Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

MBSetup.exe

windows7-x64

8

MBSetup.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    78s
  • max time network
    81s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 13:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MBSetup.exe

  • Size

    2.5MB

  • MD5

    d21bf3852bb27fb6f5459d2cf2bcd51c

  • SHA1

    e59309bbe58c9584517e4bb50ff499dffb29d7b0

  • SHA256

    de9c4e8b4b0c756eee4e39221c1e4e0e11c2e67effb828e27de3c4b4470ccff2

  • SHA512

    17bc7740f131a1d4e84fd7e4ab5e1ce510660f5046340ef6d09ef99c56c88da2b6be3ae5c5ddb7213841c506eaec147c65abba1a7a2a8eb4fb8f6329bbaa03d1

  • SSDEEP

    49152:FMofPlPU+QG/rOVcVz6StQyfvE0Z3R0nxiIq2dsTDwfw1Y:FMslc+QGjuTKtQRq261Y

Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 21 IoCs
    evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\MBSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Drivers directory
        • Checks BIOS information in registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:468
      • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:6032
        • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
          "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
          3⤵
          • Executes dropped EXE
          PID:6104
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
      1⤵
      • Drops file in Drivers directory
      • Impair Defenses: Safe Mode Boot
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3764
      • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2504
      • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
        2⤵
        • Drops file in Drivers directory
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies registry class
        PID:4496
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of WriteProcessMemory
      PID:3188
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:264
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
      1⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Checks BIOS information in registry
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5848

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Defense Evasion

    Impair Defenses

    1
    T1562

    Safe Mode Boot

    1
    T1562.009

    Modify Registry

    3
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    2
    T1120

    Query Registry

    6
    T1012

    System Information Discovery

    6
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Remote Services

    1
    T1021

    Remote Desktop Protocol

    1
    T1021.001

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dll
      Filesize

      1.6MB

      MD5

      4da585f081e096a43a574f4f4167947e

      SHA1

      38c81c6deae0e6d35c64c060b26271413a176a49

      SHA256

      623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b

      SHA512

      0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dll
      Filesize

      4.5MB

      MD5

      f802ae578c7837e45a8bbdca7e957496

      SHA1

      38754970ba2ef287b6fdf79827795b947a9b6b4d

      SHA256

      5582e488d79a39cb9309ae47a5aa5ecc5a1ea0c238b2b2d06c86232d6ce5547b

      SHA512

      9b097abeafe0d59ed9650f18e877b408eda63c7ec7c28741498f142b10000b2ea5d5f393361886ba98359169195f2aceeee45ff752aa3c334d0b0cc8b6811395

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dll
      Filesize

      2.2MB

      MD5

      13ee270968b2eaf9d45770e831412c0a

      SHA1

      6f4bfee0efd52db649a9378298148fd5ae5001e1

      SHA256

      81a28988d59a8e75b771456f61aa3029f334f2a492da70f53bd93403122e2951

      SHA512

      36f9339f15bd1982fe196eaf23ed879db5fdf1cc1c41683a915d1ee9718053720c9794e77d093a51adf9c20f58b2f5191abeecef41ea87746933c845be48bcde

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dll
      Filesize

      5.4MB

      MD5

      956b145931bec84ebc422b5d1d333c49

      SHA1

      9264cc2ae8c856f84f1d0888f67aea01cdc3e056

      SHA256

      c726b443321a75311e22b53417556d60aa479bbd11deb2308f38b5ad6542d8d3

      SHA512

      fb9632e708cdae81f4b8c0e39fed2309ef810ca3e7e1045cf51e358d7fdb5f77d4888e95bdd627bfa525a8014f4bd6e1fbc74a7d50e6a91a970021bf1491c57c

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dll
      Filesize

      6.6MB

      MD5

      363cdf02d5bd30d1fa47178678a4a28e

      SHA1

      c837a5468f2f501f826f08682ad8d76898d4d302

      SHA256

      fec71fd04cf7fa56a617a183d482335b3307942aa52e5556404fb0c398f15076

      SHA512

      a563db5886c68e2b0ef28bcb8c187bdb6fe817886e1635008765c79116a98816ba9ccda805c98a212e7a35fe49e313240bf5f2851afedb7ce3ef5da2db82521e

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dll
      Filesize

      5.0MB

      MD5

      65203dc9e80477b97326ab3ca6c2336f

      SHA1

      0593a9c4fc4c1a2d9d9176742a704a35a856c064

      SHA256

      fc3e4c6cd620be374ed2bf6e35ea35e7566da0599eff9a6851398ccc67bf3487

      SHA512

      4c61fc7066fb3be995e23933ae4a53833383c6fe0bacc4cbb445b98eca1ec073f66b54953b7982b4e4f04dfac49388907cb7e2d875ab921a39ef258084f59abd

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dll
      Filesize

      4.8MB

      MD5

      1104d30bc3a2168af06974d91fe19b6c

      SHA1

      0adc46f39c7fe3b1632913baf6830e3eee65be49

      SHA256

      8fa8305650bd8ad0f28ba9e41a525334b8ed1fe58498c4318e95cf968607d992

      SHA512

      c55c8a71eecb2c8d2e74f2c735b308649046e7040b5934657c05f5c7c6c12c2d2d36c163c72888c69530d3730a185a46991b613c7dd78770034f40fd01663b26

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
      Filesize

      4.2MB

      MD5

      03d6455dc6934a409082bf8d2ce119d5

      SHA1

      995963c33a268a7ed6408c2e6de1281e52091be2

      SHA256

      82ca2aec64fe151efd59a838c1845111bfb9f94ff277be3afae4e3f684ef3a62

      SHA512

      a0ff71bc01a11c9a95c1a0186a7bbfec9c3f84d7e600d0bca877934fa5f84053627bc59bb355f53ce9e3c9e4c6a841b8f5cb7436fe7f43b63426a8a851392c6d

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dll
      Filesize

      5.3MB

      MD5

      3e27be31b906e511486aa24e1f1f259d

      SHA1

      db7437ff8fa5d2763e24e2e57eedee54b4dd0f7b

      SHA256

      3b5747372d2d3a6113be457ce6e6797172e93d1b527e34329f11f355e6716e11

      SHA512

      540549e5d0779aa354e0b04db4a38ed46806eecf9d4df778ac4e1fef9acd19e588511692432470265469add1eb3fad2078dd397fa5b3b6710e1d1a3a66012792

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dll
      Filesize

      5.1MB

      MD5

      8611738183e576f751d6620ff1ea6572

      SHA1

      9fd9446a187a0580738623a51464f78c44e2770e

      SHA256

      38fd3575583284cc535b2bafd255945c696601b46db0f6b2bc11e11babb28dac

      SHA512

      0cb0b62975d6a9100dc0f65d6069323dabf96446bca21603bad1e6d4f63c437f40fe1e3846e67926b6cdb557e994199e2aba13f703ca35866b17b806a23f3d93

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dll
      Filesize

      4.3MB

      MD5

      68eacafc2d4837960257800fcf9e8566

      SHA1

      d1dde4b802a71da319aaad5de50a27ecb538229c

      SHA256

      d5e0c9eb4fa6daa994eede66dda650b2de03054da399fd1082cd30f58e181554

      SHA512

      719ad758d53e5f1f4ebeb48acb601e0f05cd2fe7bc5270eff3ed6ca40b70d9880338480f71340a0821d66cf60fa7b56cea6900a3c05e6e27ec4a78da44c91adc

      Download Submit

    • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
      Filesize

      1.8MB

      MD5

      47421f18fe0177047e114aa3e2170041

      SHA1

      3961977d5909aa4d42ad1f4c45bd0488db39a5bb

      SHA256

      e334e706ce3749c09fd2341a8f1e7f4eebe1fd5de1c874ca1448512f8d7a71b9

      SHA512

      980be65288725f81439580341003f4a4daacecada7821430ce5dead3bd23ffb891d66f52d13ef0c56f0e0f18a9272a75a9ad9def94ecf5b1b20a3671db3223b9

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nm
      Filesize

      335KB

      MD5

      af1a04bf8551116c2da6443ba8a93aee

      SHA1

      0d685e5cb859fd8f5949f241df5c5489b38fe53a

      SHA256

      695e6c9d5b37bf0f612f03b122f999015e69b3c9ec989cc18d2e9d340fc561b5

      SHA512

      5bf1e81243f0a14f1dd9432ca3f6fd6c23a01d83855c624665366ec077696dc6389da5155d1f91a0d973e41b2bf635e593a5a6309ec46e0d17866faab9a26e92

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.sr
      Filesize

      12.6MB

      MD5

      4462cf0b18784a381e07f5217eec5a4a

      SHA1

      ec7361128c9308ae24c62c4a214ca1466036f207

      SHA256

      daf0d44cf80afd0c7dcb038fa8acdf35e02360d61f6d65e6d276025575ec6b4d

      SHA512

      1298c4560d3a6f819681f622fa75a04712e8f5d3ac0f41bd962aa9bebe0d066123f11758d20a1db16532e48592f41ff34d9056f44be8f7a3069253ee7ae37b12

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.bin
      Filesize

      935B

      MD5

      de80d1d2eea188b5d91173ad89c619cd

      SHA1

      97db4df41d09b4c5cdc50069b896445e91ae0010

      SHA256

      2b68990875509200b2cf5df9f6bdfcda21516e629cab58951aac3be6a1dd470c

      SHA512

      7a8f5f83552dbff21be515c66c66f72753305160606c22b9d8a552ab02943a2c4e371d17dce833020d2779c6d9fe184a1e9ef3d1b8285c77aeb17b2bba154b3f

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdb
      Filesize

      14KB

      MD5

      2ff028911e45c37c759ee9c53d95590e

      SHA1

      9508b83f77fe6872f8e6d0321f318aeb559a9425

      SHA256

      03f7b3762bfb14c9bbcc96691acfe3f65d0372ec77db2a8f2052e82fa3863fa8

      SHA512

      2cc18ec01011ab695f59e928edf10686f02a77d8fe56ceb8da95646984d0a369822ef76c51aa3591e9d0812eae8594539dabb84af504a060fb3e4ffe442dcebd

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.dat
      Filesize

      924B

      MD5

      d33e2a7191a47ef876de260f0ed4090c

      SHA1

      05ada0d0c88e1e5fc944f784140031b2dfeff16b

      SHA256

      9a6e7ee585fc8021213f7a0d7efcb263a4f35c6b229354ada44a5d26a4dd7f87

      SHA512

      d168229279ede28b6923ea008e8c96eef4dc0415d820541d2c69166e062b7c04c7b186695174fbcaed29a1fb4cc40a021f07b3ea76c57f14540372895a805687

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.dat
      Filesize

      39KB

      MD5

      10f23e7c8c791b91c86cd966d67b7bc7

      SHA1

      3f596093b2bc33f7a2554818f8e41adbbd101961

      SHA256

      008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc

      SHA512

      2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txt
      Filesize

      23KB

      MD5

      aef4eca7ee01bb1a146751c4d0510d2d

      SHA1

      5cf2273da41147126e5e1eabd3182f19304eea25

      SHA256

      9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f

      SHA512

      d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.dat
      Filesize

      514B

      MD5

      d9965913153ca31e910e073a38bde988

      SHA1

      908598bc336341bcc91726130e3adecfe189e5f9

      SHA256

      d34b09619c3bb3f7ab4cc7d474f9c408b1f6bc516d393f941b7a31533f875bbe

      SHA512

      498e476b0fd200fb9796091d5b40e5e1450d1fd4175cc06ebd1e63b5ffda718fe6cc445e5b0aa951a4a5d723c213a5f775dab473b09f5c98d61822dfde804f75

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdb
      Filesize

      24B

      MD5

      546d9e30eadad8b22f5b3ffa875144bf

      SHA1

      3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

      SHA256

      6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

      SHA512

      3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdb
      Filesize

      24B

      MD5

      2f7423ca7c6a0f1339980f3c8c7de9f8

      SHA1

      102c77faa28885354cfe6725d987bc23bc7108ba

      SHA256

      850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

      SHA512

      e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdb
      Filesize

      9.7MB

      MD5

      25c6813597ec92660dec0ef73afe10ab

      SHA1

      70226c75a32136658cecc2feb9aaa0b1e57d32d6

      SHA256

      e590faa07e008d4f4fccaba17870e2d026361537091ed422fcc64446eac564bc

      SHA512

      c2667cb150aceb270b6425819516b8539eec8a2363c01736e009df30564ac0c9c5fb568c19d9f59c60f44c6b66cb77a2b44ab15c34bf107390a31bba0f11da76

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdb
      Filesize

      776KB

      MD5

      7c848ea76b1316eff3a5c61f825111fb

      SHA1

      e2bf7991118f56ec41f540c5967c2271258e3b3d

      SHA256

      3318cfe66422cf53dc4a1029cc963e961c03efe1145f8446bae1e32a886af071

      SHA512

      269a7ee497e2e3d05d10ec1baaaea9b9a8b88819d811667ad1e682258897867356d6e7b4b2dad0959d5de8c8ef6fb61ea9e94d2c3836cf52e0323d29b5f71e7a

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdb
      Filesize

      163KB

      MD5

      07b6caad14a2396366152236cbe37443

      SHA1

      cf7247475a500e7fd24e101f10e51f69a929c4e5

      SHA256

      3c87ce7bdee476d41c649256b603a1175b4e0e191353b77f2f28d7e1a829e6a5

      SHA512

      c5390492e6f9454a16c20becbe8001cd7ddf810c818b8d3b54c3fd1ec40638efe023949f2f067eacbc068d07f8fba4cd6f5d6ee8fe139bb15e80c51d52faf59b

      Download Submit

    • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdb
      Filesize

      22.0MB

      MD5

      9ea7f589922b7b0e5bf18be9013b97d8

      SHA1

      800613d48ffe618e7971f26ee8efc9311d917342

      SHA256

      ae15684f0ad1ac702e93b2d70520ac24b3f6743e7ffffab390f83d9738a13605

      SHA512

      4542cf4df4d6b6e7c690a16019ef008d8fec637f35626cdf1edd8755336954bdd1a128739bfb7fa3b4c4ddd9ef840d87d8732fb16e7150a00a10b7996437b758

      Download Submit

    • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
      Filesize

      10KB

      MD5

      8abff1fbf08d70c1681a9b20384dbbf9

      SHA1

      c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6

      SHA256

      9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658

      SHA512

      37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f

      Download Submit

    • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
      Filesize

      107KB

      MD5

      83d4fba999eb8b34047c38fabef60243

      SHA1

      25731b57e9968282610f337bc6d769aa26af4938

      SHA256

      6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c

      SHA512

      47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
      Filesize

      8.6MB

      MD5

      f35a6782aea69cda718cc378504db826

      SHA1

      5fc4028de1c51089d9f487caa02a78d4d42266fd

      SHA256

      20f89ddb4dd26f98ce006ae2034a87e1c2347788697e0fdb68b87c95af0b680c

      SHA512

      5a5dcf1ecb32addf5fa9ffbce583fbdb4714e5b87553abd57723cb1b199c54bbaf038db1a7ee1cb095b1aad878f8d17919b55cb093c4a869d7356aaf28fb3a4f

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
      Filesize

      2.9MB

      MD5

      46f875f1fe3d6063b390e3a170c90e50

      SHA1

      62b901749a6e3964040f9af5ddb9a684936f6c30

      SHA256

      1cf9d3512efffaa2290c105ac8b7534026604067c9b533e7b7df2e017569a4ec

      SHA512

      fdfb348061158f8133380e9a94215f4bfc0f6ce643a129d623cb8034c49144f1489de56cd076da645478506d9fbddc7590fe3d643622210084b15fdf0d16b557

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
      Filesize

      291KB

      MD5

      c184c2126de6da0e3a400ed335abd3cd

      SHA1

      21b8b8b7ea4be89a28b7123588da192a6acbafd1

      SHA256

      555bd3131e040bb2244ecedc7fc7c9895e6ad4907a8eab4f8efb243648f789ca

      SHA512

      7ae04c3c6e66ef061742d24d36dfc63fcb6c2348b0ce476903a15729de550afcf96406858ee3f9dc3c7ea16fa27dd19b32690f165fcc958a34d5c85cf1b788bd

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
      Filesize

      622B

      MD5

      1eabc4cb6d04fb72433932aa37c70caf

      SHA1

      bc31c5752d6d614fa675dfec63c87425931eae08

      SHA256

      2e491a724c85c486e59f5b224a6b27088850c143dc6b504d29aef669046dc8f9

      SHA512

      5594dbd513a7b56a2a1428735c51137f6f20348e85e8529617452668f5a9d39804d8d0473fbc331bac088a373d2e28d355e13d2585f024e4cf5403247dce2473

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
      Filesize

      655B

      MD5

      b7373007ad7e53addebe4155dbfe2c06

      SHA1

      c0ac899b092f111629e029292e44cfa7e5391b27

      SHA256

      1598ed14a003ef8b8fb2c346eeb7e6c5ff79edf16ff353cac426ce4a816a93c3

      SHA512

      46b463a9d5d7ca455ad71a55064f2ef41b048332604b0cb3d8085c17d4c7687bc08d1bffe913da98df526428be73dd4d33521acb852417a860fd0749792739ec

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat
      Filesize

      8B

      MD5

      7b89160994894a742b234e9eb53bc742

      SHA1

      789c41d02588c9369a6035038942c36e906b60f0

      SHA256

      9ca73a8f99b255ad3c749bd0e7f93c0dc0ab3ab6a12f4af86bf6e4b578d138ba

      SHA512

      227715b3d33abdf3f6ea09d484fa6e89988dd378dfd66996b4dcda3f84bd729b67269cc093172a5c7188b5e9963268fd7a23c43aac84aa8bc760fe714cf26940

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe
      Filesize

      3.9MB

      MD5

      b672a064c3cfdf56ce0d6091edc19f36

      SHA1

      1d21d4ca7a265c3eafaae8b6121be0260252e473

      SHA256

      04fdd99a4e8ded496a99c9d3c8c0b6a9a9bde9c4187d07342260f63852ef6273

      SHA512

      53e6c4bd68a0cf36160b21d63e7a6152ca78f17c76ccee9e185c1cf3f5a254c05f401f91501ad3d6806d5085b1f58322e6b7ad483fb813b86cb8570519410680

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
      Filesize

      2.7MB

      MD5

      b7e5071b317550d93258f7e1e13e7b6f

      SHA1

      2d08d78a5c29cf724bc523530d1a9014642bbc60

      SHA256

      467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064

      SHA512

      9c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
      Filesize

      2.8MB

      MD5

      2bbf63f1dab335f5caf431dbd4f38494

      SHA1

      90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0

      SHA256

      f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364

      SHA512

      ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
      Filesize

      1KB

      MD5

      5d1917024b228efbeab3c696e663873e

      SHA1

      cec5e88c2481d323ec366c18024d61a117f01b21

      SHA256

      4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8

      SHA512

      14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
      Filesize

      113KB

      MD5

      2ccb84bed084f27ca22bdd1e170a6851

      SHA1

      16608b35c136813bb565fe9c916cb7b01f0b20af

      SHA256

      a538caf4ac94708ddb4240d38b1b99914ca3e82283f0d8a2290be28fc05eaccb

      SHA512

      0fd66d241bdebd0052f4972e85b42639e3c5a40affe23170b84bc4068dff8e84446898a77ebf7cc0bef97454abb788faccce508a68bc5e717980ef26d8436986

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
      Filesize

      10KB

      MD5

      ddb20ff5524a3a22a0eb1f3e863991a7

      SHA1

      260fbc1f268d426d46f3629e250c2afd0518ed24

      SHA256

      5fc1d0838af2d7f4030e160f6a548b10bf5ca03ea60ec55a09a9adbbb056639a

      SHA512

      7c6970e35395663f97e96d5bf7639a082e111fa368f22000d649da7a9c81c285ee84b6cf63a4fccb0990e5586e70e1b9efc15cf5e4d40946736ca51ec256e953

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
      Filesize

      2KB

      MD5

      d87c2f68057611e687bdb8cc6ebea5b8

      SHA1

      27b1311d3b199e4c22772fa1b7ea556805775d37

      SHA256

      ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8

      SHA512

      4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
      Filesize

      233KB

      MD5

      246a1d7980f7d45c2456574ec3f32cbe

      SHA1

      c5fad4598c3698fdaa4aa42a74fb8fa170ffe413

      SHA256

      45948a1715f0420c66a22518a1a45a0f20463b342ce05d36c18b8c53b4d78147

      SHA512

      265e6da7c9eede8ea61f204b3524893cf9bd1ed11b338eb95c4a841428927cccbed02b7d8757a4153ce02863e8be830ea744981f800351b1e383e71ddaad36ad

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat
      Filesize

      10B

      MD5

      28c35d7de351c90314fe86d793ca598e

      SHA1

      ff5e2325c019e21e2e1f932f18c77b399f9ef9f5

      SHA256

      9827927d6cb815b08a8330491f57ccabddb87573db675c6cd4098d52dcc96145

      SHA512

      d708b879575fe04a134de04c7828fe5cf57f6820028164227afb6ee27f66b386a8db23d4ec86cfd26b9eee18f64d907f7480b68599ae824f5c42430c1607f7d0

      Download Submit

    • C:\Program Files\Malwarebytes\Anti-Malware\version.dat
      Filesize

      47B

      MD5

      c55ddfeaa9ffc335619b2e073c4a8619

      SHA1

      dde54d9cbf6687803f0ae4775bbd215894315b54

      SHA256

      41ce0250405060e72c92ba0e5b88e751bf399199dcc18bfca86f2fa3512258f4

      SHA512

      f8cb2b47a8e5b7b8a0beac50742a77121dee0b81da1ab757ed7f35a4fbdf9c9fd3bd68ca24c09237ffae10fa002a49842597c881212348d4f67914d0114eb3bc

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
      Filesize

      1KB

      MD5

      44131f0db6c52d9ce2a8be910e049914

      SHA1

      d4101c246a400a5a5fc585fba568c611a6766579

      SHA256

      5123ee86caf1dd7d85f5b857b77bf9af108438a41a0ef48a406684bea7a1e203

      SHA512

      e02a78f41996479352d8903ea5a027fc37eb32937b1fefba00777d01dc37617250cde3f97236cf7d12e1c394b33017e8fe5e724d60b18acf328b7c3e64fc7bb4

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
      Filesize

      47KB

      MD5

      d0c0719786aa24788040879f5a8545b3

      SHA1

      9b39368247834f13bc4b0a0055fdc83123418913

      SHA256

      90da5d286f01090be2e9fdf848055272af22ddbe210453722a7f374d7a77ccf4

      SHA512

      db09d4659e2b223aab5b9148d9b5d99468fe475cf82bd17ac845dcdce4c893d6d66dfdec505312235bfbf80cdac4459fe36689489968309de9e3bb4cf12abc03

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
      Filesize

      66KB

      MD5

      d4547c6b61917ff7dbccdf697abac893

      SHA1

      74e063318258ba73aafa512cee7478369f251925

      SHA256

      de935c1d04ac387a9f690a8d2bf6cd2f955eba08dd85a0efe9f0db35c8bde1cc

      SHA512

      5242e4b25f80759340b56f9fa45541834891ee602667ff2f2e49d5ac79d43727b14a7e7237e13b42c97feeeb48e9f05effe757a4d4670087de461ccb561710d2

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
      Filesize

      66KB

      MD5

      a08b24f122e4e199727ba9c21e1c4bbe

      SHA1

      7921a38e9246ca1664271f120bd1d4029a2f6463

      SHA256

      a1cab05446efa17621550e1d57d2365c96c5c0e8bb0471077f9265cd40bb8243

      SHA512

      5458e7d98cb1f667c57ee7123b3638240e1e4d63abac7415b1ae25662d4325d91d55983f29bded9ddcfe022a96018f697dce3dde590ef854060a7da13ed57112

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
      Filesize

      607B

      MD5

      be6086708e50cb5b193e3fa95a41df7f

      SHA1

      5a17ed6bae4ff5b9c58d28e225dfcdf97d168961

      SHA256

      8328423058245fe28dc99f5fc76906695af8225f72afcd5c9809d0f4d78ee2a4

      SHA512

      7dc0b4f9494895de9ee923b65693cd59433627ae73067d4b4aa77b28f629ccce36a1b9e797e997a410645a002d13e376011cb5a77e17e0e34662613d9175d0b6

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
      Filesize

      847B

      MD5

      da8a3fd6dc76f243fb3244de8bbc6f60

      SHA1

      dbea2d100f858c9720eb80672ddb5cc718b092c1

      SHA256

      7006ef6f0e3901f8a78ab0d04f149fda47078840610ce19db0239244584be119

      SHA512

      f120a79d743765ef122509a1bc1c3704effe8986525ea50d2263bd8af3845dff046c7ab45628143103549d586b90618bc41a6673b53131d4811d8127ebdbaf21

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
      Filesize

      846B

      MD5

      9c91df487ce52a5de8ce17c37199fd72

      SHA1

      be2d8f72e36d3d533a37fecea645096766ada144

      SHA256

      5be11e9eb310e2dd1529d806ba9ce2b10efb91deae0ab87c8424847c14e0a755

      SHA512

      d7b16236d4f73d5de8eaea2d1f3e1af3695f5fde87be1cae819d6fb5a59c981a249de07377c750b26dbc839f72265e1b5b791c3af3fae87e6e3c8afc0d96ff42

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
      Filesize

      827B

      MD5

      5ea25629dda932c06243d2d4b7a3f117

      SHA1

      56ba555e9600fd6df6c8885925544d5ab57ef6cc

      SHA256

      bda70ade8e44d7a8e29387bfde6aa46f495b0be9b5683b0a109d76bb8700ec5d

      SHA512

      6ddd4eb0f3e0b1ab8acdd97868797e0c073b843d43a707d83d02562329a57cf45972d8d62405118b1a6c135988ae743c8fefbed1a91b256e002f7fb63b128d56

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
      Filesize

      11KB

      MD5

      7bc9a3af7628b63db7eab0f860662f05

      SHA1

      362bf8e00a79ea9a2f1ae7540da0a98c83f2c156

      SHA256

      bd68c5e395b72458402d86f96134d7708f43fe56f51031106468eb332ba73a89

      SHA512

      c5e9d7acc577585565174001a852f7ea8ade8ad4e4e550f63c2aaff364f967fb90151f12c0a7aa6bd64f77fe169714bb32404178ef491a7ac982c52790a6ff46

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
      Filesize

      12KB

      MD5

      d270cd666d7e54db2c51e34347548a4d

      SHA1

      3a6f0b78f565e6cfeec6c828c396171f34d2fae1

      SHA256

      a10de7d654aaeb01f5086390928f32d297eb1983d862b6aa493955aa113923cc

      SHA512

      2d23ff04206534e5928dec91394ee2f6ecf814273ec061f497f525e7d987824944cb816a3f64b2f6087ec9614d3bab8a870731da0dc0c3bc4b32f3a1377761e6

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
      Filesize

      12KB

      MD5

      17970a7b63836277a67b33151859cef4

      SHA1

      30caa4391188565d836b7b4153af377490f098d2

      SHA256

      728e04403a50f07c02bd44d1f44c28ae11bf5498f7ba859e3ea1be12f1c5aaea

      SHA512

      874ad25c6d8489b521949878e6ec49d5e34a3b475955c522170e35e4199acc4c3c31bd8bb2e4e64e1c9b2cdf0215a400f505453ef805439c33afcc774aaf5e66

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
      Filesize

      12KB

      MD5

      1d6dcbd41af35ba87af108f9aad90dcd

      SHA1

      e9696b5368cb54b041ad3edebacaa3f806f37fab

      SHA256

      5fcbf62bb4c0e29a5250ed8ce35c829a6b0287c35b6ab50618c725d9935e88ef

      SHA512

      3ea0884959ad83fd123f55c78d60f6779b995c7a89e534f0a59f711cd8d99a3a332adb66f9a1b90d9c539643beeb5341aca0785159f16a80e494af85d8b4bf43

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
      Filesize

      1KB

      MD5

      452f004454f093b10fce2150239b2ff0

      SHA1

      60c778a36ec6eaf4a1885d996bcb6ac1b7cc91c1

      SHA256

      f6a16069a4b70edd030a5079cc7192638f77d59b8e570d739898d49ca06455d5

      SHA512

      271d3afb8fd3f38c2279acd5e87f536d4b88ffa792a6bb61d7b0e035bb36afaa020186b6a5f76bdbe3b06cbcd1478996997778fa1ba544eaeb9c53af1abb7822

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json.bak
      Filesize

      2KB

      MD5

      59987e19121a905e244888c3ea7bf470

      SHA1

      69aa5f8b3d0f42fb9d06081d0bc2b2f135885083

      SHA256

      8822c6f1348e2197f6f4412526158f114da63f4af9d28155b1ef43fd8d36174a

      SHA512

      c28412ae0c455821455393872c622f81ba2b81bcb80b9843478b78780f6f86cc5244c6017a3d3a8f3d1eb57b10d8c7a4de8f2e95214828592b0dcfeeb10963e3

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
      Filesize

      814B

      MD5

      f7d1311d37db14454505c85acc18d1c0

      SHA1

      39b422abc1027c712b058607d5ccb4a77c4e7fe4

      SHA256

      13cbb7654053232e1c9f4fc37c2176bf0ce2e154f10d4ac1713545639290ef84

      SHA512

      6c12633e5565cc7dc4374f64d10b301d7e0f1f17fb4bd99e674b764971d26d44cd2427f267758e8153a63178ffc7bda3a96938d70fd83d7ee5538ec17128390d

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
      Filesize

      816B

      MD5

      16f43d8bc0f34b3076c77f2de58d6a19

      SHA1

      30530334cd8b6abb265d0bd8247a89293b83683c

      SHA256

      4f207c38b3b21c36d336e6fadb3b94fdbebe5691bf4309d1dd69a982e68be6f3

      SHA512

      0ca2de0f1e5d7c7ae4db20b71756c4ba1c53f4c34fddaaa4378347ec9e4e656516e4aaab2846545d83eec6fcdda96133c4aded664b9764bce5d0611746d49e2c

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
      Filesize

      1KB

      MD5

      b70a3cd4366c9a703cd185615a957196

      SHA1

      5be69033463ef15f5f90a81f5176c00a4ee010d5

      SHA256

      6739c56b928ae8416cf621bbff7be6bbf996bdf7a66441ee0c2c5067a2307b5a

      SHA512

      e2bef3ee523de49fd39a5c7c02668192841c7da8f24f52824281914a0f49493f0845d72ba460b3ed8e6b8e1819900e261c22e2c52ff85ad0afe8bb841cfac6d2

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
      Filesize

      2KB

      MD5

      8c54498215b14014c42a748cd41defb2

      SHA1

      e1124d4ccc6b97863ebd148acf75974cc5494b48

      SHA256

      1a9e0b952a9bf0d784c6e2458e26b1c7f591afb78ac38b1d41b7b7aacbd6aa34

      SHA512

      87f9d41e9c33c6ac8664ce4c7a84ef5c963cd1f3a40ffc75ec010691b9426a24d095efff8b4213d15fb64811010ef9dcae5e5f4cdc3c627ce2408b4f5751f303

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
      Filesize

      4KB

      MD5

      bc59e1e816cb469487d2ac3a77ea6fa9

      SHA1

      1bc199db9fe59492593ecf0255cfa1026f190e20

      SHA256

      bb64f3ebf9cb27f526f5ba891fc4d6979fb28b05704fd979883ff9a4d0217573

      SHA512

      0f7dceedbbe8844259a0c57e69d716268336059fb34a76c4d8eaeef5b9d027f08c316f7fd894511d102747dad4676bfee6be65511a2cb393a919b3cdc1879723

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
      Filesize

      11KB

      MD5

      afe050acd9d2370a2a51afec96d73656

      SHA1

      14ac24e7aabffa1730a84db723a239dd53b8b5bc

      SHA256

      b843a337d984621643a92f3144d31dad01235053910cd460dbe84407a1f61b83

      SHA512

      2d33647c56b9fdfd106c66425243b292afa18225b873564afef8fef0261205ea3fe06dfd1ee29de3ded478c75cf7f0c8c3af9f79e2c3955f6ef63bbb179955d8

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
      Filesize

      1KB

      MD5

      1160f4d6f148c4a9ca0a8aab40870148

      SHA1

      9ca1161930cd22b05e32e2fbe73ee7254093515e

      SHA256

      da39a48ca042012c365b3663e6413cf4658f48373bdb15b4ee73db0e5ed0f186

      SHA512

      3ffb06eff2284379d84625366a9fd2fa7ff42cf015cc85f35d8c7a7fd12274fb2efcd047e29cd3ee4565e90575b32c15e4a6b70e006479fbbfe29f7a38ad7d88

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
      Filesize

      1KB

      MD5

      aaa5e0ac41ae5a4a8a7bdd9684539d2f

      SHA1

      4b29eb5903f507b9d90d45a1e272313d02d74692

      SHA256

      3983bcefdd3bcfd1034f1ee26a913c2a36e21cb7f8e82af76d23d29ca69ebbf7

      SHA512

      779f3ef71487e4c1b5ad12fab698f7f15795331c7b76118b7633a557d45e7966a200f86a95aa664bcf668dfcf5f638b5bb6fcfb89b8fe3687a5312238fa51a45

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
      Filesize

      1KB

      MD5

      c53b4f26c703e0d78f60ee0fc0f96c9e

      SHA1

      14ba42a9707a73e1569f42404524f3c3228582bb

      SHA256

      cfa02fd125f8ae46a4ea8e4fd50035debf74161162f98a297a7f7e6e50bf0962

      SHA512

      618179d0a4d233da802f9f4051e1eb9721524a132b1139463a50855ce1a3ee15862b8b98c1a4dbcb4e6e7dee0026d79cb3a483dab1fe2e55571cbdf0d56ac341

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
      Filesize

      1KB

      MD5

      894c03ecc9540e813ca0c0764a146af5

      SHA1

      6f4811da74e575ee841d454815504d14317fd728

      SHA256

      140d9a999f4af5947341a892275b1b4b4eea02fdf902d3cb984076b4c431c8ce

      SHA512

      ac8ecfe90483c76c7b0ed628adb4c3dc94524888872599bf6c48a2952a6f96f4a52b09e70c0a704d19b25f5856329564f7743831e8a35e0e76edf3aad9645808

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
      Filesize

      1KB

      MD5

      2d9d0b70e6a2ed0f8d2f20fba98f9c44

      SHA1

      e03d79ea3bde78bc5c6f457281aeea8d304eeee7

      SHA256

      4912dc0b2627af6b12dba6129233ec87c5567e4da942a5429e9e0118f76be61e

      SHA512

      18483d90ef1dc6f3d98ee17db0b36df4e13f5bc891cd68d3a366d424869a33dab998556b2fdcf1798ff9fe66682749da809754cf77baee1b960f55fc4c04d3d0

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
      Filesize

      1KB

      MD5

      6c5936465219a13a3c88de96839c3484

      SHA1

      70fd94b0f3e3edecab4f8af98fa940e65919b8bc

      SHA256

      9e33df1ef6318cc64f358e42a0046bb3c2dcb17029adbee9a5f0b058557476ed

      SHA512

      381ae436738d19dc17e7569ff8d2f7eb74e4f268876cf46571f71ab55417211501ce860e4186a1a0fd9bbc78209ee88ae77e8f0ba74ff23039bf0930cee61382

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
      Filesize

      1KB

      MD5

      542bc5fa808392004893c7540e06691d

      SHA1

      35426b6e28c18a0eccbda2d745f1f0cf56a63784

      SHA256

      d492d8a10d59e19f4512a8b04c878c5c86f7520557fc7395c52f4e837c9f16bc

      SHA512

      6b6ec76707b328bba8d6528704e8784effe2424f9508a5b0bef96a123e65f1ef883f1a02e03851eb75bf907678deee5c6bbe0a0e40668b909a455f6f6b96d8b1

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
      Filesize

      1KB

      MD5

      565401090bdb12a6a47a426c60d9e213

      SHA1

      67c7df4de756a0013dd304fbc330d64f59b96b75

      SHA256

      db3580400bc85ff5a670a0084ad40d6052a9407d6d3c22b410f3f69fdfade210

      SHA512

      330e3d7b09a6b49fccef17207e0b3493e1d2ef01d9349d0cc7f9b4ee233de694db283b440234dc925ce3cbc0ab9159f71e5590439022dd84152278fd4023c042

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
      Filesize

      1KB

      MD5

      ad6d4c12d2e8d335e4c0e07d59ad7f8a

      SHA1

      53c14f8df7dc613527a339fb726e2ed728bdeec3

      SHA256

      52e8a7d84b67994529d09065f161b87ba2d587196a2864662dfd2121f8e66896

      SHA512

      20d9ad9440bfae6437a224dbee4d051c130845044fd258b2164887166aab1a500726475c13e6d40009c5c249dc7b4a621d27f332e44fe2cb1c536f8b01ae9cbf

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
      Filesize

      1KB

      MD5

      8df1e23831b0a96021d47ee08ffcda80

      SHA1

      95a52e4dc5f5670ef384ef2fb9ec38d1ec27fd58

      SHA256

      bd3dd990f3bf08b38b903e467c919f72bf0e6ad39920697455dee3cf39bd8bd9

      SHA512

      c9d5740e113e23c10431181a610f36047c4f95ee3860c0d2652689c378f27577fe82475629d6248f95482e013111f9e94bfd44fe25bb9fb93206db883224e2b1

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
      Filesize

      1KB

      MD5

      03a7cb2d2c98ac14e2678b40cf62b8ef

      SHA1

      d06f4114521fad70139e110a32408d6d311b14c6

      SHA256

      2fea51979eac90aa8cb988325daf0258dd770203d10cf5ecd501195c8c236e1c

      SHA512

      a5aa734dced73dc2cf7d0bfa703bde8ac8fd9a6317fabd76a3a02ae1ca082c6f79a2dd2b067c5ed715bfb5673530b6b3b7f3a048f874814f44d434c8603f935a

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json
      Filesize

      125B

      MD5

      e759027e8ecf049029da7208b3c04ab3

      SHA1

      a37ef59d78c2745e7c394069753a90321ac289e0

      SHA256

      df10de8dfb99c6a74914853992661aa3fc5fecbfa169e92116d2a4b47d0793cf

      SHA512

      35afededbb2d5445e992ca004624c7b72500ace074630e9a8f6d66915eaa73663931fbf0731eb0d18f706964cc2c694f682cbb7b146a00aa585dd4b8bbf01920

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll
      Filesize

      529KB

      MD5

      d18a4d9fc656260d806e0b18827648ea

      SHA1

      ae58682779e8896544762535ef3b157e300d6156

      SHA256

      4509d6d67679c14056a189374e68aead1e4b12a49e927e5c1142108f4cb58231

      SHA512

      c223e48335c702596bbf1661f8ab56ae0f670c36a7f228d394df81d928e646f61d30ac04f4affed4b8c513641bf5da30b6ac6fa3815bec4fd61d803135a36951

      Download Submit

    • C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat
      Filesize

      76B

      MD5

      aa8a1ea6210a49b6ba5e796c2d7ecbcc

      SHA1

      0e7a36facb6788b46a3e64f882e02e21af2e40bf

      SHA256

      0b9ae618e82064302e48563de1710e4d68d9a2b252eed2a478beb5a331535020

      SHA512

      dc6cd7ea8095bb0424d40ec97945cf82ee8812fc3e59271cd3f491a37d289dd20029674569f70e696983f5a32a881ce3dcd3746b93152c518799d0e024bddf7d

      Download Submit

    • C:\Windows\System32\CatRoot2\dberr.txt
      Filesize

      19KB

      MD5

      8c3154ee44b25b5fe500b78f81047e69

      SHA1

      b1aaf75ce2a3f302bebcb87885929f24b10906e8

      SHA256

      4b77cf91bac201c7c1080d42ce6444684fe23cee9202f69e0bd8f6e7482f69f5

      SHA512

      42e874090a850914407c5359b9e52793d306ebd3719fa4659ec1fea829973902965962298fcd67059f20b07088c6a3a2f707dc9a07fa88adbd6a3a8d416355f5

      Download Submit

    • C:\Windows\System32\catroot2\dberr.txt
      Filesize

      19KB

      MD5

      870d3f2d3f8b12d12f36ab5bc4e99a62

      SHA1

      003189e6f8589efc29b85190c718cf90f80649b5

      SHA256

      1548875df31dc15f4dfb4d69a4d0074d65dfabb059a58be102a8729d9685924c

      SHA512

      a6b4a69c11978cffb42053eec78981723790e3f487c770e17813553d9eb1dc09693e3d49140c479241774a0bd93caa71f2168b03e04a398864679cdb459bcb6e

      Download Submit

    • C:\Windows\Temp\MBInstallTempdd8e6e8b729b11ef8ec3762c928cca03\7z.dll
      Filesize

      1.6MB

      MD5

      3430e2544637cebf8ba1f509ed5a27b1

      SHA1

      7e5bd7af223436081601413fb501b8bd20b67a1e

      SHA256

      bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa

      SHA512

      91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d

      Download Submit

    • C:\Windows\Temp\MBInstallTempdd8e6e8b729b11ef8ec3762c928cca03\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
      Filesize

      372B

      MD5

      d94cf983fba9ab1bb8a6cb3ad4a48f50

      SHA1

      04855d8b7a76b7ec74633043ef9986d4500ca63c

      SHA256

      1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

      SHA512

      09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

      Download Submit

    • C:\Windows\Temp\MBInstallTempdd8e6e8b729b11ef8ec3762c928cca03\ctlrpkg\mbae64.sys
      Filesize

      154KB

      MD5

      95515708f41a7e283d6725506f56f6f2

      SHA1

      9afc20a19db3d2a75b6915d8d9af602c5218735e

      SHA256

      321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6

      SHA512

      d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

      Download Submit

    • C:\Windows\Temp\MBInstallTempdd8e6e8b729b11ef8ec3762c928cca03\dbclspkg\MBAMCoreV5.dll
      Filesize

      6.3MB

      MD5

      0309d4dcc8b3597cc6aea8c6025b9405

      SHA1

      25d112c8dcdcd143399d2882805b2c06df8e1afa

      SHA256

      59825d6ce6a54b102f0ae0929112da899af0386502cbcc87565d5d390e17c6d4

      SHA512

      4ced39d3127ecb9b2a617d572a26472b359fafbe7af99b8f9208468dd76c0d219095b5ce2444308e4812cfb9e039e00de05e5de968c0baccfba9aef88d90556b

      Download Submit

    • C:\Windows\Temp\MBInstallTempdd8e6e8b729b11ef8ec3762c928cca03\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.33\mscordaccore.dll
      Filesize

      1.3MB

      MD5

      0377b6eb6be497cdf761b7e658637263

      SHA1

      b8a1e82a3cb7ca0642c6b66869ee92ce90465b2a

      SHA256

      4b7247323c45262bbb77f0ef55c177a2211040fa77d410513a667488bf1bc882

      SHA512

      ff3f6f6d1535e7aab448590fdbdf60d37e64e00d4081853f201c0103d7b7918f388db5469774f32af211e0990bc103bc9ff3708fa44efd868aa312c76ea65600

      Download Submit

    • C:\Windows\Temp\MBInstallTempdd8e6e8b729b11ef8ec3762c928cca03\servicepkg\MBAMService.exe
      Filesize

      8.6MB

      MD5

      2d49262ee00ca948aefc1047d65bca56

      SHA1

      ae60524cd5d0fc2e8f32b38835667871747db3fb

      SHA256

      6931bb215c086739a7b2ab089a8bd9cd4b2acbb9f44a32ec1b420f216f6ff782

      SHA512

      d069d4f20d69aa102438f1779f6222cfef7967733cce8d744bf6121e8e22bfc8dee4ee6887cf13e17ea173a0db4c52e3009fe85b861f5c7622294b63b366877a

      Download Submit

    • C:\Windows\Temp\MBInstallTempdd8e6e8b729b11ef8ec3762c928cca03\servicepkg\mbamelam.cat
      Filesize

      10KB

      MD5

      60608328775d6acf03eaab38407e5b7c

      SHA1

      9f63644893517286753f63ad6d01bc8bfacf79b1

      SHA256

      3ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59

      SHA512

      9f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7

      Download Submit

    • C:\Windows\Temp\MBInstallTempdd8e6e8b729b11ef8ec3762c928cca03\servicepkg\mbamelam.inf
      Filesize

      2KB

      MD5

      c481ad4dd1d91860335787aa61177932

      SHA1

      81633414c5bf5832a8584fb0740bc09596b9b66d

      SHA256

      793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3

      SHA512

      d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830

      Download Submit

    • C:\Windows\Temp\MBInstallTempdd8e6e8b729b11ef8ec3762c928cca03\servicepkg\mbamelam.sys
      Filesize

      20KB

      MD5

      9e77c51e14fa9a323ee1635dc74ecc07

      SHA1

      a78bde0bd73260ce7af9cdc441af9db54d1637c2

      SHA256

      b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0

      SHA512

      a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186

      Download Submit

    • memory/4884-3892-0x00000136B18F0000-0x00000136B1BE7000-memory.dmp

      Filesize

      3.0MB

      Download