Overview

overview

10

Static

static

3

WannaCry.exe

windows11-21h2-x64

10

Resubmissions

06-08-2024 18:54

240806-xkfalsxckp 10

06-08-2024 15:17

240806-spgxsawekf 10

06-08-2024 15:16

240806-snyh5swejf 10

06-08-2024 15:15

240806-smzptawdph 10

06-08-2024 14:54

240806-r9xnaswbjb 10

06-08-2024 01:49

240806-b88feazcka 10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06-08-2024 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WannaCry.exe

  • Size

    224KB

  • MD5

    5c7fb0927db37372da25f270708103a2

  • SHA1

    120ed9279d85cbfa56e5b7779ffa7162074f7a29

  • SHA256

    be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

  • SHA512

    a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

  • SSDEEP

    3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ

Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealerworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 6 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 9 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 31 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 16 IoCs
    evasionspywaretrojan
  • NTFS ADS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
    "C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 278571722956060.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\cscript.exe
        cscript //nologo c.vbs
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2232
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe f
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4148
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MSExchange*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3784
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Microsoft.Exchange.*
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2260
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlserver.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1576
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlwriter.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1512
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe c
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3568
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b !WannaDecryptor!.exe v
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4536
      • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
        !WannaDecryptor!.exe v
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3464
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1908
    • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
      !WannaDecryptor!.exe
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2008
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:672
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdfbac3cb8,0x7ffdfbac3cc8,0x7ffdfbac3cd8
      2⤵
        PID:340
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
        2⤵
          PID:3944
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
          2⤵
            PID:3904
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
            2⤵
              PID:3444
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
              2⤵
                PID:4936
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
                2⤵
                  PID:1516
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
                  2⤵
                    PID:1540
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3136
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4740
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
                    2⤵
                      PID:3968
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
                      2⤵
                        PID:3104
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5224 /prefetch:8
                        2⤵
                          PID:1244
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5304 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3908
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                          2⤵
                            PID:1064
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
                            2⤵
                              PID:8
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                              2⤵
                                PID:3164
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                                2⤵
                                  PID:1944
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
                                  2⤵
                                    PID:1820
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
                                    2⤵
                                      PID:2532
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
                                      2⤵
                                        PID:1432
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
                                        2⤵
                                          PID:2272
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6328 /prefetch:8
                                          2⤵
                                            PID:3948
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6792 /prefetch:8
                                            2⤵
                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                            • NTFS ADS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:788
                                          • C:\Users\Admin\Downloads\MBSetup.exe
                                            "C:\Users\Admin\Downloads\MBSetup.exe"
                                            2⤵
                                            • Drops file in Drivers directory
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3432
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /C timeout /t 1 & "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1380
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout /t 1
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Delays execution with timeout.exe
                                                PID:1476
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"
                                                4⤵
                                                  PID:1144
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi
                                                    5⤵
                                                    • Checks processor information in registry
                                                    PID:4348
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1988 -prefMapHandle 1884 -prefsLen 21730 -prefMapSize 243020 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3fea2f4-5e79-412d-b4ad-8ab65a1ffeda} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" gpu
                                                      6⤵
                                                        PID:5196
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2500 -parentBuildID 20240401114208 -prefsHandle 2492 -prefMapHandle 2488 -prefsLen 21730 -prefMapSize 243020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49e2a766-a1a0-4aa4-896a-9042bcc63249} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" socket
                                                        6⤵
                                                          PID:1056
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3656 -childID 1 -isForBrowser -prefsHandle 3648 -prefMapHandle 3644 -prefsLen 22395 -prefMapSize 243020 -jsInitHandle 1400 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {153c8f65-a4e7-4488-add2-d3c97c029d8e} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" tab
                                                          6⤵
                                                            PID:6308
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3884 -childID 2 -isForBrowser -prefsHandle 4152 -prefMapHandle 4148 -prefsLen 23619 -prefMapSize 243020 -jsInitHandle 1400 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f22fb8f1-6c90-483e-905f-9dea23d1bc6c} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" tab
                                                            6⤵
                                                              PID:908
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2408 /prefetch:8
                                                      2⤵
                                                        PID:7096
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,12185405832525029333,6215969665562431960,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4792 /prefetch:2
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5568
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:4732
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:3668
                                                        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
                                                          "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
                                                          1⤵
                                                          • Drops file in Drivers directory
                                                          • Executes dropped EXE
                                                          • Impair Defenses: Safe Mode Boot
                                                          • Loads dropped DLL
                                                          • Enumerates connected drives
                                                          • Drops file in Program Files directory
                                                          • Modifies Internet Explorer settings
                                                          • Modifies data under HKEY_USERS
                                                          • Modifies system certificate store
                                                          • NTFS ADS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2524
                                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
                                                            "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            PID:5520
                                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
                                                            "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
                                                            2⤵
                                                            • Drops file in Drivers directory
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Modifies registry class
                                                            PID:2956
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                          1⤵
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          PID:5804
                                                          • C:\Windows\system32\DrvInst.exe
                                                            DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000154" "Service-0x0-3e7$\Default" "0000000000000168" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            • Modifies data under HKEY_USERS
                                                            PID:5708
                                                        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
                                                          "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
                                                          1⤵
                                                          • Drops file in Drivers directory
                                                          • Sets service image path in registry
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Enumerates connected drives
                                                          • Checks processor information in registry
                                                          • Modifies Internet Explorer settings
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1420
                                                          • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                            "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow
                                                            2⤵
                                                              PID:4836

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Reconnaissance

                                                          Resource Development

                                                          Initial Access

                                                          Execution

                                                          Windows Management Instrumentation

                                                          1
                                                          T1047

                                                          Persistence

                                                          Boot or Logon Autostart Execution

                                                          2
                                                          T1547

                                                          Registry Run Keys / Startup Folder

                                                          2
                                                          T1547.001

                                                          Event Triggered Execution

                                                          1
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Privilege Escalation

                                                          Boot or Logon Autostart Execution

                                                          2
                                                          T1547

                                                          Registry Run Keys / Startup Folder

                                                          2
                                                          T1547.001

                                                          Event Triggered Execution

                                                          1
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Defense Evasion

                                                          Impair Defenses

                                                          1
                                                          T1562

                                                          Safe Mode Boot

                                                          1
                                                          T1562.009

                                                          Indicator Removal

                                                          1
                                                          T1070

                                                          File Deletion

                                                          1
                                                          T1070.004

                                                          Modify Registry

                                                          5
                                                          T1112

                                                          Subvert Trust Controls

                                                          2
                                                          T1553

                                                          Install Root Certificate

                                                          1
                                                          T1553.004

                                                          SIP and Trust Provider Hijacking

                                                          1
                                                          T1553.003

                                                          Credential Access

                                                          Unsecured Credentials

                                                          1
                                                          T1552

                                                          Credentials In Files

                                                          1
                                                          T1552.001

                                                          Discovery

                                                          Browser Information Discovery

                                                          1
                                                          T1217

                                                          Peripheral Device Discovery

                                                          2
                                                          T1120

                                                          Query Registry

                                                          6
                                                          T1012

                                                          System Information Discovery

                                                          6
                                                          T1082

                                                          System Location Discovery

                                                          1
                                                          T1614

                                                          System Language Discovery

                                                          1
                                                          T1614.001

                                                          Lateral Movement

                                                          Remote Services

                                                          1
                                                          T1021

                                                          Remote Desktop Protocol

                                                          1
                                                          T1021.001

                                                          Collection

                                                          Data from Local System

                                                          1
                                                          T1005

                                                          Command and Control

                                                          Exfiltration

                                                          Impact

                                                          Defacement

                                                          1
                                                          T1491

                                                          Inhibit System Recovery

                                                          1
                                                          T1490

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
                                                            Filesize

                                                            4.2MB

                                                            MD5

                                                            03d6455dc6934a409082bf8d2ce119d5

                                                            SHA1

                                                            995963c33a268a7ed6408c2e6de1281e52091be2

                                                            SHA256

                                                            82ca2aec64fe151efd59a838c1845111bfb9f94ff277be3afae4e3f684ef3a62

                                                            SHA512

                                                            a0ff71bc01a11c9a95c1a0186a7bbfec9c3f84d7e600d0bca877934fa5f84053627bc59bb355f53ce9e3c9e4c6a841b8f5cb7436fe7f43b63426a8a851392c6d

                                                            Download Submit

                                                          • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
                                                            Filesize

                                                            10KB

                                                            MD5

                                                            8abff1fbf08d70c1681a9b20384dbbf9

                                                            SHA1

                                                            c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6

                                                            SHA256

                                                            9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658

                                                            SHA512

                                                            37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f

                                                            Download Submit

                                                          • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
                                                            Filesize

                                                            107KB

                                                            MD5

                                                            83d4fba999eb8b34047c38fabef60243

                                                            SHA1

                                                            25731b57e9968282610f337bc6d769aa26af4938

                                                            SHA256

                                                            6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c

                                                            SHA512

                                                            47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
                                                            Filesize

                                                            8.6MB

                                                            MD5

                                                            4dc92b52e48b9a7e209307def43f0fa4

                                                            SHA1

                                                            ba0640d5afd2d5b07fdfca4d2a37a1208bda1b94

                                                            SHA256

                                                            461727e42566cd84e4161d5332131956041e02e3d81cfec07c22862fa4b6d3d4

                                                            SHA512

                                                            cb1b2f63befed99c26a5f4912f5e9e7a315f75414097e66a2c2768573425129d18245e515d2bf38e352eefd78d0e61407d43a09993edf0aec6e2ff7c296d0d8d

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
                                                            Filesize

                                                            2.9MB

                                                            MD5

                                                            46f875f1fe3d6063b390e3a170c90e50

                                                            SHA1

                                                            62b901749a6e3964040f9af5ddb9a684936f6c30

                                                            SHA256

                                                            1cf9d3512efffaa2290c105ac8b7534026604067c9b533e7b7df2e017569a4ec

                                                            SHA512

                                                            fdfb348061158f8133380e9a94215f4bfc0f6ce643a129d623cb8034c49144f1489de56cd076da645478506d9fbddc7590fe3d643622210084b15fdf0d16b557

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                            Filesize

                                                            291KB

                                                            MD5

                                                            44cb90ea083b7bc3e45a26ccdab7547b

                                                            SHA1

                                                            ae98b313fa7c4f584d1a9077a656605ce79f4076

                                                            SHA256

                                                            ebc35d0c495d460e5f18ffd5a04813323d063963485eb63bd84de38632a4cd75

                                                            SHA512

                                                            e6baa2dae9b0e5f838e04000b83cb76e9c54bfab0af48e3163f8627ca5ea2a72ab962be8a46e097d9e5aa09163139aeadd26d4604c54c3c6a875bc029fd9f9ec

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
                                                            Filesize

                                                            621B

                                                            MD5

                                                            4434aa07690d8ec78f9a56dd0df5d198

                                                            SHA1

                                                            46d13bd00d9f30f6e5fe6935eb73205b703f6c49

                                                            SHA256

                                                            03cdf86ef473d2e8384628ff77ddfe3570fb33209faaba3e6204f5b1a75bb8f2

                                                            SHA512

                                                            0cc0875cc7bc613b21c50ebf3d0e53534bfa20036cb3b4cd370cb055c6aa5b6ffd0d5cfca1d22f32773839c01b269ee56921c9760e53c9f1b1f33c54b0759ea7

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
                                                            Filesize

                                                            654B

                                                            MD5

                                                            c2b622d30048d45f2975e94f1c68ada7

                                                            SHA1

                                                            b67872077ccc5ae9e3dcb45b721701467235e143

                                                            SHA256

                                                            b16ce874f04ed71e79c4a93212c4e9fff7d65e7ce6f003dd9e0b8bdc52083c8e

                                                            SHA512

                                                            f0b83d905e59093a144f120a1dfc208e274256be16f250ae6702504d13b8a411dd4b93a0123853b2e080f40ca952f55cd75074b37f52d0239bde4102878de7df

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat
                                                            Filesize

                                                            8B

                                                            MD5

                                                            dfc81f506c5cba82d533a0828d2c46b7

                                                            SHA1

                                                            28399192b912c55ccae4291551be15bbb1fb12fb

                                                            SHA256

                                                            f5076f41420169b67bd85561fc37eebfd4a4489ebafa098a3af077b920e9d0db

                                                            SHA512

                                                            81821a31cb5513558ef04dab23735e8cb1f3ea7d03dacd587cf65e67641324e400cd4469556840808d85bb2fb75fdafafd9599bcaa8dc52146f0897a2ae6d96d

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe
                                                            Filesize

                                                            3.9MB

                                                            MD5

                                                            dfd900def4742b3565bc9aa63ec11af5

                                                            SHA1

                                                            c1cefc356045ccf20ebc98f6c48b2a85f0d32465

                                                            SHA256

                                                            eae4a33cfa155a9f5f520816b42dc4f4012d5c7c916dc756b3de025a3062a461

                                                            SHA512

                                                            bb2b4daa121dab894ad036648eff6f81e9be97840b4be7ba54b7df0383cf863b157d6088814a0d63c7523751f8c68d9b5c1f247512d7587348750c1b71ef3b3e

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
                                                            Filesize

                                                            2.8MB

                                                            MD5

                                                            2bbf63f1dab335f5caf431dbd4f38494

                                                            SHA1

                                                            90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0

                                                            SHA256

                                                            f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364

                                                            SHA512

                                                            ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            5d1917024b228efbeab3c696e663873e

                                                            SHA1

                                                            cec5e88c2481d323ec366c18024d61a117f01b21

                                                            SHA256

                                                            4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8

                                                            SHA512

                                                            14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
                                                            Filesize

                                                            113KB

                                                            MD5

                                                            2ccb84bed084f27ca22bdd1e170a6851

                                                            SHA1

                                                            16608b35c136813bb565fe9c916cb7b01f0b20af

                                                            SHA256

                                                            a538caf4ac94708ddb4240d38b1b99914ca3e82283f0d8a2290be28fc05eaccb

                                                            SHA512

                                                            0fd66d241bdebd0052f4972e85b42639e3c5a40affe23170b84bc4068dff8e84446898a77ebf7cc0bef97454abb788faccce508a68bc5e717980ef26d8436986

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
                                                            Filesize

                                                            10KB

                                                            MD5

                                                            ddb20ff5524a3a22a0eb1f3e863991a7

                                                            SHA1

                                                            260fbc1f268d426d46f3629e250c2afd0518ed24

                                                            SHA256

                                                            5fc1d0838af2d7f4030e160f6a548b10bf5ca03ea60ec55a09a9adbbb056639a

                                                            SHA512

                                                            7c6970e35395663f97e96d5bf7639a082e111fa368f22000d649da7a9c81c285ee84b6cf63a4fccb0990e5586e70e1b9efc15cf5e4d40946736ca51ec256e953

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            d87c2f68057611e687bdb8cc6ebea5b8

                                                            SHA1

                                                            27b1311d3b199e4c22772fa1b7ea556805775d37

                                                            SHA256

                                                            ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8

                                                            SHA512

                                                            4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
                                                            Filesize

                                                            233KB

                                                            MD5

                                                            246a1d7980f7d45c2456574ec3f32cbe

                                                            SHA1

                                                            c5fad4598c3698fdaa4aa42a74fb8fa170ffe413

                                                            SHA256

                                                            45948a1715f0420c66a22518a1a45a0f20463b342ce05d36c18b8c53b4d78147

                                                            SHA512

                                                            265e6da7c9eede8ea61f204b3524893cf9bd1ed11b338eb95c4a841428927cccbed02b7d8757a4153ce02863e8be830ea744981f800351b1e383e71ddaad36ad

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat
                                                            Filesize

                                                            9B

                                                            MD5

                                                            a58601a3ccc71c69736ff3f16e3faa50

                                                            SHA1

                                                            4ef363a438a28e0c966f055f89788c9292b8e091

                                                            SHA256

                                                            3edae4348be02e88de39aed7fce3aa4e781afb6b7728121777066ef9b9b17555

                                                            SHA512

                                                            d23ae01eb0824a7e1865f9a7389bac349373a90ded9e46937f331bb44aa4e9b275efd795b346270497fa67f2afb9624c8a088cf923e3029090ddda11c8ad6ca7

                                                            Download Submit

                                                          • C:\Program Files\Malwarebytes\Anti-Malware\version.dat
                                                            Filesize

                                                            47B

                                                            MD5

                                                            034cbf9421690e278200d2c88d212eff

                                                            SHA1

                                                            f30c5e86db1196bc931a44bb9118bab43c0255c8

                                                            SHA256

                                                            dcf557d3f2cdb71a0710ea7c85e110d3690b49b4ab49fa6688a8926fa96253ad

                                                            SHA512

                                                            6b0b900273537a99b1aa9c0f4d1b0ec6c1372d5dde5bd797ae13b5ac4495f60997962f39869d2c66a9643dcc371bf4210f06e7e00f6acc810aa8c3719597326d

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            d0a581216fb8c65fbbaa041e1432a86a

                                                            SHA1

                                                            15abe52fd13fbbf3fe94859bf94486993a7b5a96

                                                            SHA256

                                                            9f081b304e2e02771547a98f4e2fd1873ec7bd180aba9d78052705f044951f23

                                                            SHA512

                                                            91f6e2de9ba5622f4d77dce6d426747448e5d187c10fde203b4faf8c3d9365b57313d2727ac77984469ba030a7b83ba99a51e5de38aa7b3f1883325f06581477

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
                                                            Filesize

                                                            47KB

                                                            MD5

                                                            4ad87cd16e0b0bcf87c485ef70c6c6af

                                                            SHA1

                                                            d3641e629ec7b489cfb50b30c3eaf06606bf8f4c

                                                            SHA256

                                                            98fd59859ae456cdada5e27702fbfeacd1d22a340ab94641d2c91b23944ffbd7

                                                            SHA512

                                                            c1950647651a4132922c5300234c699be2a15f93520b3e9f9f2e131c840ce2e807420959794ca4f40ff922f3249d5ab4005cd0a46e0c5a10506b035448b793ee

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
                                                            Filesize

                                                            66KB

                                                            MD5

                                                            186ec59b90632e5dc91612e0f3883ec0

                                                            SHA1

                                                            5fdd1ff14c85379c7c5d3df626c7a826c6cf1b33

                                                            SHA256

                                                            f6659ce78f73d16d03599737eb05b84b205acaa0d1702c77b90727e8029a9963

                                                            SHA512

                                                            2b20cdfa9978b73c12ced0a05e5e40c32313de6d06dd6078d39825ba739f811ebb295ec54fb3b994876defe5035aa0bb4771f039a6d6abb4f6effa96bedc74fb

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
                                                            Filesize

                                                            66KB

                                                            MD5

                                                            12b5e41f286e335e5ce7f690463584e8

                                                            SHA1

                                                            7017fdea6f512c97efed883a289145308a5af549

                                                            SHA256

                                                            fd44d003273293bf6b85737e1b2a78fa2a73fc6ddce853951e8aa9bced0a4778

                                                            SHA512

                                                            2c829354fd8d9b272e4b3bb6f0f0416883a9813b55d8ddde36807f0916fc08e1e9349ddff49120aeba0e1dcb454817f13bbf33b4ee6923609c5e5e9f43972c77

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
                                                            Filesize

                                                            607B

                                                            MD5

                                                            228d8aa512bd1bebf493e483a61f4f40

                                                            SHA1

                                                            f61bc1949359eb20420e6ae3338f8980cbeebd0d

                                                            SHA256

                                                            dc7411af6ded7581443c997ab2dc6875c8bb658bf57b23d3b5353406eb86b5c7

                                                            SHA512

                                                            24463363cb8b1a1091c80c33ae6cb5b69eaf1d11904d7533d6731e84c020ba2de0487da28f3dc4f08fb1d66773c3e417147888a84f80ae67d99b1a2fdf097409

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
                                                            Filesize

                                                            847B

                                                            MD5

                                                            b84b447d39e7a88d819f1f6cc08fb966

                                                            SHA1

                                                            364ffdb61325d06356f9fcd024ecdb6daf47857a

                                                            SHA256

                                                            992774949ecb69a9d1d7021f6e91650c0b1724ef955c5c07e833ce46b78fa612

                                                            SHA512

                                                            7a057f81038e852815890c6a37d5241e1b07e7b8217f6e187de984b91401e19ed6681db4a7198929cca3be22bc9f8cb1684656a057b9634b6f3d3d38375a599c

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
                                                            Filesize

                                                            827B

                                                            MD5

                                                            f0b0f0c0ba35f8284f8f5afd8dc4aa5e

                                                            SHA1

                                                            96220bafcc06c5ed14603709e5aad8c2d6317179

                                                            SHA256

                                                            b9858955b7a4f806260edcca8b3b776d89384640b0a643eaa68427c7cc5d6d85

                                                            SHA512

                                                            da1d15366ef7b1f32ef6d980ff97330bbbb3d4f46e30d6984c6260b02f30e40c821d35442f01988916f0b6f94bf1b5d80e7fd617c0aef6189d54bcd6d3ba938a

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            512f8a92576cd3d1272e761b88dbbfce

                                                            SHA1

                                                            64b0fe57163971fe148a76c68c3d6ed0d5124fb7

                                                            SHA256

                                                            8d08fed562d0f194dfcbfe7ac15eb07c601cbceab35a4ef934f0818c5fc99f70

                                                            SHA512

                                                            af4190b80f0a8443b6b6df5d9a5ea8872b43a40a8709b546ba497f9236c1e127b7e1457bc9a0f758bd0e022cb11126d13a2caf011d50543e415d9be0dc736c01

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            0f16cf31a35d8e40eb2d45cc63e7c2f9

                                                            SHA1

                                                            4718defc451a6d41a3fa25e2ed63d62626afa9a7

                                                            SHA256

                                                            b15cf9e5f9cd5117b427d8df9f33bc00644fcf27b46fcb247a3b9a53ccddaf20

                                                            SHA512

                                                            64a084b57b3e8cbae2b4ce4bec0fc669b55e4b67e6c53926dfcd8e1db0d035700cd8dbb3ad4075b5a1950a249343b40bf705f45157135037504959f7e55af702

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            7b354f7bfe7bcfc5a446915e9e9560a0

                                                            SHA1

                                                            9ee9c1bf137beeaf10767863a8c8595594f00633

                                                            SHA256

                                                            439e42df4888ccd474fc624c4ef913b6f8150eade7fadd7c7fec649a8cfc7224

                                                            SHA512

                                                            fa014c135ea48c961674da9ac777b201c108d4a1e3c6272809ba042572e8c58669205d987c4730ccdf8d8ba87885c54b1f646ba20691eb466760dd2367bd65db

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            41a4c382aac5e249ba4141309a54b4cd

                                                            SHA1

                                                            ec332cd6f9087631f6d1b0018ce2e2e72a3b7fd8

                                                            SHA256

                                                            65b60862177c76d9933b5a938267ed6be617a4f74b024c38a739a7579b9a6b8e

                                                            SHA512

                                                            9b5182a4447042108bedc8b6ddd2619ee533aba126c475a4668136972a9d4e1f3a3b0e47e54d3d7677e81bf65f122c052e905b75020fab687bdb6c7bb9aa0aec

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            b5d91e78ac2aec43e6fba9d398c53ad7

                                                            SHA1

                                                            2535592d76061f6aa56769ae2407990abd26316c

                                                            SHA256

                                                            78f7241d5b758a3b63999c5f36ae221fea42dd27c83fd7d8c01e74f9e3f5cabe

                                                            SHA512

                                                            cb1da6f0327577242c63f158d5a3a0025412e31dd863c72ac0a70f7dafb9b292a5c48cc9bf180048a65d9b7323d5ee9c91e17ca43bee30ddf31a31ef9b98d504

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
                                                            Filesize

                                                            814B

                                                            MD5

                                                            faad7379d31cc0007d6e17f3ae9bdc35

                                                            SHA1

                                                            82417b404efe1934e8c96f185a49f06f8aa98db4

                                                            SHA256

                                                            dd683135d05dbac71b0eafa1c49158b812b41e46363a079729689877e1f3e9e5

                                                            SHA512

                                                            76cca9000e5a6f023f2a4ba18562eb04eccdc65787a133d35f99ccbb0abb04f5dd46928da2391282ff611110f3b1cbc70e89f48800954af18d826bb9c56b23f9

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            fb12d31fe2c7f011f4234686a80444f2

                                                            SHA1

                                                            56565ebf8fd9208241268c07a8b190b1d11be231

                                                            SHA256

                                                            e6a335f79b2af29f037da81d105f8c0dd97ae9fc4af9c2766bbfad4e07da73fe

                                                            SHA512

                                                            a9117043ab37e33e66ff9881f77c79ff43b331d278c24f8d83dab5b124f4085064a27d26aeb56e80fd8a62c85c9dc4157e7079ef0ffad9507386540f96e8ec79

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            fa174c81d3150b655ebafe1509a56e5b

                                                            SHA1

                                                            d79292c7462e83e9cb49db2edc4c02c4892f47ca

                                                            SHA256

                                                            7754f6abb1bb2e3dd23db2e4f6de16626f7d3c0be43227f2fc34ee69b134de42

                                                            SHA512

                                                            97cdda3997d01e2546820006b2c844ed026d72867481755910c1235dba3ab87f01cde8d0a085612d6da2349e167d340c138573bafbc67ed469312c9823406a17

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
                                                            Filesize

                                                            4KB

                                                            MD5

                                                            898787db3c60658f99f777c0b6b2b599

                                                            SHA1

                                                            8ab707b3185ffa14bf2ee4f6e64d9507d7ae1f88

                                                            SHA256

                                                            2e8adaef2b2c51afc47ee144c6bd0cd98833c2ab12348d6aaa5f744d067ea38d

                                                            SHA512

                                                            d574e4ce114b291b9ca0b09463aba58fe2b21977becc8eb8908227cda6d27eb7cb43a6db294bf3d8a07203e1df33002e4fafb913d4149156c6f6658a8db510f7

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            10e4853d1a8e15252d72f1b2898898d6

                                                            SHA1

                                                            041220f8584e755d9b7f0686d990007e4ccad509

                                                            SHA256

                                                            6cb720d673f7221c7693a6194a2ff36bc9ecd5488598782bf5158b24e121fe35

                                                            SHA512

                                                            806c5d0c6f2e93e6f70d99dd220e309fbb871d0b60ad116c86a3360eeb5a0019b3b20b3c0c50eb0dc3f409ee5bdfe5fb3b1f9552925c7277ff957f0e2defc42a

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            b6ccdcc9b48973696eb2bed99e29c6be

                                                            SHA1

                                                            71d46a9a15a6058d59459b5c9e82453bf611dfc6

                                                            SHA256

                                                            1618ec64365443e8e19d21c6e9ffb53f2a7bdde48523a603683b9835ca2ab322

                                                            SHA512

                                                            bf729afa42945e79c9a622de0d06fbecdc9a28182c9efa55454865445668df3d9772084c589869bd56fcfa406eea281037daa45ddf162f196d026efca0da7bbd

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            1f1e72ef93c4dd5d047b491781784cb7

                                                            SHA1

                                                            e606f32263468ebac2bbeda302a5d850db7cb732

                                                            SHA256

                                                            d9e8b0472367e9c10eb31f5c79eb1462870a06e9db1a7edd15838c36cd4d80c5

                                                            SHA512

                                                            5335c4271bdafc55b0b26e176240bf5f43f95de7194f86940649e6228c2aa67ffee7c729a898ef3fb5787bf1d7e3485a604fa63b7877729310ca6bb043017a27

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            a54e211f3d4c1dc3da8332dab9f268f0

                                                            SHA1

                                                            1fd0b03c6c516e3f2de99e29bcb409f29fa86aca

                                                            SHA256

                                                            66740131c5317a59b5aae7bde1be0187b5b9b8f8c56cdf478523870b792492cc

                                                            SHA512

                                                            d817653f6dbbd8e4ae0a6d41d7b962ac262bbdc741beae1c9259313d58ad22bd740d189cf9b9e6e9cf8305b11964801fea81ac07af2155a35030d9f3e38c6c3d

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            8bce087609855036b0f6dfea1bd0ed80

                                                            SHA1

                                                            4d43231966c82c00fe8e1ca2b2a667c140c85178

                                                            SHA256

                                                            d237f93d66e707b2f7fc8e9c1e3a9bd25ddea16b2bdf62b9eb0243d051f18bc8

                                                            SHA512

                                                            ed4ee423128a4746a9eb63f1bad8f8b08e57ec1d23166ded7f220126549920cb5dea5d13b3dc62a98578ce2217af83459f3b4990d09015841b15ad8cb1e48f72

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            9e824d23cd6ce3a0b90e4dce06c2027b

                                                            SHA1

                                                            be09c4d45a704e8d6b324fd59ee111e85eb5b8ff

                                                            SHA256

                                                            dcb3a8f2e99116d58380a905e37f3d11061ff62d531df5753e36751c5d72384c

                                                            SHA512

                                                            c63054904e892340eece6e0786eb2eca629a77b65fadcefd2b34fa82ac2bc0cad1535668659ac34da43370211e10c29395dd15533140a49e40b086507e0eb619

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            847193d6fc7b0774ca0545fa52853c2a

                                                            SHA1

                                                            c4ae49fb1dc2bd71921175a393a5efa53430242a

                                                            SHA256

                                                            fdc4181f2be592bb1792fb2ecb7409f570fbd024b04737b84f88258726145ad7

                                                            SHA512

                                                            6775c8fd8d2a1263d91d87028d072a3de9f2e963965c832f598fa7e27cbfd92375b4ae1fd96a0555ef1d3195e3b43f9fc8cf3200bce6a0f716e19369d6b4ad41

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            f4fbbb15ab7768c8b3a25e60cf24a67a

                                                            SHA1

                                                            c3d155eb1ef20b2fb87e25191c80685d5d7c7021

                                                            SHA256

                                                            75bbaf5c93637cb476afb44b4a5c62465b6aec3fdc28252a08e3cef8bf38ec7e

                                                            SHA512

                                                            95bf255b641dd026cc2f9c1ac46fa56d1c11a2a3a94c4af191950fa3aa48ad6176c0731ee89b7be56ec8d2696d0bd75e414a618711ba150a763563eac8951a97

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            98015bc1d636af1671401622c8477def

                                                            SHA1

                                                            80797ceaf0e4f229235030cfe5ec1c43dcc4d376

                                                            SHA256

                                                            06c6a42314c33fce8f218ec48f7e0e04469b42fe9bce6db2e8d3ce3f1482a967

                                                            SHA512

                                                            28c65007e96220bb24eb4fb0d586bc74f5ccae263e23435a6efc3f73c851a62ee028fdcf5e746a17baa0a786c2c51d8d89f6e71d10c6b80b53871695893b237e

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            749859c438fae90a653318d47cde44bf

                                                            SHA1

                                                            bd823d8c633655d47b499c754069a159129b06ac

                                                            SHA256

                                                            2b1d1760fa9b990c85c218c8571163428f8c4aadc85ed5f11429d2479cd1ee70

                                                            SHA512

                                                            33c3abd9e62f9f419071c0497e04b5470f00884d3efaaf7c366b9d015b6d6e87cc78a1e967afc15286c2a9c4790b436e7d529b2a27da1732728abdc625cd9a95

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            f538a12a121dda0ffee994af490df83f

                                                            SHA1

                                                            517d1db50d533aba13da84e1ddfec874c878e8f4

                                                            SHA256

                                                            4fa65e60874753bd6c8e84e24703b53361dbdc10aaa34e40585bc567554062c3

                                                            SHA512

                                                            918743e50d3a1491255096540b4f73cd5f04534d9bce9aa0fa6d1b181b17c64c85bf493f37bedeaf0e8d62c86a3369e7fa980954dfd0e57475708acf3ed1d191

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            7cd8c656ec7db198fbfaead7be7dd5a3

                                                            SHA1

                                                            9391d8719aa66a6b11844c4ddf0dd3197d4d8339

                                                            SHA256

                                                            fb54d91c42fa764f203d835abe2bf6e7d336f8764ce0a6b569118fd1916c79e4

                                                            SHA512

                                                            3b214cd9eede987f51edef165a149a442990f5fcb552952011a9b3ab871ab119c0eabb59b651f0138bc286bb66cdf17991a531d37f71016c856d277c9b5db4f7

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            910f823dcf7e4a22475378eb7f822388

                                                            SHA1

                                                            df45ed463fd011e32c2bcd20262eeafe86eb0d35

                                                            SHA256

                                                            20582787511576a7f0297fb3a147e189f281decee11f411bb21b7e148ae1469f

                                                            SHA512

                                                            268cb90094d0c3275a820bae6aa70be6e2b2e2d4a2a6ed9ba539300982f5856523b1e5cb7d7e42d9b84b8e0c55dd4fc9b192fe82a3b86f39c400f70389e51bff

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            a027c8b9212cff0edc5fa75538a236ba

                                                            SHA1

                                                            bc409b8bfe9339dddeaecc912a0bc3ae87dc76fb

                                                            SHA256

                                                            28161c51ae77d577f8dfad731f055fd85ea885b237cf6064cc39026047204bf7

                                                            SHA512

                                                            6eb13e8e4382970dba3d8ef53905afbb03d5ca64056c97bc3f66442b422c771f9913ef5c975d4b7c2b1c9615511f6310bacdc15d2e6c40bdb072329900d47797

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            ff1159687098cc0a7a5f8a3ebe84e475

                                                            SHA1

                                                            7d91a407fbbd24c82c4821891529a5ae043e8c78

                                                            SHA256

                                                            a3067b476147b8f57087c050da90968e2e2997fdf6d0bd553c36f888297c7023

                                                            SHA512

                                                            a0409d006b7b1c5cd95aa6d6d734e0f7f60ef83e0938eb21ae2eaea3bb078bb22abce97f9e1b1c17a8e21635697a4cb19317f220b0c441bed6496230c4bfaff5

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json
                                                            Filesize

                                                            125B

                                                            MD5

                                                            f9dff05dd213c2a73a859199ea3d33e2

                                                            SHA1

                                                            b4cdb059c944dc2f566e6bee6bafd821c93d0675

                                                            SHA256

                                                            c12afc30d3d862e964348e2b6d6ea55fc507d7b21a2a5ce6b67b0ad8d7524a33

                                                            SHA512

                                                            7720a354c6b9e22853621236911c17fcb98c03e1290a50d2c1d51d9c8b27fb0fd8e036467586657733791df199f57ccfc7a23eb3f33021b249a37dcffe00add2

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll
                                                            Filesize

                                                            4.5MB

                                                            MD5

                                                            f802ae578c7837e45a8bbdca7e957496

                                                            SHA1

                                                            38754970ba2ef287b6fdf79827795b947a9b6b4d

                                                            SHA256

                                                            5582e488d79a39cb9309ae47a5aa5ecc5a1ea0c238b2b2d06c86232d6ce5547b

                                                            SHA512

                                                            9b097abeafe0d59ed9650f18e877b408eda63c7ec7c28741498f142b10000b2ea5d5f393361886ba98359169195f2aceeee45ff752aa3c334d0b0cc8b6811395

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll
                                                            Filesize

                                                            5.4MB

                                                            MD5

                                                            956b145931bec84ebc422b5d1d333c49

                                                            SHA1

                                                            9264cc2ae8c856f84f1d0888f67aea01cdc3e056

                                                            SHA256

                                                            c726b443321a75311e22b53417556d60aa479bbd11deb2308f38b5ad6542d8d3

                                                            SHA512

                                                            fb9632e708cdae81f4b8c0e39fed2309ef810ca3e7e1045cf51e358d7fdb5f77d4888e95bdd627bfa525a8014f4bd6e1fbc74a7d50e6a91a970021bf1491c57c

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nm
                                                            Filesize

                                                            335KB

                                                            MD5

                                                            ca2975673899f6f3daf6b37fd307cf3f

                                                            SHA1

                                                            2426f1dc2ee0f82ad3148440cdca885b92857dba

                                                            SHA256

                                                            fe2a1b1736c9ee8df7bca05ab5c46c484ad5e239c60079c5fac357caf1e85d5f

                                                            SHA512

                                                            025b3b2149514770557427f41a301b1c6ac41fabc35f4e6a1b168ae16efce6346f27d02db2dab41efe2c18e6644dd15e89995755cb148bf7ec19bec18209cdeb

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.sr
                                                            Filesize

                                                            19.6MB

                                                            MD5

                                                            f12160eaf42e6a791680f93dee70c684

                                                            SHA1

                                                            5003b0fad71bf38548e4ce991270b5c49755e5bf

                                                            SHA256

                                                            e2a3f2e7cdc4830f1df60a25fdd2ed2d79801776b46b4a59af48f0d54973528f

                                                            SHA512

                                                            7f0bda784d861cf2ae25ae617cca59ba28494e5b7d909e48a6aeb14acb45349ca87fb8e8fc5f0a5afc6e90a917897b890fe0b2755bd32ddc315851d1c9ab5b16

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.bin
                                                            Filesize

                                                            995B

                                                            MD5

                                                            a8e4820e175f7d9c0f37c4f63bdf44bc

                                                            SHA1

                                                            e0aa265a99ceb65255ead59d54ab2e044c7f63ef

                                                            SHA256

                                                            4c2d5ddb9c89842b4c0aa4289c62aa67d7480400b95b0bb9be5581576b680a6b

                                                            SHA512

                                                            68a717c19a8f3532ff8bf3fae6d28a081939618c0f49da8c2cb8c14a9b563cc8dfd3b22d1d0f0e3aec8bd79207f46f3ecb0c49f5caf4fee2d570a5d1917df0df

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdb
                                                            Filesize

                                                            14KB

                                                            MD5

                                                            5d7e13894fc042d16c5042b8debfe706

                                                            SHA1

                                                            9ff508d1f466310f356169b058b100e4c7941fa9

                                                            SHA256

                                                            7d012cefeaef20fbbf17f75cd461dd23571a327c1cbefa44beb2e44c7d47946d

                                                            SHA512

                                                            51bbeba734788acc9d7f5e187ecc773cf6bcac92dff7af2fb5532b071e8d4a796c5fe5743cb5619df5c0a02a3e9fa15cd796051012e29c0e6212e2357675f600

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.dat
                                                            Filesize

                                                            924B

                                                            MD5

                                                            a9e121b62e264660baeac12a1b942332

                                                            SHA1

                                                            edac13c089024fb961e863185e184177ffb723a8

                                                            SHA256

                                                            1c7db99fdbd0f622469cc402dcd0dbdb32d8a38877725e29e5f890dcfd13de63

                                                            SHA512

                                                            541f2d8cccb6ba68e44e2de3a08759a59f563cbc05a945525eba331eec6dd7671a00f265ef9537c6d3e52a8b64e67ee0cbda720f5fb1d33779a9d1eb7a811fd6

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.dat
                                                            Filesize

                                                            39KB

                                                            MD5

                                                            10f23e7c8c791b91c86cd966d67b7bc7

                                                            SHA1

                                                            3f596093b2bc33f7a2554818f8e41adbbd101961

                                                            SHA256

                                                            008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc

                                                            SHA512

                                                            2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txt
                                                            Filesize

                                                            23KB

                                                            MD5

                                                            aef4eca7ee01bb1a146751c4d0510d2d

                                                            SHA1

                                                            5cf2273da41147126e5e1eabd3182f19304eea25

                                                            SHA256

                                                            9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f

                                                            SHA512

                                                            d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe
                                                            Filesize

                                                            1.8MB

                                                            MD5

                                                            00bb4872fd3c456f23b2b00a679b3890

                                                            SHA1

                                                            b2f98fc663e37bbfda7398079d4d483d862256a6

                                                            SHA256

                                                            1bbaa5b2a9e7423568aaaf7b6c2939a6ea784e0b8fb5e428b6e7423927e0c9ca

                                                            SHA512

                                                            eda71ee5c4bb9490e9a303347180e94425f2228476a45d983ee4ce5ff1c84b60c359ad29d545b0bcc8dac0aafc6cf0d4297560bdd2e68587aeb0137de61f19ae

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.dat
                                                            Filesize

                                                            514B

                                                            MD5

                                                            ebd2464d7a713990d4801481768e4740

                                                            SHA1

                                                            539ed295d23aad633c487a5086ffea90a6466422

                                                            SHA256

                                                            b742b05a95f10ca07a3325e89b52b6d7544b164136d85070bad576ddd88bfea8

                                                            SHA512

                                                            e791ef25e119c7e2e908ec64512701d658da580b1153353f7301ebaf9cbb87b7266fcb65cf2927228c1d850610c33d4392f46b4dcbf960acc12ebb6718d93bb4

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdb
                                                            Filesize

                                                            24B

                                                            MD5

                                                            546d9e30eadad8b22f5b3ffa875144bf

                                                            SHA1

                                                            3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

                                                            SHA256

                                                            6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

                                                            SHA512

                                                            3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdb
                                                            Filesize

                                                            24B

                                                            MD5

                                                            2f7423ca7c6a0f1339980f3c8c7de9f8

                                                            SHA1

                                                            102c77faa28885354cfe6725d987bc23bc7108ba

                                                            SHA256

                                                            850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

                                                            SHA512

                                                            e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdb
                                                            Filesize

                                                            9.7MB

                                                            MD5

                                                            58411d4cbd554fa2461a37afe41d04be

                                                            SHA1

                                                            f2280ed0fb7f4ddf9862ad38829647e5e5c2cbbf

                                                            SHA256

                                                            8b76b07ff3196eec40be07d5e4d972c7c5d4cad0e3dbea0f3504d3265634cf69

                                                            SHA512

                                                            428db8ebb2fd9107c7a9f23e47c2163d6939e14d97bef691bcc8bc76ec5dc96ce7774fea77ce14fd4a18beeae7a7d44a4c9e03c4e9476bf2cd0bec980168d329

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll
                                                            Filesize

                                                            528KB

                                                            MD5

                                                            a8de0cb6e0103dc9dc9f1a7f4f35f819

                                                            SHA1

                                                            27674efbfcc8975b4a372742b141ddce47cb540d

                                                            SHA256

                                                            87bc58ad3b68b87620c543f54f1e5ecbbb49b7468aa7c271a6d9ab95ac9beefd

                                                            SHA512

                                                            6688449e115b0403e08cb24c61f961c74c27cfd6609af360c251eb446d294e42ab1323e34a4e3992020d8c7fd0e8002fb7b96329cdf9c486910508d81429a072

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdb
                                                            Filesize

                                                            830KB

                                                            MD5

                                                            1424af47116964a6e2078ad264ed2aa7

                                                            SHA1

                                                            a9f6e6ef3024b7bf1ce268404549043bef4978dc

                                                            SHA256

                                                            bab5e87675816b34083bba6e8fc3765e118e04b656548540cd96394499d2ac20

                                                            SHA512

                                                            036360b911e930402d89fce4c4615f61634b67a4d8adbec5612c418011aa956a02ef3a97585a43431b0b40d8f1ae629006787a528a4044e62b56bb282b9cd403

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdb
                                                            Filesize

                                                            167KB

                                                            MD5

                                                            de41f3ca86eb861d42391f64f7117a27

                                                            SHA1

                                                            8d85c2c4c8ef432f2388aed09fdc2edf532730ba

                                                            SHA256

                                                            353d19d0d19263d81128b430fafbe4d19e63626101c06216da000ced9a2ff2d4

                                                            SHA512

                                                            9ffc1c811fa40f01e0ba8b154053ccd23824923cca78da64e9262b420abd9614114557deb76b26750a7dce3f3b4aea6c4c1a6620346900e3b9aea45fabd1e1a2

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdb
                                                            Filesize

                                                            23.8MB

                                                            MD5

                                                            42a6b2ec64d8113916031dc354466042

                                                            SHA1

                                                            e7601b0632d6c6554d864441fa8b0158ef7c0abf

                                                            SHA256

                                                            e274a786acc1a3ffb4d47964b075ea14642cde6ea64e06148ea78dbbdf34e003

                                                            SHA512

                                                            a2620099f3bfbfe78d4766c2b2487e436eee6aa65c82c8517e7bab2b8d68dfd7477c5ae5a2c66ded7d62e00250ca03fa86da466ff51d8eb60ab637c62cfc799a

                                                            Download Submit

                                                          • C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat
                                                            Filesize

                                                            75B

                                                            MD5

                                                            a934c86ec5019bba2a3121d5679ca805

                                                            SHA1

                                                            1d5a5c23d0c48f7449efb6444af030dbbd0364de

                                                            SHA256

                                                            ba2c2947ad0fc3a86a1b7b4a4caf349fde86b4e9767a614a2cec547a2972b616

                                                            SHA512

                                                            3ef57ba917f2897f2d12e48de0068a7269f80d8f84a3b4ede6fed4ed2366928e58dde3e6bf35af3efba8ba5c8c73009518b1bc6586682487a8d03bd85d316497

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            Filesize

                                                            152B

                                                            MD5

                                                            ea667b2dedf919487c556b97119cf88a

                                                            SHA1

                                                            0ee7b1da90be47cc31406f4dba755fd083a29762

                                                            SHA256

                                                            9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

                                                            SHA512

                                                            832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            Filesize

                                                            152B

                                                            MD5

                                                            2ee16858e751901224340cabb25e5704

                                                            SHA1

                                                            24e0d2d301f282fb8e492e9df0b36603b28477b2

                                                            SHA256

                                                            e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

                                                            SHA512

                                                            bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                            Filesize

                                                            48B

                                                            MD5

                                                            d995d25ff905511652f368e1bf80b28a

                                                            SHA1

                                                            5e085c9f56ef8ac23536a6d0822a46206c5d0dff

                                                            SHA256

                                                            9aac2efb532764a16bf364651e0253336f17c54218b92c675377865c1d7e4e25

                                                            SHA512

                                                            8fdc1e84b1492baf65a09805f9298b3e2f1c92334993ac33871ff49aee0d061a94bb225ca48c5a72974b202127d16ce693e31075340de02aa4f41bbfdcf5ce07

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            568050207a17d2faa24ada7e726b08bd

                                                            SHA1

                                                            745dd5d2bb2609afac2ceebe41ef34924ffe3672

                                                            SHA256

                                                            c0005a4bf6dac8afd255cf826fbbe351a559a2267dc2a9f1771b8700054aa74e

                                                            SHA512

                                                            159300ec97824f5085d23a61acf8bcff4f0bc5428b0be8c495c52963eac33c3f95e9669c04eca44b99d13f14012145d9a70ebd5f1fc088a362596d0aec2a8878

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            24c3c66d95ba3fa072caaf9a96ff91c7

                                                            SHA1

                                                            9cbaf62863f83c3a7786d4248873e997675240b0

                                                            SHA256

                                                            f0687e679b145e50ac13e91163a3eae8d6779cf75cb96a15c3d14519c6fa641c

                                                            SHA512

                                                            1cb6bd370ac8e81239cb75d2c919cdd6ea98909afdb9eff9fcca3a1827939eda351032b24ae1cea336143973955170e62ec971b21b1adc4bd2f349ccd0ab0205

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            718577b7d85961a3d64a2826f33f2d43

                                                            SHA1

                                                            5eb18fe9f120c2e4768defa40aa0b1b6364686cf

                                                            SHA256

                                                            9d7270e25a87f9656ea8138a7f7ff4f51e6a6638fa02dc58eb7f6b50f2b9ec94

                                                            SHA512

                                                            ff791d78993998cc998a3cf2aacddc5146b61d82e0280826772ba50c5c10ede8bc878c9f038782d880c064a90ff48ac467ac1799ea6f955eaa01df400bfbd783

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            Filesize

                                                            5KB

                                                            MD5

                                                            8590935f6651ea567ff77f0de698ddf0

                                                            SHA1

                                                            c6fa83b8330fb11c5debb9722a746b20c6ac557a

                                                            SHA256

                                                            46d99e3142bf65d7ec558aacffcddc5f1e704c7bfb9807bfd5242067ced16941

                                                            SHA512

                                                            88c592ebe6c88c128dab3441ae5ab77b3e038b4a0d3c027a74c91a1357e72c06f86a4b0eae37b6aee35632848ba3faec0e8c9566f87e4199c88d2aa92be2a3d5

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            Filesize

                                                            6KB

                                                            MD5

                                                            eb0bda92c624eee3ecfe6dafb99ae179

                                                            SHA1

                                                            9a3d99a55c27810d55ed79ccd9853e526f40c34f

                                                            SHA256

                                                            77da91966c46b2e7df5c0632701405e0b60523408fb92b320dcc38a7fb321d2e

                                                            SHA512

                                                            13226299a09fc8605ec6f0a83bf68904ce438d84ef44a3ae6b783a714ac40352040964bcee2cdf42968bde495657263c2ddd8e7bed59215c56f57203a794c52b

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            Filesize

                                                            6KB

                                                            MD5

                                                            97d3757d8662ad2db6ba5ad927a56a66

                                                            SHA1

                                                            594c93cae884fdbca0d8d40a4e1fa832ec1d2a79

                                                            SHA256

                                                            8273da65595254e06120d4ae213c6e39a7606d68728f3bc1fcaf4da8a7868d5d

                                                            SHA512

                                                            c9485ad174f52eb192fed4dcb819c7d6f81fcb3ecdf74c1b520fbb74fc7bc86438a6e01d07a395748945b1086d8aea4cf452c24f0c26c45e44b813be247acdd2

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            704b8bf7bef5bed91d0619a104932454

                                                            SHA1

                                                            683fcfb371eacf27882173a36f204f97c72c45c6

                                                            SHA256

                                                            985decfede902e0104c04d868c01383cf646d891002b5e25ab699a49f1b4a947

                                                            SHA512

                                                            e3e21135aff1796498951bd92ca5569f22a9f2e247bfe9b3b18dc1857d06235b028e08c8f43af14c4b7fa37b2bc70bd902bc507d83937f5978caa36f49546f76

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b84f.TMP
                                                            Filesize

                                                            538B

                                                            MD5

                                                            40abd3862a250ac9d43382ee03b6d980

                                                            SHA1

                                                            bef7745c1dbb802e05ae24a81ec9d6ccd6cd626c

                                                            SHA256

                                                            f51bfa1762731bfb1f6de0bf8518de509fb1118bbf041ab7180a60ee47a65fc2

                                                            SHA512

                                                            d8a2d453c88dcd43400f5bddf0b218eabe3f7284fa28d7e768c90ec392e13f65cdcfa9f3c8d14daf3dcade48fa676b0547ed3800115207f79d885825924d3e88

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                            Filesize

                                                            16B

                                                            MD5

                                                            6752a1d65b201c13b62ea44016eb221f

                                                            SHA1

                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                            SHA256

                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                            SHA512

                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            36e499951dc1b8b11259ce11592d545b

                                                            SHA1

                                                            88aa950b59a868bba984678114b252568899b75d

                                                            SHA256

                                                            754a408e1afd653bbbaa1924fdc188c0f8bfaaca6c8c90bc24cecc902dba408e

                                                            SHA512

                                                            785f748ecb6e1c4ec7883b0f570d8fe1522ac41b6f6621e6e5167e8238a3c07253ed5837a529e22f1c43a10f583e7f8ac7e23c59e5ac95e986d6e91dbe805876

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            1ca80e743996c8e73fdf3cfe42d29657

                                                            SHA1

                                                            96bbc6262a4db233ca025f623270eebddc0ba911

                                                            SHA256

                                                            74e01ba194642b21eb401bad493a58c2f258134f82374edac6f983bbe331d8b1

                                                            SHA512

                                                            8fb0828886ee8e5e545fe5b3df2477135f931187b3ba804fa291cc44f7512780c289569d2b6051ededa7daf2c8a0e4d254c2c90c7836d2d97fbae28870299168

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            bae8e31d0abbe77628a81e3a6e3ef47f

                                                            SHA1

                                                            626e1cb54dbd3cc7d2809b708dd748bc439c7587

                                                            SHA256

                                                            24f0491db6b1a95713b03f2d946f8217a7040135c2cce5ad8188ee940a0293d5

                                                            SHA512

                                                            ed0d678a35a913759d548a21a1be14ba0b3ba63162f321b0bd6095c022d4d6c7c7f4d00ff2957d45dc5c9d438bf3a8f3239f5cf7fbc253132977ca48ec4a317e

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WCRY
                                                            Filesize

                                                            415KB

                                                            MD5

                                                            7d4ab9cf6a73a07395591336375a88ed

                                                            SHA1

                                                            521ded1fa7589eaa3ef8a1e9c43019bd4362d700

                                                            SHA256

                                                            0e8a7cb5825b3520227ae78d63dbea9d8c8f7f267de8a8157861f812778c789f

                                                            SHA512

                                                            ef1fa9cd4c8ef9aa94bbf120383cd89e47cb1f38ae2348ed307c026f35fdc587e19e3d400a2ccb65a0701bd5157d79003c2dd06a5a1867d8d8736fbbaa7ea38e

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt
                                                            Filesize

                                                            797B

                                                            MD5

                                                            afa18cf4aa2660392111763fb93a8c3d

                                                            SHA1

                                                            c219a3654a5f41ce535a09f2a188a464c3f5baf5

                                                            SHA256

                                                            227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

                                                            SHA512

                                                            4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            1d8c7fa5e1e7efd627a312265c8c6292

                                                            SHA1

                                                            ace5f58e87d279bb2036ee3fc70f69e027dea5ea

                                                            SHA256

                                                            97564f87418bde06facd441c89dc9962c27f3fc78d94b2190c888a37a21ec62a

                                                            SHA512

                                                            df5efa224146a5736f47f8b0f1f0ca378ee60b64817c229168e38051553efb265d3fba936330c11cdc04ffae8734001e1f8f5d1cf9de70bf48de9ce25c6df38e

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\00000000.res
                                                            Filesize

                                                            136B

                                                            MD5

                                                            952abe281ace61d92322abcd9d6a0ec0

                                                            SHA1

                                                            22907134a6014f6af09603d3e29d31a50b6bba18

                                                            SHA256

                                                            8d76e9d9d3d1c650bf017ed62a2def161fc3d4bb36ed50caa15276532c56d0e8

                                                            SHA512

                                                            9ddf60cc587cfa8e934141f0605feca7938dcde0a8b7c9d3f24a76324db4bfbbe288e3df57c4ebb48bcb5f63b0ac7c063f072f8b717d1cc1dfae584751236bc5

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\00000000.res
                                                            Filesize

                                                            136B

                                                            MD5

                                                            063b5dd70e5feb346bac469f38e5fae5

                                                            SHA1

                                                            dd788bcc4811aa3b7b2eca85fccdf142119d970b

                                                            SHA256

                                                            f489037ed5b8daf2b69397ed0b1cf18e572ac2e242d9f225796231531e4ccce8

                                                            SHA512

                                                            96aeed7ad843048ec264e73e7d3fcbb30260e3e20732359425ac56aa422b31855cb07d6229a71460ec4fb286ec3cbcc66c7f8997efbe1a0f872e53ff02dcf2e0

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\00000000.res
                                                            Filesize

                                                            136B

                                                            MD5

                                                            5deaceb0df54f4054c57e43c0fd00cb3

                                                            SHA1

                                                            cb8e4f4cf25b29248a3b9332514f86de0a5874b4

                                                            SHA256

                                                            4a08694fedc003e1a333e02971c191da95e3434ed7214c803f4823dc3ea2b6bb

                                                            SHA512

                                                            c12ddbd04edc1de3f0296b318eea190d52690b25fc2b9f3227029a122bad18538a3868759aef3813c6b8a2799f89dc6b8f896eb6473b43895393c940b1eb1c78

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\278571722956060.bat
                                                            Filesize

                                                            336B

                                                            MD5

                                                            3540e056349c6972905dc9706cd49418

                                                            SHA1

                                                            492c20442d34d45a6d6790c720349b11ec591cde

                                                            SHA256

                                                            73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

                                                            SHA512

                                                            c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\c.vbs
                                                            Filesize

                                                            219B

                                                            MD5

                                                            5f6d40ca3c34b470113ed04d06a88ff4

                                                            SHA1

                                                            50629e7211ae43e32060686d6be17ebd492fd7aa

                                                            SHA256

                                                            0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

                                                            SHA512

                                                            4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\c.wry
                                                            Filesize

                                                            628B

                                                            MD5

                                                            89835596de75d8228554792e80dd8511

                                                            SHA1

                                                            f7bc07a815ecdc3d6bdc38cc506e2433b900c2d7

                                                            SHA256

                                                            24565359ac2594408ef4608467c6a2f2340a9f66ff280ec3c0af154f84a2d4d0

                                                            SHA512

                                                            1ba98a578c88a6d78fa98479b6123348f4372ba114e046f59e681bfbf81925b2132f8a6cedcef49e670a75be8fa781b796be55d0f7ef087149fb6b2afc48b072

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\m.wry
                                                            Filesize

                                                            42KB

                                                            MD5

                                                            980b08bac152aff3f9b0136b616affa5

                                                            SHA1

                                                            2a9c9601ea038f790cc29379c79407356a3d25a3

                                                            SHA256

                                                            402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

                                                            SHA512

                                                            100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Temp\u.wry
                                                            Filesize

                                                            236KB

                                                            MD5

                                                            cf1416074cd7791ab80a18f9e7e219d9

                                                            SHA1

                                                            276d2ec82c518d887a8a3608e51c56fa28716ded

                                                            SHA256

                                                            78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

                                                            SHA512

                                                            0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\prefs.js
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            3132a7d82a1953b7db6dc812c312c3b7

                                                            SHA1

                                                            56cb49ee0436bc39f6c0ed651324f41705ce948f

                                                            SHA256

                                                            7fdd44350bbe2c796b8d34d5821853bf76f3c9caa1ddfe95872aff2cbdc617ab

                                                            SHA512

                                                            a8880070c19084087786a1e7484eb5d420d91c700c264c27fa03f51d4a97371e109bdba8df0b8f56da39d3e8b49e4f1a7dae3f4db7738d8c6a32ecc6781d4858

                                                            Download Submit

                                                          • C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier
                                                            Filesize

                                                            26B

                                                            MD5

                                                            fbccf14d504b7b2dbcb5a5bda75bd93b

                                                            SHA1

                                                            d59fc84cdd5217c6cf74785703655f78da6b582b

                                                            SHA256

                                                            eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                            SHA512

                                                            aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                            Download Submit

                                                          • C:\Users\Admin\Downloads\Unconfirmed 528499.crdownload
                                                            Filesize

                                                            2.5MB

                                                            MD5

                                                            d21bf3852bb27fb6f5459d2cf2bcd51c

                                                            SHA1

                                                            e59309bbe58c9584517e4bb50ff499dffb29d7b0

                                                            SHA256

                                                            de9c4e8b4b0c756eee4e39221c1e4e0e11c2e67effb828e27de3c4b4470ccff2

                                                            SHA512

                                                            17bc7740f131a1d4e84fd7e4ab5e1ce510660f5046340ef6d09ef99c56c88da2b6be3ae5c5ddb7213841c506eaec147c65abba1a7a2a8eb4fb8f6329bbaa03d1

                                                            Download Submit

                                                          • C:\Windows\System32\CatRoot2\dberr.txt
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            6d8fd71900e49750a78e3a5f2add286c

                                                            SHA1

                                                            fafecc2f1ce5f85df6928c39be7fdeb3663929e1

                                                            SHA256

                                                            c7f24ded8484dde1b224925633c18ddfcb17aaca02ae1514258e694bda05326a

                                                            SHA512

                                                            c75bc3321bfb4baed36e64750a2fe027fad38ba06402cf745d32ef9f09cb64d580e5f9d2165bd8f9c4c5cfe257921abefd2ae43ede87d8bf891de363505a44cd

                                                            Download Submit

                                                          • C:\Windows\Temp\MBInstallTemp0315222f540411efb5494233bf090fb9\7z.dll
                                                            Filesize

                                                            1.6MB

                                                            MD5

                                                            3430e2544637cebf8ba1f509ed5a27b1

                                                            SHA1

                                                            7e5bd7af223436081601413fb501b8bd20b67a1e

                                                            SHA256

                                                            bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa

                                                            SHA512

                                                            91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d

                                                            Download Submit

                                                          • C:\Windows\Temp\MBInstallTemp0315222f540411efb5494233bf090fb9\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
                                                            Filesize

                                                            372B

                                                            MD5

                                                            d94cf983fba9ab1bb8a6cb3ad4a48f50

                                                            SHA1

                                                            04855d8b7a76b7ec74633043ef9986d4500ca63c

                                                            SHA256

                                                            1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

                                                            SHA512

                                                            09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

                                                            Download Submit

                                                          • C:\Windows\Temp\MBInstallTemp0315222f540411efb5494233bf090fb9\ctlrpkg\mbae64.sys
                                                            Filesize

                                                            154KB

                                                            MD5

                                                            95515708f41a7e283d6725506f56f6f2

                                                            SHA1

                                                            9afc20a19db3d2a75b6915d8d9af602c5218735e

                                                            SHA256

                                                            321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6

                                                            SHA512

                                                            d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

                                                            Download Submit

                                                          • C:\Windows\Temp\MBInstallTemp0315222f540411efb5494233bf090fb9\dbclspkg\MBAMCoreV5.dll
                                                            Filesize

                                                            6.3MB

                                                            MD5

                                                            65a49aa18cfaa688a43a62e2821fbd77

                                                            SHA1

                                                            2ff08fd8149e1202e580dad63f7ac1fe3130464e

                                                            SHA256

                                                            7dc3f946efc0cba5e4e6285bb0c77c20e04ae473f41ba58ac1a7ee539168e6ee

                                                            SHA512

                                                            4e0a6c1491f398ad9ed4a0004b0e6e0c6a29693f7c225d93d567ad356a9a6423b35cafe2ae5dbd8bdce9b034b35055ec1c3e5248a09a3a209116ed1f7e62aea1

                                                            Download Submit

                                                          • C:\Windows\Temp\MBInstallTemp0315222f540411efb5494233bf090fb9\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll
                                                            Filesize

                                                            1.3MB

                                                            MD5

                                                            3143ffcfcc9818e0cd47cb9a980d2169

                                                            SHA1

                                                            72f1932fda377d3d71cb10f314fd946fab2ea77a

                                                            SHA256

                                                            b7fb9547e4359f6c116bd0dbe36a8ed05b7a490720f5a0d9013284be36b590b7

                                                            SHA512

                                                            904800d157eb010e7d17210f5797409fea005eed46fbf209bca454768b28f74ff3ff468eaad2cfd3642155d4978326274331a0a4e2c701dd7017e56ddfe5424b

                                                            Download Submit

                                                          • C:\Windows\Temp\MBInstallTemp0315222f540411efb5494233bf090fb9\servicepkg\MBAMService.exe
                                                            Filesize

                                                            8.6MB

                                                            MD5

                                                            2d49262ee00ca948aefc1047d65bca56

                                                            SHA1

                                                            ae60524cd5d0fc2e8f32b38835667871747db3fb

                                                            SHA256

                                                            6931bb215c086739a7b2ab089a8bd9cd4b2acbb9f44a32ec1b420f216f6ff782

                                                            SHA512

                                                            d069d4f20d69aa102438f1779f6222cfef7967733cce8d744bf6121e8e22bfc8dee4ee6887cf13e17ea173a0db4c52e3009fe85b861f5c7622294b63b366877a

                                                            Download Submit

                                                          • C:\Windows\Temp\MBInstallTemp0315222f540411efb5494233bf090fb9\servicepkg\mbamelam.cat
                                                            Filesize

                                                            10KB

                                                            MD5

                                                            60608328775d6acf03eaab38407e5b7c

                                                            SHA1

                                                            9f63644893517286753f63ad6d01bc8bfacf79b1

                                                            SHA256

                                                            3ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59

                                                            SHA512

                                                            9f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7

                                                            Download Submit

                                                          • C:\Windows\Temp\MBInstallTemp0315222f540411efb5494233bf090fb9\servicepkg\mbamelam.inf
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            c481ad4dd1d91860335787aa61177932

                                                            SHA1

                                                            81633414c5bf5832a8584fb0740bc09596b9b66d

                                                            SHA256

                                                            793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3

                                                            SHA512

                                                            d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830

                                                            Download Submit

                                                          • C:\Windows\Temp\MBInstallTemp0315222f540411efb5494233bf090fb9\servicepkg\mbamelam.sys
                                                            Filesize

                                                            20KB

                                                            MD5

                                                            9e77c51e14fa9a323ee1635dc74ecc07

                                                            SHA1

                                                            a78bde0bd73260ce7af9cdc441af9db54d1637c2

                                                            SHA256

                                                            b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0

                                                            SHA512

                                                            a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186

                                                            Download Submit

                                                          • memory/1420-5634-0x000001B367C80000-0x000001B3680A5000-memory.dmp

                                                            Filesize

                                                            4.1MB

                                                            Download

                                                          • memory/4776-7-0x0000000010000000-0x0000000010012000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download