Should I block it?

No, this file is 100% safe to run.

Additional versions

3.0.2	11.18%
3.0.2	0.62%
1.70.0.0000	36.65%
1.70.0.0000	33.54%
1.65.0.0000	17.39%
1.65.0.0000	0.62%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Child process

mbam.exe (Malwarebytes Anti-Malware by Malwarebytes Corporation)

Related files

PE file structure

Show functions

Import table

advapi32.dll

InitializeSecurityDescriptor, ReportEventW, DeregisterEventSource, RegisterEventSourceW, IsTextUnicode, CryptGenRandom, CryptAcquireContextW, OpenProcessToken, DuplicateTokenEx, CreateProcessAsUserW, GetTokenInformation, RegSetValueExW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerExW, SetServiceStatus, RegQueryValueExW, SetSecurityDescriptorDacl, RegOpenKeyExW, RegCloseKey

kernel32.dll

GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetUserDefaultLCID, LCMapStringW, SetStdHandle, WaitNamedPipeW, TransactNamedPipe, SetNamedPipeHandleState, GetTimeZoneInformation, LocalFileTimeToFileTime, FileTimeToLocalFileTime, CloseHandle, CreateWaitableTimerW, WaitForMultipleObjects, CreateEventW, GetLocalTime, ResetEvent, FileTimeToSystemTime, Sleep, GetSystemTimeAsFileTime, SetEvent, SystemTimeToFileTime, SetWaitableTimer, GetLastError, FreeLibrary, LoadLibraryW, GetProcAddress, GetCurrentProcess, GetComputerNameW, GetModuleHandleW, GetVersionExW, CreateFileW, GetACP, GetSystemInfo, CreateProcessW, OpenProcess, TerminateProcess, Process32FirstW, Process32NextW, CreateToolhelp32Snapshot, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, WideCharToMultiByte, MultiByteToWideChar, SetFilePointer, WriteFile, ReadFile, CreateDirectoryW, OutputDebugStringW, GetSystemTime, GetCommandLineA, HeapSetInformation, RaiseException, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, HeapFree, IsProcessorFeaturePresent, HeapSize, ExitProcess, GetStdHandle, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, GetStartupInfoW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetLocaleInfoW, GetStringTypeW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, HeapReAlloc, InterlockedExchange, RtlUnwind, GetCPInfo, GetOEMCP, IsValidCodePage, WriteConsoleW

mbam.dll

_GetRandomizationTime@0, _LicenseIsValid@0, _GetMBAMSettings@4, _UnscheduleTask@16

mbamnet.dll

_PerformUpdate@16, _IsTrialActive@0, _ValidateTrial@16

shell32.dll

SHGetFolderPathW

user32.dll

CharUpperW

userenv.dll

DestroyEnvironmentBlock, CreateEnvironmentBlock

wtsapi32.dll

WTSQuerySessionInformationW, WTSEnumerateSessionsW, WTSFreeMemory

mbamscheduler.exe

Malwarebytes Anti-Malware by Malwarebytes Corporation (Signed)

Remove mbamscheduler.exe

Version:	1.70.0.0000
MD5:	1acaa67676e9e7bda5e0c41b6e0decaf
SHA1:	bf60e2b8b4e4b6c2206c52c543de6ed64697ee7f
SHA256:	807934d61e9a6c8302c934dcc3901a80a7068c9bc8eb4fae24a32d97cb1df963

What is mbamscheduler.exe?

Malwarebytes' Anti-Malware is an application that finds and removes malware. It is available in a free version, which scans for and removes malware when started manually, and a paid version, which provides scheduled scans, real-time protection and a flash memory scanner. Malwarebytes' is intended to find malware that other anti-virus and anti-spyware programs generally miss, including rogue security software, adware, and spyware.

About mbamscheduler.exe (from Malwarebytes Corporation)

“Malware is big and malware is bad. Your computer is constantly at risk from infection by malware including viruses, worms, trojans, rootkits, dialers and spyware. Malwarebytes specializes in fighting ”

Details

File name:	mbamscheduler.exe
Publisher:	Malwarebytes Corporation
Product name:	Malwarebytes Anti-Malware
Typical file path:	C:\Program Files\malwarebytes' anti-malware\mbamscheduler.exe
File version:	1.70.0.0000
Size:	388.85 KB (398,184 bytes)
Certificate
Issued to:	Malwarebytes Corporation
Authority (CA):	VeriSign
Effective date:	Monday, May 23, 2011
Expiration date:	Tuesday, June 4, 2013
Digital DNA
PE subsystem:	Windows Console
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

Malwarebytes' Anti-Malware

Malwarebytes Corporation

2% remove

Malwarebytes' Anti-Malware (MBAM) is a computer application that finds and removes malware. MBAM claims to be intended to find malware that other anti-virus and anti-spyware programs generally miss, including rogue security software, adware, and spyware. MBAM scans in batch mode, rather than scanning all files opened, reducing interference if on-demand anti-malware software is also running on the computer.

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MBAMScheduler'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00265138%	0.028634%
Kernel CPU:	0.00155648%	0.013761%
User CPU:	0.00109491%	0.014873%
Kernel CPU time:	1,801,084 ms/min	100,923,805ms/min
CPU cycles:	368,379/sec	17,470,203/sec
Context switches:	2/sec	284/sec
Memory
Private memory:	3.16 MB	21.59 MB
Private (maximum):	9.37 MB
Private (minimum):	3.9 MB
Non-paged memory:	3.16 MB	21.59 MB
Virtual memory:	79.3 MB	140.96 MB
Virtual memory (peak):	127.56 MB	169.69 MB
Working set:	5.19 MB	18.61 MB
Working set (peak):	36.15 MB	37.95 MB
Page faults:	229,063/min	2,039/min
I/O
I/O read transfer:	9.46 KB/sec	1.02 MB/min
I/O read operations:	3/sec	343/min
I/O write transfer:	10.65 KB/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	272 Bytes/sec	448.09 KB/min
I/O other operations:	34/sec	1,671/min
Resource allocations
Threads:	3	12
Handles:	103	600
GUI GDI count:	4	103
GUI USER count:	1	49

Process properties

Integrety level:	System
Platform:	64-bit
Command lines:	"C:\Program Files\malwarebytes' anti-malware\mbamscheduler.exe"
Owner:	SYSTEM
Windows Service
Service name:	MBAMScheduler
Description:	“Malwarebytes Anti-Malware scheduler”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads

Averages

ADVAPI32.dll
Total CPU:	0.03556454%	0.272967%
Kernel CPU:	0.02549784%	0.107585%
User CPU:	0.01006670%	0.165382%
CPU cycles:	691,262/sec	5,741,424/sec
Memory:	792 KB	1.16 MB
sechost.dll
Total CPU:	0.02585657%
Kernel CPU:	0.00982658%
User CPU:	0.01602999%
CPU cycles:	658,732/sec
Memory:	100 KB
ntdll.dll
Total CPU:	0.01517494%
Kernel CPU:	0.00000000%
User CPU:	0.01517494%
CPU cycles:	9,373/sec
Memory:	1.23 MB
wow64.dll
Total CPU:	0.01468664%
Kernel CPU:	0.00300257%
User CPU:	0.01168407%
CPU cycles:	503,014/sec
Memory:	252 KB
mbamscheduler.exe (main module)
Total CPU:	0.00508504%
Kernel CPU:	0.00093328%
User CPU:	0.00415176%
CPU cycles:	129,226/sec
Memory:	404 KB
wow64cpu.dll
Total CPU:	0.00039790%
Kernel CPU:	0.00022170%
User CPU:	0.00017620%
CPU cycles:	6,940/sec
Memory:	32 KB
mbamnet.dll (Malwarebytes Anti-Malware by Malwarebytes)
Total CPU:	0.00013632%
Kernel CPU:	0.00005212%
User CPU:	0.00008420%
CPU cycles:	2,050/sec
Memory:	2.1 MB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	39.38%
Windows 7 Ultimate	16.88%
Microsoft Windows XP	11.25%
Windows 7 Professional	10.63%
Windows Vista Home Premium	4.38%
Windows 8 Pro	3.75%
Windows 8	3.75%
Windows 8 Pro with Media Center	3.75%
Windows 8.1	3.13%
Windows 8.1 Pro	0.63%
Windows Vista Home Basic	0.63%
Windows Vista Business	0.63%
Windows 7 Enterprise	0.63%
Windows 7 Starter	0.63%

Distribution by country

United States installs about 59.12% of Malwarebytes Anti-Malware.

Distribution by PC manufacturer

PC Manufacturer	distribution
ASUS	23.13%
Hewlett-Packard	19.73%
Dell	16.33%
Toshiba	13.61%
Acer	8.84%
GIGABYTE	4.08%
Sony	4.08%
Lenovo	2.72%
Intel	2.72%
Samsung	1.36%
Gateway	1.36%
Medion	1.36%
Sahara	0.68%

Remove Adware and Spyware Programs, FREE Download!