d18b5026e1fb7a36598

                                                                                SHA1

                                                                                229d99130a5165e9e672dd3e501688a9fc7d97f5

                                                                                SHA256

                                                                                a0722a4a8245ea9a17183d0fcf4dcf3e457998b9c0bf8b915932cdc130032a26

                                                                                SHA512

                                                                                b6e3d6785f8e36af1ca3a5875eac89d1eeccb601e7601c01c4788b795809c667602034a2243e354d7ddcb59a27a907ba1e14889330f43fb29dac22b66ed4281f

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                bf3570e5ba4e2152bab26182ee05b693

                                                                                SHA1

                                                                                e923374bfcb75730709b827312e49a238a7b2510

                                                                                SHA256

                                                                                e0d6ed8b2ee5d3a44bcc214255b7bad657a558b1ba80dfea7df614a6b29d0e69

                                                                                SHA512

                                                                                6dc09d903d899d0d188057e5e88205b01ee5cf5a3c306f2c3ba1fa836d9d23f29fc7a2a72964e48514d859c68da7862c247dcf82a30702cc371df85d8b3885ae

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                aa612fc4fd30fa0d1d30d76ee8ed93d3

                                                                                SHA1

                                                                                b5b17dfe076c368553f5710634a96afaf4e9946a

                                                                                SHA256

                                                                                80c6870e14a9d514194630d74666943adda8e8ba2b6a5e41a3fe467b96ba46c4

                                                                                SHA512

                                                                                7b1ebc9a3908702163609511bc625fe142e02fa851ff88592ed7c8b7f1a132bc79b83fca0c6dfcc9b6d21c3b4234b6044f8d2c3c5658dcf86b8a3d4ba144bb99

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                b73b9be44db9487a4e1f07c4794560f7

                                                                                SHA1

                                                                                1bafab6165c91be914368f3da2cd6cd675fbc261

                                                                                SHA256

                                                                                67a692fb5bc90ff475a309045e1ced0cd06ce8a9e81ea28a932b4be4a0357fe4

                                                                                SHA512

                                                                                6b47e87cf8d392ba7957939e0ebbe8d4c2d11b5516c90d88fd198ed40cc321e2bfaea9c47387b7de681f62c007c7e535ac2a08fa90b4c5309d22ee105b7934f4

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json.bak

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                42e8d849e8ab3a7295870dd36d1b8b6d

                                                                                SHA1

                                                                                c5281313523e061bb5f680408a398b869a54c077

                                                                                SHA256

                                                                                803b9c5b4a76e1022fc293e7c2a1c63a82065d25a3399fea5ae7ad43bb1ccf77

                                                                                SHA512

                                                                                c2ae555cd43e255ae43c1c522f401642251a7906d47b462586f4da0815f5379c6701e7c861782f3fc4c69395056069e38669afa8507593fbe9f0ed1d4b7480a6

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                46d127e5e18c479039446048ba2db629

                                                                                SHA1

                                                                                e6c8c9092371d4b3e17774573b315dad9e5dbc27

                                                                                SHA256

                                                                                ec7ad1a8b8777f7c28da95faef0c3993449ee3431876dfa0a540b62a3b511105

                                                                                SHA512

                                                                                24e8704acf6afd2460c447ae258033878272bfcfc1a46ac36cd0f39ecccc9eb3cc33febe283b7fca8add088031d9726c47daba595f0bf42f557cfe32299b4be7

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                2813c60bc66e99bb4cfb722be4c23493

                                                                                SHA1

                                                                                7c549cbe13516ac79d48361738e56cb8babc3890

                                                                                SHA256

                                                                                bc204d56577da4b64e5729cbb9fe314be983cfda34746a15cd5c7c3142ef76a1

                                                                                SHA512

                                                                                eb62852b5d2a1187568d50b4546784994d7dc75755aed7f618ab9b75a6ce9c1da9635baa9d28d3092f94f35a1d1cec05393b0889d317931a0fc809163ab57de4

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                f7e1a678eea9064cc430b98f549b09f5

                                                                                SHA1

                                                                                2f081bf881e1735237c8597b8c5ed8a5116df06f

                                                                                SHA256

                                                                                6390a46d28e1bea94356c4e8c61a67a2b600ac6fa6cf82f77cc305b3a6e34bf8

                                                                                SHA512

                                                                                8e86ba06ff9a2a7ebb52bc4604e60ae752346a45d140c8ea1263e54903ccfa53fc20ad76244fd7c8805e7c963c1bebbd8f013cafbd5db8a10ba7530f285aad64

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                a13b93f435950dd4bf4b47c6e4395533

                                                                                SHA1

                                                                                c0f77733240a929bd958d13272b6ff80cbf1a531

                                                                                SHA256

                                                                                97fa64c976ca8104ce448a575c341ac844ab43cf00d40a8eccbbd448c2a725ca

                                                                                SHA512

                                                                                bd2c0a6babea68cb1df7a5a43b2df21dd1730e1433445f63c7dcda3251d297dfee0cd4b2d7b30451baac83ce9b7769361d12be10d9d1b5286cf0ad84515f1e74

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                0ca72d9d4ace8d80ba773e5b25d25a79

                                                                                SHA1

                                                                                46ecfaea03a192d98c5ffce43feeec0cfa8629d0

                                                                                SHA256

                                                                                5a65a59a162e9c386c6e7f61a8a4c8e9e5907e12a39ad2c7585b1d742ebbc3da

                                                                                SHA512

                                                                                72a34ba9411710cfea587df15dfdda81038c0595c1037a81029b8436be88a347e58520472e52270b1819954a3c872be6414b8dc1c505023129b2cfea1250a45e

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                849abc968c4d7f2aabd89b18de5bb69b

                                                                                SHA1

                                                                                4c7e698e6a2ad6c7edc7efd4f17956f7e488f439

                                                                                SHA256

                                                                                50b72a038c718c54476f2ad6f8c16f57dc86d12f6b7aca0635050345c31b6f8c

                                                                                SHA512

                                                                                fc15c0d9737209da1907d6589ab567fac83533dcded9206da0718ef550ae76b43a824fb77ac3c755a8d82a20a7449f56c9c530d67365b149e878cd92c67213bb

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                c6ebac83df14568220536ed61eb8d56c

                                                                                SHA1

                                                                                94cdae086c4860cd9cd7091de0670d210684f12c

                                                                                SHA256

                                                                                68404904e00db856b561fdb48427212b7b0f9de177499350f21d0df8a3402b41

                                                                                SHA512

                                                                                245030640d81b33fbeca9a6b51017858902224c3c1dc867bc036812dfdf4c2503107a9634ac61fdd5839fb7c7589db966e4acec2bd45c3a15ca922743c08466f

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json

                                                                                Filesize

                                                                                125B

                                                                                MD5

                                                                                4641151bd1b3124a757b7e59385bba3e

                                                                                SHA1

                                                                                21cd0e2fa27a70b6e024b992fec205270ad20971

                                                                                SHA256

                                                                                189c350cf331b21f10cfa0fce7977e6b94b1c9c1d58fd1a813d29978e969bc6f

                                                                                SHA512

                                                                                94d9bd4a50148eabfbf5a69ddc13145ddf19c13abf10fd1729d2f5ab7850dab31110be96e8de14a16bcb1d4004fa6d7b3fe6227db21eee5c2ac48795cc439b46

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\config\telemetry.json

                                                                                Filesize

                                                                                387B

                                                                                MD5

                                                                                4c039be6924a8cf2c8e85350309557a2

                                                                                SHA1

                                                                                3653247143be0267f4482d29c92d7a20f97285b7

                                                                                SHA256

                                                                                fe02019563f57bab0ef91ef3173e964b138ab10b636abaf9b83cf5e83c99ea8e

                                                                                SHA512

                                                                                4a2409ef6760e35230e2c68f3bd00bb68176fd3503e419ab00199123c51f1f41d32054f1258caa468b8adb08369812e631753e1910aa0cab67f0806a0ff6a787

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D78.tmp

                                                                                Filesize

                                                                                68KB

                                                                                MD5

                                                                                54dde63178e5f043852e1c1b5cde0c4b

                                                                                SHA1

                                                                                a4b6b1d4e265bd2b2693fbd9e75a2fc35078e9bd

                                                                                SHA256

                                                                                f95a10c990529409e7abbc9b9ca64e87728dd75008161537d58117cbc0e80f9d

                                                                                SHA512

                                                                                995d33b9a1b4d25cd183925031cffa7a64e0a1bcd3eb65ae9b7e65e87033cd790be48cd927e6fa56e7c5e7e70f524dccc665beddb51c004101e3d4d9d7874b45

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll

                                                                                Filesize

                                                                                4.5MB

                                                                                MD5

                                                                                f802ae578c7837e45a8bbdca7e957496

                                                                                SHA1

                                                                                38754970ba2ef287b6fdf79827795b947a9b6b4d

                                                                                SHA256

                                                                                5582e488d79a39cb9309ae47a5aa5ecc5a1ea0c238b2b2d06c86232d6ce5547b

                                                                                SHA512

                                                                                9b097abeafe0d59ed9650f18e877b408eda63c7ec7c28741498f142b10000b2ea5d5f393361886ba98359169195f2aceeee45ff752aa3c334d0b0cc8b6811395

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll

                                                                                Filesize

                                                                                5.4MB

                                                                                MD5

                                                                                956b145931bec84ebc422b5d1d333c49

                                                                                SHA1

                                                                                9264cc2ae8c856f84f1d0888f67aea01cdc3e056

                                                                                SHA256

                                                                                c726b443321a75311e22b53417556d60aa479bbd11deb2308f38b5ad6542d8d3

                                                                                SHA512

                                                                                fb9632e708cdae81f4b8c0e39fed2309ef810ca3e7e1045cf51e358d7fdb5f77d4888e95bdd627bfa525a8014f4bd6e1fbc74a7d50e6a91a970021bf1491c57c

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nm

                                                                                Filesize

                                                                                335KB

                                                                                MD5

                                                                                b99c7cf30aaf880d97c2bac8eefbff0d

                                                                                SHA1

                                                                                8bd3b1a8b5451e2f63caa3d137afee7cddb77857

                                                                                SHA256

                                                                                215051b824726dc93b967bf1262e236e72cd8eb8ddce1d081545715c12d32da8

                                                                                SHA512

                                                                                544204482d77819b22f3b2ff228caecaba49455c9c671df834dc651c2baf506d0c37df618e969a997b8ba446a9d3dd82e7c04cbf7e031b1228840d444459d654

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.sr

                                                                                Filesize

                                                                                18.7MB

                                                                                MD5

                                                                                85040812fcc4a3d312b34c3bf645ec7d

                                                                                SHA1

                                                                                e1cc3ebccda8596367700bc1a12bbc03cee25e96

                                                                                SHA256

                                                                                083f07f68c9b2a939142176777fa79c046bb964a1317e670390ad2d809e663d1

                                                                                SHA512

                                                                                c73b09c552e4c2098330e048a5176cbcdb80c3db72ebb59f200e89bde90b23bffa1fcc927176cc92c4e2973e458a78067b741ca346e314c7c37744274f925364

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.bin

                                                                                Filesize

                                                                                995B

                                                                                MD5

                                                                                a8e4820e175f7d9c0f37c4f63bdf44bc

                                                                                SHA1

                                                                                e0aa265a99ceb65255ead59d54ab2e044c7f63ef

                                                                                SHA256

                                                                                4c2d5ddb9c89842b4c0aa4289c62aa67d7480400b95b0bb9be5581576b680a6b

                                                                                SHA512

                                                                                68a717c19a8f3532ff8bf3fae6d28a081939618c0f49da8c2cb8c14a9b563cc8dfd3b22d1d0f0e3aec8bd79207f46f3ecb0c49f5caf4fee2d570a5d1917df0df

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.dat

                                                                                Filesize

                                                                                39KB

                                                                                MD5

                                                                                10f23e7c8c791b91c86cd966d67b7bc7

                                                                                SHA1

                                                                                3f596093b2bc33f7a2554818f8e41adbbd101961

                                                                                SHA256

                                                                                008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc

                                                                                SHA512

                                                                                2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txt

                                                                                Filesize

                                                                                23KB

                                                                                MD5

                                                                                aef4eca7ee01bb1a146751c4d0510d2d

                                                                                SHA1

                                                                                5cf2273da41147126e5e1eabd3182f19304eea25

                                                                                SHA256

                                                                                9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f

                                                                                SHA512

                                                                                d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe

                                                                                Filesize

                                                                                1.8MB

                                                                                MD5

                                                                                ffe5a249402aecd1d0b141012ef5b3cf

                                                                                SHA1

                                                                                9fe9b21390d35a0f82097fddaf1ee18e91fd2f2d

                                                                                SHA256

                                                                                1acc1c8c918e0ac6cdb4fc41d96339959d42a71947a02f573686ee091606ac57

                                                                                SHA512

                                                                                1f7427472ca3f8a9abf06d761595fadca59b77ccea93477e6d71546a1385d654817cb356585dc05499ef87f61c504511399620852e95a46601f31fc6fa05f2d7

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll

                                                                                Filesize

                                                                                528KB

                                                                                MD5

                                                                                ad5afe7fe3eac12a647f73aeb3b578bf

                                                                                SHA1

                                                                                29c482e6b9dd129309224b51297bff65c8914119

                                                                                SHA256

                                                                                7d2c7bc745e07d54f1c26c06d7438eb40ec6f5d17dfa15928b67d447f4c63747

                                                                                SHA512

                                                                                5be9f8384cc22bb7d69d8e532e7025675db16777b2d01ca1819a6e3d8c7daaaaa23d842d338d55d74eb9973e230a8f9a11ce7524667fee09b18fbdcb5a49289f

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\version.dat

                                                                                Filesize

                                                                                26B

                                                                                MD5

                                                                                fb00cd3d153e0b985b48d90e76fb1507

                                                                                SHA1

                                                                                c08be2658c63f766186d3ca8e3d1ce638ac00d6d

                                                                                SHA256

                                                                                7598b269fa52b23e08f9b4198ab9c553952a7872a02a34986082ed1a80de97a6

                                                                                SHA512

                                                                                512c0b194be2f3f0f96d1f1b20a832452dde2a02e78dd3278c160beb85b3c70cb2b425abbb23a6d94382cd9183d40a31b906ce4d9a92a16f4af22f4ea2137be0

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat

                                                                                Filesize

                                                                                75B

                                                                                MD5

                                                                                1ebc82a25cef4ec3a745be8b200e4620

                                                                                SHA1

                                                                                a80d5f9866fb15949802363f19ea0c8677b23c13

                                                                                SHA256

                                                                                4724c0ea67b1bb5815fb14d443237e0c60205aca3fb73603e4c954467a1aad1e

                                                                                SHA512

                                                                                d0bb30fab283a05d8fd18bd764bbfcdb0a24925a08a0ce75891d3c8bd747874f8931d050602c837d7a5d1d162ad11e07ba9658b1e607bff8b75d91f95d9059a8

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\SdkDbUpdatrV5.dll

                                                                                Filesize

                                                                                2.6MB

                                                                                MD5

                                                                                52c4aa7e428e86445b8e529ef93e8549

                                                                                SHA1

                                                                                72508ba29ff3becbbe9668e95efa8748ce69aa3f

                                                                                SHA256

                                                                                6050d13b465417dd38cc6e533f391781054d6d04533baed631c4ef4cea9c7f63

                                                                                SHA512

                                                                                f30c6902de6128afbaaed58b7d07e1a0a674f0650d02a1b98138892abcab0da36a08baa8ca0aba53f801f91323916e4076bda54d6c2dc44fdad8ab571b4575f7

                                                                              • C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exe

                                                                                Filesize

                                                                                5.9MB

                                                                                MD5

                                                                                7708a5e3933e1b612254a862264480ba

                                                                                SHA1

                                                                                6105629ce9db4b41a9794ee8c24c7b2d3610f4ea

                                                                                SHA256

                                                                                10230809ebd35191829bd21d88b7ffdc480a6e12f0a607eeb37d24a0d7246f58

                                                                                SHA512

                                                                                9db50f4d798b728b50f0ddce587e76a33ea25176fd244fe0a913a173efbab157ba8a61e892f3018a727709871864b09a1d903e7efd7eb44e08dc961cc859ff96

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\36b7b1ca-9c23-498d-bd29-28aab541ab97.tmp

                                                                                Filesize

                                                                                136KB

                                                                                MD5

                                                                                8cc4692c14a7e2aa92bfb5efc6d0853d

                                                                                SHA1

                                                                                6d83cb64f0fb81350af68efc8abcc3d6178528ae

                                                                                SHA256

                                                                                f3ab15a167b32eeae3dac9f8162b9fb026c84dfa8dd1b888dafa48d6be3250e8

                                                                                SHA512

                                                                                6ac237467950a9fb4cfe1fbdec89deeee34ec7bd93a712fbde1b037a13fc7c1d0b18ec9e4547a7853c32339094fc8a1e4d5e1bc82732cd9df701ef4593b55b71

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                97cd353f95dd047f1b307f4e2a06aed5

                                                                                SHA1

                                                                                8520d826fc1c44bd491c20cf6dd5905002ef6316

                                                                                SHA256

                                                                                818ff27950abc2c58757edf7fcf647cbcb9825e42a9bd64deb79954d7a90e305

                                                                                SHA512

                                                                                3d9578d7979253065f59d3236070b092e6c0bd7ab5cc4bfedcc48b6635810ba1e74628452b276fe87f8f287ce3a74226d0420cd09ac07ab2db1d3418cb7268e2

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                abf5cbcf4ffcd343518273d495de7ae0

                                                                                SHA1

                                                                                70c1cbcfbf1b70c477c0ad8fba6342c5483c2e60

                                                                                SHA256

                                                                                e3496d2469a8413e3f1575bf17036da0ea0090874aa92481d8bf96e8cce47287

                                                                                SHA512

                                                                                c0eb18e82203f119ed447e7a4710e93f42415c890c63162c377d2146e5f2bf04e370cceff3b0d1688214ff8040186f0f329ef09437767d51e631c5edcaea2dd1

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                                                Filesize

                                                                                264KB

                                                                                MD5

                                                                                329905dbab2c385dbe06cbe057a429d0

                                                                                SHA1

                                                                                c1f10f2840caec8241d0ee5468388a13f9ac9e9d

                                                                                SHA256

                                                                                30052449e97be5435b5265444652ca7193899e7b1074a50921aa94bd27089951

                                                                                SHA512

                                                                                ce8b0e934828c24b801cffb75e44e51fffe1368e961c1c9c733e8b8b71e33e55b2386375c779a19eadf2d55c5d873381a666b246d87425e6a9d6eda6b52ea0ac

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                135a0cb9763daefe23eac6523c5339ad

                                                                                SHA1

                                                                                618435cbf9d9bca2dd5d7475646562d3da26813f

                                                                                SHA256

                                                                                8d33ac9987a4ceda193799e40df6b129085b5ce4fd8439c7369885753e2bd3ec

                                                                                SHA512

                                                                                2467524ddab53e579ccf19c47c685b5d3185d218d6bf51b51b9b0cdbd242fedfe0ce4465b3d03c246465481514e673c179babe5fc564bbcfcb54536a466d3da2

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                0f8a75d3f834482b882a49c3be8c71eb

                                                                                SHA1

                                                                                3d6491b0162e7d4ea1f637ef99da90e99a13a43c

                                                                                SHA256

                                                                                4e6ae7877cc7ca8e92f987d8e7c4fec15311e36b1cb022dc7e5082f90e673858

                                                                                SHA512

                                                                                88946e08376eee9a72205bb5752581ac9752e4ed019faaeb87909de2183c168db7071be733fd71d6794e4201960ad1b95aa117bdfeebf304db8d3b978564222b

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                6683f753abf317496673799fa0516803

                                                                                SHA1

                                                                                7f15c3be123006aea05dae41150e5d7f8f0662e0

                                                                                SHA256

                                                                                8c3332722fae9d849ae6cc5ce08b8d4ca69bedb7c639cee788d23cc2c29c8abe

                                                                                SHA512

                                                                                5db2060bb9c139fb87b66e0bea9d55c1b4df5564b0b5b03627229f5f9e2fb8b19932dc5509f0094d166b3a116cea7793bb371063191c04b7bbb30b7ce68c9206

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                37624a63b6fe9def7badbebee36c78a9

                                                                                SHA1

                                                                                64ea59305a3c07b4de6d74607e979bfed10c0e6c

                                                                                SHA256

                                                                                78cecc575c5f05f935f75e7e28b61cce7f8269d04a92c295628b96d6b01cbedb

                                                                                SHA512

                                                                                c2842264c5d873396057c84356d967b50db19ad16fbb737229ea831aefb7fda701bd3cdfcd75094d095cf9436be833d97d511e25053f44364215aade7eea61ae

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                23c622b79b83e57db6c25ebe9ec2b35e

                                                                                SHA1

                                                                                853ba10055fdf594f3bf8865daf5f09911f6698f

                                                                                SHA256

                                                                                0f06f959440bf7457d8e1854c637be089dfe44cddd44e4daaf2c7095b7eeae86

                                                                                SHA512

                                                                                a90e8d29fa855d0f3ba3ae0e4a057c49c67d450039199f7e078ec1bf36967f9689b07697748a165fceb561622ab2dadc6e497aa56f06610ad227597b00609894

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                0d9f06a86909a643239901ab6dc1e4a5

                                                                                SHA1

                                                                                6013144159499dca89d0aaf9e861dd7ecbbff240

                                                                                SHA256

                                                                                5484a0496e3efde9a286dad31ec463b32324cd50b2059d3f567d097fede2a49e

                                                                                SHA512

                                                                                08732d39a1ae9641efa1302011961790fe34f6eaa6e14cf7f53c779bd1a8e7089ef6bb6a5c08a5ebcd6d68fe50e1ab63a1ed62c3818be40ba335c1eb32b55d66

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                e8805a54fde0700603926318a285b611

                                                                                SHA1

                                                                                6a40bbf83ec4f5c0dfedf4d35d18941bcbfa66ea

                                                                                SHA256

                                                                                4b5818ecd84ef091fecf3ab938bbf707ca92fc8edd654dfc3492cfcef1ee3546

                                                                                SHA512

                                                                                f7380e3654648f4e9b1aebec43591b32621eab02dce9eb7dd4a0e80d9ebf21794da2d2e867f598401feaaa1b80377e6accbcb17784f50ffbd64af792fb55bab3

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                a355a2d70d9c53c24be123f2f7acbeff

                                                                                SHA1

                                                                                22841e7f070e174404852540bfc1788d137d318f

                                                                                SHA256

                                                                                3081f00faf7e8207735993f567a23c0f4fa870ba24bfc713e2bf75f2d6ce12ff

                                                                                SHA512

                                                                                d9536c67f6dac1d87acc6e3138751d7fa0bbc7bc5cff2132ea600133b9e9c0370919e9263c6450dbd295081ee854684fa70fd4cd38d1bd9aca578eadfba30c4d

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                0377c78949b5bb919517b2b2b7174ed2

                                                                                SHA1

                                                                                3a71302bc712f418bbca18188216d4710084296f

                                                                                SHA256

                                                                                9b923bc3eaef0d0702353b679e8b08c3387fd075f82430f1e4d56563838669cf

                                                                                SHA512

                                                                                69f96d4a6ad7a3a863671846d2055a4e21477c0255974e13e7ecba0db0d72cf45afc662058b8ae853028415971acb4e6dd1aa290b418d5e77aa4d145b0aa31f7

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                904e0313a0337ea07c19431d60ac72bf

                                                                                SHA1

                                                                                89a46f93c92b652e6dedec3016c47265fa55794c

                                                                                SHA256

                                                                                15fec402a23f2a94f24d1de56fedea51fb554073f2166bef4fa7932e65ee242c

                                                                                SHA512

                                                                                6133159dd53a390562136b1d74f39822091e0b92186213ea279c766b3dd40815902889855a42b636b5c641596e4e4c3bc80ae0acfa6edc7158bc5d4fa647e08b

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                a7c8e95ebf2a7fc126dca51fbd9616e5

                                                                                SHA1

                                                                                480f7001672a9be67003e51f299d8515e52de6a0

                                                                                SHA256

                                                                                9de53fb20acba45d4cad510072a7cfdbb2e362b1620789519445650066458a05

                                                                                SHA512

                                                                                f77d5f995df536d9bdd01bf64483ce5c27ccf06295ce68fbe2f731df0daf91b096aa8bb4a44d252e6e3f177ea9446038741b831a10a14bfb80e0ffd18605845e

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                0c48b96d6e4e3599b4881bd8f8f6b594

                                                                                SHA1

                                                                                5964a6ac71f19b78a3c38802de354eba951037bf

                                                                                SHA256

                                                                                86ebf4bfa59e8c133a7a8a2b6a1571bdfe683fef8dc0c0dac7b05f17fba846f0

                                                                                SHA512

                                                                                d88ef9508ece362472932e508f284afb9bbc579d0112dbdf14a001c1b5f98d42b0be7599185eedc9ade36567ec3615b6fdd42a39857d2a9f2fcf006bda54d969

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                Filesize

                                                                                136KB

                                                                                MD5

                                                                                b80ee0d65242ed3e41f5a26c519bb6ce

                                                                                SHA1

                                                                                5b855cd3679a28a28ba5b26f2cd01dc2e50f3a8f

                                                                                SHA256

                                                                                85a1817e643e18709355d0a8605c9dccdccb89fe5dc09584ed651059207c6bad

                                                                                SHA512

                                                                                657191ffcb76361369db99888adf9d90c42383cc6fc0fe1bd9afd5c869d0e5bfd46e9b306ed4763d0cd5c9de83f187c0f7d2bfff3b0a5b58d9cbe25d79317feb

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                Filesize

                                                                                136KB

                                                                                MD5

                                                                                3a32a35f3ed2bcc2f1848a2ffcf9eba4

                                                                                SHA1

                                                                                ca2866bf05c2d293a3d3dc3a45880b408812adb9

                                                                                SHA256

                                                                                46b8170f13a5fd8bb265c466cea4ac9add04ce137ac43881200bda9d1c6e9a47

                                                                                SHA512

                                                                                6365441629e5cdcc4a6658f6e1fb825fe30901cad6fa52a16d730e0892b23d97c6b71d730cac18dbb93d2b0e5a667c0466661c4a67d734151800aa8b45e7c95a

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                Filesize

                                                                                136KB

                                                                                MD5

                                                                                69c2e8c0fb33bcd7d58cc8036c85c692

                                                                                SHA1

                                                                                86f66fa4d176a6dc0ace78fb4f696e2d92f513d1

                                                                                SHA256

                                                                                a0f12448055e69292e30757d9fc2954c3a8f0820409be21bac2852cdd93d59b4

                                                                                SHA512

                                                                                3b1252a7eae43c091a78eb85c7b333a69471c35c0224aaaa9937b36f54911fa98d932f432ed045830d4e4f2df90a07d5370e4925393697f6eb1e6c79aa781cc6

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                Filesize

                                                                                111KB

                                                                                MD5

                                                                                7303fddaab149963b94d7a9d55553b43

                                                                                SHA1

                                                                                f334219f4c5276e9678ae3ed62b2809b2c9c9c8f

                                                                                SHA256

                                                                                8438f3ac26a41941538b6b27ccda4c36647ba8f01fdc3e89038773978b6bf438

                                                                                SHA512

                                                                                67311f0e5f02429b8fb2d6378bc28c0775e55d6bdf1ef15996124414c155940b5c9b3f06cf448fe76d49b00d11162ef6a2479f41dbd6f5857e5b7f14a350c4e6

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                Filesize

                                                                                105KB

                                                                                MD5

                                                                                cd319dddd521e8aa1c67f09c5009208f

                                                                                SHA1

                                                                                77430240af77de1c61cabd17d6b2a1b256e1d34f

                                                                                SHA256

                                                                                85e634890628c4c0f8cedd897d24cf227d99ff5255aa69382f1831dd3e978f86

                                                                                SHA512

                                                                                f24e745ec1d4602fae938c5d4a251dd048dbdca097760639fbaef4477589cad36cd7efaebbaea20be81b537ff37418cf8ce5aa6f320c93bb24a46ed78673ee6d

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe582a86.TMP

                                                                                Filesize

                                                                                98KB

                                                                                MD5

                                                                                1889060dd2c3833dae0d79ca4e322154

                                                                                SHA1

                                                                                81f13759325bfc9e92c15fddadf908a0a8d918ec

                                                                                SHA256

                                                                                ec77a058f3148a1430f0b3e052788231c6d2d3ea9244ce4dc50b2608a3712333

                                                                                SHA512

                                                                                da83562e5f1df52cbb04b4511fcdfac7b036b367b1fde5a61ccbad3af673f28af5f777b4037fc0dd7955ed1854517c4954d2408c450e581c3da33f17f80aad41

                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                                Filesize

                                                                                2B

                                                                                MD5

                                                                                99914b932bd37a50b983c5e7c90ae93b

                                                                                SHA1

                                                                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                SHA256

                                                                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                SHA512

                                                                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7LCXWBZV\Roboto-light.ce8559ad[1].woff2

                                                                                Filesize

                                                                                109KB

                                                                                MD5

                                                                                025c67a0703a8dabdcf0339a3913c78d

                                                                                SHA1

                                                                                f0be153b2e42ec9a0742ca3c850213e9af0b8bb0

                                                                                SHA256

                                                                                5a25dc4bf661f7a5020b9420bb9f4cbae3492847c54e3413d37c9934cc06711f

                                                                                SHA512

                                                                                192e13223f9bf363f35642af64273a1e8cda0f98b5e53296a74331a5e1942f99fa6a72ada3c10df80c59159ce4fd760e253aaa98d7d97beb9511fe14cd98bc2c

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S2KJOORK\Roboto-light.922b4b2b[1].woff

                                                                                Filesize

                                                                                69KB

                                                                                MD5

                                                                                2cb09b3b3bc3ca54b2827b84ad14a177

                                                                                SHA1

                                                                                ec933699bd132a0c06b7627e8245bc6fae1cd244

                                                                                SHA256

                                                                                8017222f11d4067eb95a18bcfa1e4639ea51126b64472bd38ce5277cac6926fd

                                                                                SHA512

                                                                                01e03b1e9cd5a2fca522e1c7ae8827daa26282823e4a458c8937c8166625ce847bfaf7ac1e209c48c60ac66399c6ef2402d2841117453b1593718658d2dd473e

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YII18RLT\Graphik-Light.8512717f[1].woff2

                                                                                Filesize

                                                                                41KB

                                                                                MD5

                                                                                dd3dde4397a6f4f61a2d460f58ddc83f

                                                                                SHA1

                                                                                47e5615751f8a96a47405526172ac3896856ce69

                                                                                SHA256

                                                                                039bb21133a0657e78917ed224bc151347123282bbd3bf1e0c5da81bccb93da6

                                                                                SHA512

                                                                                9ced2ec0ff9478b8e9299163c4f306beb1b07b658a841ace9ec63e35a04780e1e2b1bcb699629722b02ad0a3033397b2bb3e85343fce577eec7badca08bfc6c7

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YII18RLT\Graphik-Medium.3ff48deb[1].woff2

                                                                                Filesize

                                                                                41KB

                                                                                MD5

                                                                                48be6e464ff8ec756c992726b493de51

                                                                                SHA1

                                                                                e1764af30e57eb5d7df59f8b3e8c791385548af4

                                                                                SHA256

                                                                                fc4c4327594c7559168718f24efe82754660fdd55f62aa796baefee1e9b8d3d3

                                                                                SHA512

                                                                                b0ba969fad483af9e2205e4d1ece856ce680f95ec75f30e347914263bb3d8de3a6eaef984b32e83243b58e66cc5caa76b3919ca8fb23e26d44d0dc4ee3c133f8

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YII18RLT\Graphik-Regular.3fdd19ea[1].woff2

                                                                                Filesize

                                                                                37KB

                                                                                MD5

                                                                                06f39e6344b13d29d1bbecce524d24fd

                                                                                SHA1

                                                                                7286c18338b38b9a93bbc3d70553e8072f2bb241

                                                                                SHA256

                                                                                9e1c5b7f15bcd940814677515f306113aa93921b6e7f0d184a6de904d07b6f43

                                                                                SHA512

                                                                                4998334ba4a7157495a2684a518974830541038edb4bb9ae663e91a900bd2972f0870ef557aac32050aa62dc172d4cb27bb063e2d669a72d4f0da1285123bcb5

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YII18RLT\Graphik-Semibold.b023d334[1].woff2

                                                                                Filesize

                                                                                41KB

                                                                                MD5

                                                                                f427534757749c1a8ef5a5713587c4ec

                                                                                SHA1

                                                                                526e5c6d6d9ac4e319094a4c5f80c9b5c318cf5a

                                                                                SHA256

                                                                                33441b6e44fb33343a5769858ca65653ce482e5e0c58c6eb1cee0e50aa06ddf6

                                                                                SHA512

                                                                                5674df335aa1c27ec8671b8f99acb3427ad0d2269c82a6269afc781436cb73efeadef44a7f21274994e078a07c93b3a6e4bd274b096bd7837fe5c7c6edd277c1

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YII18RLT\_static[1].css

                                                                                Filesize

                                                                                318KB

                                                                                MD5

                                                                                b5815d54cee8f2a95652ff0f68c557b0

                                                                                SHA1

                                                                                fd0694c894c8b87d9ecafe1b3345857ed36b40a7

                                                                                SHA256

                                                                                5b69a1a5eeb34c30601067c7aa339a1f6710c7722e6d89deef27d443fb1097b9

                                                                                SHA512

                                                                                00effc6767531400321c128e3337f85e36c338c6414d3da5d4a87611a5eea52a3c76b26ee537f52ea453f92da2c1d2bfaaf7c439bdcd8ad57371c2c61854b9a2

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\P0JFXRVZ\cropped-favicon-512x512-1-1[1].png

                                                                                Filesize

                                                                                831B

                                                                                MD5

                                                                                311a928ad1210a491bf2ddc244e644fb

                                                                                SHA1

                                                                                e236c8551176c4ecfda845b887b8dc28d99493dc

                                                                                SHA256

                                                                                952f93877fffd447f8e95a4dd76f10caea82d23e22319c3419f6702628647304

                                                                                SHA512

                                                                                e31a1cb9a0a41b28e644dd13d54abee0c6c7217e384b295eed85f094bab75a01946098ccbdddfdde1ac92792dff545dbfe3fa9af21fff83eae417bbf510bf9f3

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF9011BCC54D8BBF4F.TMP

                                                                                Filesize

                                                                                16KB

                                                                                MD5

                                                                                1ee493279d81ca2c0f61ec5a62977fed

                                                                                SHA1

                                                                                f2cb52b11375fbe9c1979aa600460b2a60bfd777

                                                                                SHA256

                                                                                985112ddae4672d0afb215a312f5f8ce3399b7d6d161b8a889682bf71fc07efa

                                                                                SHA512

                                                                                588b2a03a7ab03cfb3a3295e762cd842769b4e9ecdb906df228ee99298bec0863234d70732e5210c4ae4732ded451868c989fc2205f5ab308685245d5ec04128

                                                                              • C:\Users\Admin\Downloads\DeriaLock.exe

                                                                                Filesize

                                                                                484KB

                                                                                MD5

                                                                                0a7b70efba0aa93d4bc0857b87ac2fcb

                                                                                SHA1

                                                                                01a6c963b2f5f36ff21a1043587dcf921ae5f5cd

                                                                                SHA256

                                                                                4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309

                                                                                SHA512

                                                                                2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14

                                                                              • C:\Users\Admin\Downloads\MBSetup.exe

                                                                                Filesize

                                                                                2.5MB

                                                                                MD5

                                                                                8611a0d47266ce8d473d540bd6534ffc

                                                                                SHA1

                                                                                8804544c8ac023d89783d3d27b8c00b11dd8cbb4

                                                                                SHA256

                                                                                a573205f27cd8a421e33322a41037ddf74d4f9cedc574c86dea6550a8f065143

                                                                                SHA512

                                                                                8f4291ebb1b8cb5561b857d3ea2418c503f79b37b201f017d04a3c49746bfdc29abad5cfef3f2ce150fa8163824ac0a649a24386aee4562940d394f6514e4b7c

                                                                              • C:\Windows\System32\CatRoot2\dberr.txt

                                                                                Filesize

                                                                                93KB

                                                                                MD5

                                                                                d6427e0052faab4609ae1a0718a24a50

                                                                                SHA1

                                                                                43ac082de7000eb11a99a070972a40a223a36c67

                                                                                SHA256

                                                                                b88a679dc63d388f72b487d4c8868cfa020fca3219a5d947ec6e89ebad50a41b

                                                                                SHA512

                                                                                01906121c5a206f271344944c8d429f6cc8af7fcf0bdfdbe8b3481201e70cddf697e2a743487d031f46b9195b87069256bdd51e36f13ce6481f957767a43b704

                                                                              • C:\Windows\System32\catroot2\dberr.txt

                                                                                Filesize

                                                                                93KB

                                                                                MD5

                                                                                d620211de59806c2edf99069655f4be6

                                                                                SHA1

                                                                                905c8a6bf44bce3f64e8bb07cc28ec2f29668296

                                                                                SHA256

                                                                                9780060b60365b7faacca535e93a516236e0ed1d4b7460875606140d08725122

                                                                                SHA512

                                                                                38623767ca800754f4832438dccdab12a6601d91a530146ba9c55854f15a0e9422950f3a443d74e9b98312798d0943d35985ecf08ada93a7ed6e705ea878f425

                                                                              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EC3B71635F8BA3FC68DE181A104A0EF_10CFC0D4C45D2E76B7EA49C8C22BEDFE

                                                                                Filesize

                                                                                5B

                                                                                MD5

                                                                                5bfa51f3a417b98e7443eca90fc94703

                                                                                SHA1

                                                                                8c015d80b8a23f780bdd215dc842b0f5551f63bd

                                                                                SHA256

                                                                                bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

                                                                                SHA512

                                                                                4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

                                                                              • C:\Windows\System32\drivers\MbamChameleon.sys

                                                                                Filesize

                                                                                216KB

                                                                                MD5

                                                                                7764c438ad9a4f024d60c77b82f2721f

                                                                                SHA1

                                                                                64e478e83bde2965216a37f283beb2695997b69d

                                                                                SHA256

                                                                                3f51a3149e6a79cd71fcb1451660196b6ba59c3b687736f59b24e5dab425d73c

                                                                                SHA512

                                                                                bbbac97b950d20621ae396a7f8ba8ec990ad056e2180bfa10d11b4eaccf3680e8830d652b7972bae52826535bfc68ae8c1e4ee93071c954ec7f8dbc7a6dcfd84

                                                                              • C:\Windows\Temp\MBInstallTemp8b46a011491b11efa6b1c2153342db40\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json

                                                                                Filesize

                                                                                372B

                                                                                MD5

                                                                                d94cf983fba9ab1bb8a6cb3ad4a48f50

                                                                                SHA1

                                                                                04855d8b7a76b7ec74633043ef9986d4500ca63c

                                                                                SHA256

                                                                                1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

                                                                                SHA512

                                                                                09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

                                                                              • C:\Windows\Temp\MBInstallTemp8b46a011491b11efa6b1c2153342db40\ctlrpkg\mbae64.sys

                                                                                Filesize

                                                                                154KB

                                                                                MD5

                                                                                95515708f41a7e283d6725506f56f6f2

                                                                                SHA1

                                                                                9afc20a19db3d2a75b6915d8d9af602c5218735e

                                                                                SHA256

                                                                                321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6

                                                                                SHA512

                                                                                d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

                                                                              • C:\Windows\Temp\MBInstallTemp8b46a011491b11efa6b1c2153342db40\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll

                                                                                Filesize

                                                                                1.3MB

                                                                                MD5

                                                                                3143ffcfcc9818e0cd47cb9a980d2169

                                                                                SHA1

                                                                                72f1932fda377d3d71cb10f314fd946fab2ea77a

                                                                                SHA256

                                                                                b7fb9547e4359f6c116bd0dbe36a8ed05b7a490720f5a0d9013284be36b590b7

                                                                                SHA512

                                                                                904800d157eb010e7d17210f5797409fea005eed46fbf209bca454768b28f74ff3ff468eaad2cfd3642155d4978326274331a0a4e2c701dd7017e56ddfe5424b

                                                                              • C:\Windows\Temp\MBInstallTemp8b46a011491b11efa6b1c2153342db40\servicepkg\MBAMService.exe

                                                                                Filesize

                                                                                8.5MB

                                                                                MD5

                                                                                c02dea5bcab50ce7b075c8db8739dbe1

                                                                                SHA1

                                                                                d1d08a208e00567e62233a631176a5f9912a5368

                                                                                SHA256

                                                                                c264dd072a5c7954667804611bcc8a0708125ed907b1cf2f8f86434df1a125dd

                                                                                SHA512

                                                                                74bb2b82d0d2bad4e26138304d4e4ad6379acf19f8aa13aacc749901e7381281d59720d7bfc3c6df0c835d805f134ed08fcde47a79c4c5384a92abeaa4c89f4c

                                                                              • C:\Windows\Temp\MBInstallTemp8b46a011491b11efa6b1c2153342db40\servicepkg\mbamelam.cat

                                                                                Filesize

                                                                                10KB

                                                                                MD5

                                                                                60608328775d6acf03eaab38407e5b7c

                                                                                SHA1

                                                                                9f63644893517286753f63ad6d01bc8bfacf79b1

                                                                                SHA256

                                                                                3ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59

                                                                                SHA512

                                                                                9f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7

                                                                              • C:\Windows\Temp\MBInstallTemp8b46a011491b11efa6b1c2153342db40\servicepkg\mbamelam.inf

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                c481ad4dd1d91860335787aa61177932

                                                                                SHA1

                                                                                81633414c5bf5832a8584fb0740bc09596b9b66d

                                                                                SHA256

                                                                                793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3

                                                                                SHA512

                                                                                d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830

                                                                              • C:\Windows\Temp\MBInstallTemp8b46a011491b11efa6b1c2153342db40\servicepkg\mbamelam.sys

                                                                                Filesize

                                                                                20KB

                                                                                MD5

                                                                                9e77c51e14fa9a323ee1635dc74ecc07

                                                                                SHA1

                                                                                a78bde0bd73260ce7af9cdc441af9db54d1637c2

                                                                                SHA256

                                                                                b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0

                                                                                SHA512

                                                                                a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186

                                                                              • C:\Windows\Temp\MBInstallTemp8b46a011491b11efa6b1c2153342db40\servicepkg\srvversion.dat

                                                                                Filesize

                                                                                9B

                                                                                MD5

                                                                                b302673116414c7c4cc5428d0e50e7e5

                                                                                SHA1

                                                                                14c56a67d0f3e4f6c7e92146ead787d722b1e89e

                                                                                SHA256

                                                                                2bab6e8554a9f52106e43711b3d1c10b6e1125c9900e67cfab642b0e6be9ded3

                                                                                SHA512

                                                                                156db182d8d577eb570b6871b044a067e9f70316d0c5167c3127c6b60c368a26f125771b2411a219de39c2c14d2aaeef5dadc2eaeaa7228a4576fe62b2548a99

                                                                              • \Windows\Temp\MBInstallTemp8b46a011491b11efa6b1c2153342db40\7z.dll

                                                                                Filesize

                                                                                1.6MB

                                                                                MD5

                                                                                3430e2544637cebf8ba1f509ed5a27b1

                                                                                SHA1

                                                                                7e5bd7af223436081601413fb501b8bd20b67a1e

                                                                                SHA256

                                                                                bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa

                                                                                SHA512

                                                                                91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d

                                                                              • memory/688-6697-0x000001F940EE0000-0x000001F940EE1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/688-6459-0x000001F94A820000-0x000001F94A821000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/688-6293-0x000001F943920000-0x000001F943930000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/688-6277-0x000001F943820000-0x000001F943830000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/688-6312-0x000001F940EB0000-0x000001F940EB2000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/688-6701-0x000001F940B60000-0x000001F940B61000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/688-6694-0x000001F942A70000-0x000001F942A72000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/688-6458-0x000001F94A810000-0x000001F94A811000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/4244-6093-0x000002C65E1D0000-0x000002C65E1E0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4260-7633-0x0000000000FB0000-0x000000000119B000-memory.dmp

                                                                                Filesize

                                                                                1.9MB

                                                                              • memory/4720-6346-0x000002471B490000-0x000002471B492000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4720-6393-0x000002471D530000-0x000002471D532000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4720-6391-0x000002471D520000-0x000002471D522000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4720-6352-0x000002471AE00000-0x000002471AF00000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/4720-6432-0x000002471A610000-0x000002471A710000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/4720-6348-0x000002471B4B0000-0x000002471B4B2000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4720-6342-0x000002471B450000-0x000002471B452000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4720-6344-0x000002471B470000-0x000002471B472000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4720-6335-0x000002471ACF0000-0x000002471ACF2000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4720-6337-0x000002471B410000-0x000002471B412000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4720-6339-0x000002471B430000-0x000002471B432000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4720-6329-0x000002470A510000-0x000002470A610000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/5160-6170-0x0000000000B80000-0x0000000000D6B000-memory.dmp

                                                                                Filesize

                                                                                1.9MB

                                                                              • memory/5488-6717-0x0000000005190000-0x00000000051E6000-memory.dmp

                                                                                Filesize

                                                                                344KB

                                                                              • memory/5488-6713-0x0000000004F20000-0x0000000004FBC000-memory.dmp

                                                                                Filesize

                                                                                624KB

                                                                              • memory/5488-6714-0x00000000054C0000-0x00000000059BE000-memory.dmp

                                                                                Filesize

                                                                                5.0MB

                                                                              • memory/5488-6715-0x0000000004FC0000-0x0000000005052000-memory.dmp

                                                                                Filesize

                                                                                584KB

                                                                              • memory/5488-6716-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                              • memory/5488-6712-0x0000000000600000-0x0000000000682000-memory.dmp

                                                                                Filesize

                                                                                520KB