Overview

overview

10

Static

static

1

MBSetup-3.3.exe

windows10-2004-x64

10

MBSetup-3.3.exe

windows10-ltsc_2021-x64

8

MBSetup-3.3.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    23/06/2026, 02:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MBSetup-3.3.exe
  • Size 2.7MB
  • Sample260623-dbgbrshz2n
  • SHA256 572113257475dacd1cc957ba7b00a4ec44649d6164ea2e43556f693fe7c34721
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Drops file in Drivers directory 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Sets service image path in registry 3 TTPs 4 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 41 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 12 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 18 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MBSetup-3.3.exe
    "C:\Users\Admin\AppData\Local\Temp\MBSetup-3.3.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:3652
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
    1⤵
    • Drops file in Drivers directory
    • Impair Defenses: Safe Mode Boot
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4140
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Modifies registry class
      PID:4620
  • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Event Triggered Execution: Netsh Helper DLL
    PID:1164
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of WriteProcessMemory
    PID:800
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "00000000000001CC" "Service-0x0-3e7$\Default" "00000000000001D8" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2552
  • C:\Windows\system32\DRIVERS\MbamElam.sys
    C:\Windows\system32\DRIVERS\MbamElam.sys
    1⤵
    • Executes dropped EXE
    PID:228
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
    1⤵
    • Executes dropped EXE
    PID:1292
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Checks BIOS information in registry
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2544
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2148
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3332
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2472
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1088
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4040
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1496
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1224
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3600
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3672
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2668
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4192
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4736
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3840
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1680
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1328
    • C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
      "C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      PID:1620
  • C:\Windows\system32\DRIVERS\mbamswissarmy.sys
    C:\Windows\system32\DRIVERS\mbamswissarmy.sys
    1⤵
    • Executes dropped EXE
    PID:2904
  • C:\Windows\system32\DRIVERS\MbamChameleon.sys
    C:\Windows\system32\DRIVERS\MbamChameleon.sys
    1⤵
    • Executes dropped EXE
    PID:3180
  • C:\Windows\system32\DRIVERS\mbam.sys
    C:\Windows\system32\DRIVERS\mbam.sys
    1⤵
    • Executes dropped EXE
    PID:3356

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        2
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        2
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Impair Defenses

        1
        T1562

        Safe Mode Boot

        1
        T1562.009

        Modify Registry

        3
        T1112

        Subvert Trust Controls

        2
        T1553

        Install Root Certificate

        2
        T1553.004

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        5
        T1012

        System Information Discovery

        5
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Remote Services

        1
        T1021

        Remote Desktop Protocol

        1
        T1021.001

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        mbtun.cat
        • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
        • Size 10KB
        • SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbtun.sys
        • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
        • Size 107KB
        • SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
        • Size 1.6MB
        • SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AEControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
        • Size 4.9MB
        • SHA256 f15b0afd904825c8e653fb305bf5248571566a9d59aac9d3202aad549d746e1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Actions.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
        • Size 6.1MB
        • SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ActionsShim.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
        • Size 3.7MB
        • SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ArwControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
        • Size 5.5MB
        • SHA256 4c0ed13fa8a08e2d8f7673ddf1efbf47721559de4b47d38de3346802a1272032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BrowserSDKDLL.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
        • Size 7.0MB
        • SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BrowserSDKDLLShim.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
        • Size 3.7MB
        • SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CleanControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
        • Size 8.7MB
        • SHA256 d85916bd0b4ef3f1aa9abf108d0f6a9541b0ff690fe71af8fb90dd4139f411a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CloudControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
        • Size 6.9MB
        • SHA256 71b6312c8f6bd8e62c7f766ed56dea99f9daca0963039128ba11e4b6842b0922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LicenseControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
        • Size 7.1MB
        • SHA256 14d0f6b8a3c404e7773458b731edcde63a94f3f09adf2489ff837e0e3b9f7098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MBAMInstallerService.exe
        • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
        • Size 10.6MB
        • SHA256 edca8a8b132d7b3ab64092ca1423376f9a0a6d16d53268ccd7a257b712c0d83e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MBAMShim.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
        • Size 4.3MB
        • SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MBVpnTunnelService.exe
        • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
        • Size 4.1MB
        • SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MBVpnTunnel_mbtun.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
        • Size 4.2MB
        • SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MWACControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
        • Size 7.5MB
        • SHA256 de2dae4a12a73667b42dc5eaeb3789e03481d8797c0257e32eb86ed5e83c5e3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MwacLib.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll
        • Size 6.4MB
        • SHA256 a61d5bc48277514b50c53b59d6b9fd759461be710a9d94a0bcbdd4c97f4dc376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PoliciesControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
        • Size 6.1MB
        • SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RTPControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
        • Size 6.4MB
        • SHA256 ca857f122db3d8d65e81969cefc3e9d42243e85f72a0567a369236b82ca0ee34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SPControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
        • Size 4.5MB
        • SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScanControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
        • Size 6.9MB
        • SHA256 f41c5a9754861fd06b05470a267fa9d6f801a0dce1834ad36aeec3212458841c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SelfProtectionSdk.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
        • Size 4.6MB
        • SHA256 fc37ffdcd7d89b95c6848677973c8dff654e4a65f3d067961144c92b6f71150e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SelfProtectionShim.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
        • Size 4.0MB
        • SHA256 49b3feefcda8c839dfd591a04ed73d7321db278f061d5d4735f1ff520bb78288
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ServiceConfig.json
        • Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
        • Size 621B
        • SHA256 6fc2a69093890189cf3c0a5123d847125530601318847becee4d6c8d00e9fb94
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Swissarmy.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
        • Size 5.3MB
        • SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SwissarmyShim.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
        • Size 3.8MB
        • SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TelemetryControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
        • Size 7.3MB
        • SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UpdateControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
        • Size 4.5MB
        • SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VPNControllerImpl.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
        • Size 3.5MB
        • SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        arwlib.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\arwlib.dll
        • Size 7.2MB
        • SHA256 1ef6987ac94c4e77b5b756a54c5946ba0056d8bcdf0f4f05d114f2345e8917d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ig.exe
        • Path C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        • Size 1.8MB
        • SHA256 3bf6111de16dcbffbe696afefeac07e988cf884d1a2f85009762b7ac7b60ac18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbae-api-na.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll
        • Size 723KB
        • SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbcut.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\mbcut.dll
        • Size 4.2MB
        • SHA256 44497e517a18870547bd5e565e00822c5a3ddd8f24de88afc98b7b44d6af059f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbshlext.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
        • Size 3.1MB
        • SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbtun.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
        • Size 2.8MB
        • SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbtun.inf
        • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
        • Size 1KB
        • SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        offreg.dll
        • Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
        • Size 140KB
        • SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pkgvers.dat
        • Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
        • Size 78B
        • SHA256 8566965da6dcc9b1d502d65aade56269de7ee66758690a622333e91740f5ec9f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        farflt.cat
        • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.cat
        • Size 11KB
        • SHA256 26ed3d77c1c84adb04150fead280f7bccc14ad4ad4bf94ee49d8ebf2ee2b3aec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        farflt.inf
        • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.inf
        • Size 2KB
        • SHA256 c031327df2e0222fb1820e38786e4826a7fa06ad72b4d2a0e35d6a94c20e9044
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        farflt.sys
        • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sys
        • Size 210KB
        • SHA256 7491ef8e1693e3711913af6cdba3d63081bf92fba8e2f8129fccdccb111eeee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbamchameleon.cat
        • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
        • Size 11KB
        • SHA256 e4357437faec3b5de5d8089e3a92fe5640f5948a3a29971f12a7f764f4b77509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbamchameleon.inf
        • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
        • Size 3KB
        • SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7z.dll
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\7z.dll
        • Size 1.6MB
        • SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MBAMService.exe
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\ctlrpkg\MBAMService.exe
        • Size 11.0MB
        • SHA256 10715f7321fcf50ee7a7cbdeb46035634c3aa4bf314cfd02a0aa1c16d34b0669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MBAMWsc.exe
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\ctlrpkg\MBAMWsc.exe
        • Size 4.2MB
        • SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Malwarebytes_Assistant.runtimeconfig.json
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
        • Size 519B
        • SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        mbae.sys
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\ctlrpkg\mbae.sys
        • Size 155KB
        • SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbamelam.cat
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\ctlrpkg\mbamelam.cat
        • Size 11KB
        • SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbamelam.inf
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\ctlrpkg\mbamelam.inf
        • Size 2KB
        • SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        mbamelam.sys
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\ctlrpkg\mbamelam.sys
        • Size 21KB
        • SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        srvversion.dat
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\ctlrpkg\srvversion.dat
        • Size 9B
        • SHA256 bb739f2dafe570246d21c1fec46063f8645144e95838794010faa1f62e77a733
        • MD5 SHA1 SHA512
        Submit Download

        MBAMCoreV5.dll
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\dbclspkg\MBAMCoreV5.dll
        • Size 8.7MB
        • SHA256 15ea0e58a63840c705681cd9bdd4024d347816f99e5bcce7194b475e27f040b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .version
        • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4997214b6eae11f1849eeea419972ce3\dotnetpkgtmp\shared\Microsoft.NETCore.App\10.0.8\.version
        • Size 50B
        • SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        mbae-default.log
        • Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.log
        • Size 1KB
        • SHA256 607620fd72b22aee7f451d8ee15e55b23b8d21def235861448845262bbfec49e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AeConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
        • Size 47KB
        • SHA256 a4708d02dd733d48a1e8cb45bd82d629173f8c45e4f16719d45b24798bc791c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AeConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
        • Size 66KB
        • SHA256 95123575477da8e958e3058992408ea6f2e431c0bd435be09c4574b306844d52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ArwControllerConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
        • Size 1KB
        • SHA256 9dea2349877c24e19d08724cfebb4ddd95a9957c862c088aea69591669f893bc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LicenseConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
        • Size 12KB
        • SHA256 e309472a07aa0f6f38492b18bb691a8c9706e786588ffc11a768f772d6f5a734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LicenseConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
        • Size 12KB
        • SHA256 7c5f48b94c1b1c1e5a861d38367f37473492394564753fd27021f16444d87811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LicenseConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
        • Size 12KB
        • SHA256 c0222be98b4cbc7951c7b1ff9071c3b46fe94ea891ad74dad7bb89f9ea1614e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MwacControllerConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
        • Size 2KB
        • SHA256 f24015a247ff7629ad32b0722ab129eaa9c687c8ab016c94bdf5489070dbff2b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RtpConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
        • Size 2KB
        • SHA256 0ff0b721d3f019a1f6bfca68c9cc8eda5a4d60737db812cf754c3ab4338a851e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScanConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
        • Size 5KB
        • SHA256 decb81578e6bb9ed6493568f7620ba8b3a9c840d5c2921d430ab1af60ab9600c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SpConfigFile.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
        • Size 12KB
        • SHA256 864e84f21ce5b11461420a17f354e6611762e561e692daa8a79cee9ef5af80dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TelemCtrlConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
        • Size 1KB
        • SHA256 4bb0404a640e72d080b6d3e306d77cab2a583147325ea443ff1bb9eff20a5841
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        TelemCtrlConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
        • Size 1KB
        • SHA256 cb1b38aef25edad80ee969ba9f3f7f967766513d209f9b698327dfe0f7538c63
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        TelemCtrlConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
        • Size 1KB
        • SHA256 e138ce90904b610297eb79bd1c03a5e8972cb73534e9f676f277d9a77b356997
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdateControllerConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
        • Size 1KB
        • SHA256 63f7eb6dd943f894a5786f958f0e8fe16d1d1e060cea8c98afe4a3cbe7e0155e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdateControllerConfig.json
        • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
        • Size 1KB
        • SHA256 d7cab70361a16292ecb7ac4d94476308abc5dc62e89eec9f0d3658ba834510af
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MBSetup.exe
        • Path C:\ProgramData\Malwarebytes\MBAMService\rmode\MBSetup.exe
        • Size 2.7MB
        • SHA256 0b9465643cd2609856e7ebdebc34296670a2b388c2bcf6e5ee0b59430c97bf41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbrescue.exe
        • Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
        • Size 7.7MB
        • SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 51KB
        • SHA256 4cc4d5b4c78694ef6b5ec79144c75f482814439b8b803a540ed54f722be66326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 51KB
        • SHA256 987c650006680614a89547bdcfb8cfa2aaa6e9aacc07e0aa959d6fc2e0b80472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\catroot2\dberr.txt
        • Size 51KB
        • SHA256 57b90104ade2f63c3997b3691458d057ac0a04e842ebb45b6fc7de9428c9fc43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MbamChameleon.sys
        • Path C:\Windows\System32\drivers\MbamChameleon.sys
        • Size 230KB
        • SHA256 1d0c63d9d7328822fcbb5e06770270bc28aad0debc6e3bf77a89a8ce2d9b4bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mbamswissarmy.sys
        • Path C:\Windows\System32\drivers\mbamswissarmy.sys
        • Size 240KB
        • SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mb_errors999.log
        • Path C:\Windows\TEMP\mb_errors999.log
        • Size 429B
        • SHA256 65eb1b76a36112f945f93893ff1e86313e8abca8c71aea35cc939e4aa81a1c75
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2544-3143-0x000001CFAC790000-0x000001CFACC19000-memory.dmp
        Download

        memory/2544-3142-0x000001CFAC3E0000-0x000001CFAC78F000-memory.dmp
        Download

        memory/2544-2795-0x000001CFAC3E0000-0x000001CFAC78F000-memory.dmp
        Download

        memory/2544-2796-0x000001CFAC790000-0x000001CFACC19000-memory.dmp
        Download

        memory/2544-3185-0x000001CFAC3E0000-0x000001CFAC78F000-memory.dmp
        Download

        memory/2544-3186-0x000001CFAC790000-0x000001CFACC19000-memory.dmp
        Download