Overview

overview

9

Static

static

1

2026-06-27...at.exe

windows10-2004-x64

9

2026-06-27...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_b2416edb738fa965cc0d0405322a24c1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
  • Size 2.7MB
  • Sample260629-ecl43scv61
  • SHA256 0385b06957b7f5b2c3c7132f8ebd8414f64f00407ea2baf07acbffa8d6eca334
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables built or packed with MPress PE compressor 2 IoCs
  • Detects executables packed with ConfuserEx Mod 1 IoCs
  • Detects executables packed with Goliath 1 IoCs
  • Detects executables packed with Themida 1 IoCs
  • Drops file in Drivers directory 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Sets service image path in registry 3 TTPs 4 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 39 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 13 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: LoadsDriver 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_b2416edb738fa965cc0d0405322a24c1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_b2416edb738fa965cc0d0405322a24c1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:5732
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
    1⤵
    • Drops file in Drivers directory
    • Impair Defenses: Safe Mode Boot
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2844
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Modifies registry class
      PID:408
  • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Event Triggered Execution: Netsh Helper DLL
    PID:3756
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "00000000000001A4" "Service-0x0-3e7$\Default" "000000000000014C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:3712
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
    1⤵
    • Executes dropped EXE
    PID:2292
  • C:\Windows\system32\DRIVERS\MbamElam.sys
    C:\Windows\system32\DRIVERS\MbamElam.sys
    1⤵
    • Executes dropped EXE
    PID:5392
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Checks BIOS information in registry
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
      "C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      PID:2008
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2900
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3548
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:6032
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4640
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5012
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4460
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1972
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4532
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5320
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1584
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5316
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3420
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5284
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1376
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:6128
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:1672
    • C:\Windows\system32\DRIVERS\mbamswissarmy.sys
      C:\Windows\system32\DRIVERS\mbamswissarmy.sys
      1⤵
      • Executes dropped EXE
      PID:5388
    • C:\Windows\system32\DRIVERS\MbamChameleon.sys
      C:\Windows\system32\DRIVERS\MbamChameleon.sys
      1⤵
      • Executes dropped EXE
      PID:5448
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:408
      • C:\Windows\system32\DRIVERS\mbam.sys
        C:\Windows\system32\DRIVERS\mbam.sys
        1⤵
        • Executes dropped EXE
        PID:3040

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Safe Mode Boot

            1
            T1562.009

            Modify Registry

            3
            T1112

            Subvert Trust Controls

            2
            T1553

            Install Root Certificate

            2
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            5
            T1012

            System Information Discovery

            5
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Remote Services

            1
            T1021

            Remote Desktop Protocol

            1
            T1021.001

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            mbtun.cat
            • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
            • Size 10KB
            • SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.sys
            • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
            • Size 107KB
            • SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
            • Size 1.6MB
            • SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AEControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
            • Size 4.9MB
            • SHA256 f15b0afd904825c8e653fb305bf5248571566a9d59aac9d3202aad549d746e1a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Actions.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
            • Size 6.1MB
            • SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ActionsShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
            • Size 3.7MB
            • SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ArwControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
            • Size 5.5MB
            • SHA256 4c0ed13fa8a08e2d8f7673ddf1efbf47721559de4b47d38de3346802a1272032
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BrowserSDKDLL.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
            • Size 7.0MB
            • SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BrowserSDKDLLShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
            • Size 3.7MB
            • SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CleanControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
            • Size 8.7MB
            • SHA256 d85916bd0b4ef3f1aa9abf108d0f6a9541b0ff690fe71af8fb90dd4139f411a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CloudControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
            • Size 6.9MB
            • SHA256 71b6312c8f6bd8e62c7f766ed56dea99f9daca0963039128ba11e4b6842b0922
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LicenseControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
            • Size 7.1MB
            • SHA256 14d0f6b8a3c404e7773458b731edcde63a94f3f09adf2489ff837e0e3b9f7098
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMInstallerService.exe
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
            • Size 10.6MB
            • SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
            • Size 4.3MB
            • SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBVpnTunnelService.exe
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
            • Size 4.1MB
            • SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBVpnTunnel_mbtun.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
            • Size 4.2MB
            • SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MWACControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
            • Size 7.5MB
            • SHA256 de2dae4a12a73667b42dc5eaeb3789e03481d8797c0257e32eb86ed5e83c5e3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MwacLib.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll
            • Size 6.4MB
            • SHA256 a61d5bc48277514b50c53b59d6b9fd759461be710a9d94a0bcbdd4c97f4dc376
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PoliciesControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
            • Size 6.1MB
            • SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RTPControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
            • Size 6.4MB
            • SHA256 ca857f122db3d8d65e81969cefc3e9d42243e85f72a0567a369236b82ca0ee34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SPControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
            • Size 4.5MB
            • SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScanControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
            • Size 6.9MB
            • SHA256 f41c5a9754861fd06b05470a267fa9d6f801a0dce1834ad36aeec3212458841c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SelfProtectionSdk.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
            • Size 4.6MB
            • SHA256 fc37ffdcd7d89b95c6848677973c8dff654e4a65f3d067961144c92b6f71150e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SelfProtectionShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
            • Size 4.0MB
            • SHA256 49b3feefcda8c839dfd591a04ed73d7321db278f061d5d4735f1ff520bb78288
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ServiceConfig.json
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
            • Size 621B
            • SHA256 e7a90222df1f6088865cdedea3396d347af8e9b8186d05148643867bb4da1823
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ServiceConfig.json
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
            • Size 784B
            • SHA256 348da0d79daeb36456f042ec213217b6112d2d6bed7e98e60ba8243fe235273c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Swissarmy.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
            • Size 5.3MB
            • SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SwissarmyShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
            • Size 3.8MB
            • SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TelemetryControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
            • Size 7.3MB
            • SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UpdateControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
            • Size 4.5MB
            • SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VPNControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
            • Size 3.5MB
            • SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            arwlib.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\arwlib.dll
            • Size 7.2MB
            • SHA256 1ef6987ac94c4e77b5b756a54c5946ba0056d8bcdf0f4f05d114f2345e8917d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ig.exe
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
            • Size 1.8MB
            • SHA256 3bf6111de16dcbffbe696afefeac07e988cf884d1a2f85009762b7ac7b60ac18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbae-api-na.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll
            • Size 723KB
            • SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbcut.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbcut.dll
            • Size 4.2MB
            • SHA256 44497e517a18870547bd5e565e00822c5a3ddd8f24de88afc98b7b44d6af059f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbshlext.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
            • Size 3.1MB
            • SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
            • Size 2.8MB
            • SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
            • Size 1KB
            • SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            offreg.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
            • Size 140KB
            • SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pkgvers.dat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
            • Size 78B
            • SHA256 f7d7607cb371bed61da65ffa9aedbe871028cf65e66dd443033c50cdba3a42b1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            farflt11.cat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat
            • Size 11KB
            • SHA256 492b9a6cd8affe9d15353d7dd2d49e4fc7abf67b0275500263602607bca83fdb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            farflt11.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf
            • Size 3KB
            • SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            farflt11.sys
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys
            • Size 211KB
            • SHA256 3f59425564e9d5a3ca651c35688aabd433d95218b4c287d8b07c823f45ec8a90
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamchameleon.cat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
            • Size 11KB
            • SHA256 e4357437faec3b5de5d8089e3a92fe5640f5948a3a29971f12a7f764f4b77509
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamchameleon.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
            • Size 3KB
            • SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            7z.dll
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\7z.dll
            • Size 1.6MB
            • SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMService.exe
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\ctlrpkg\MBAMService.exe
            • Size 11.0MB
            • SHA256 10715f7321fcf50ee7a7cbdeb46035634c3aa4bf314cfd02a0aa1c16d34b0669
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMWsc.exe
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\ctlrpkg\MBAMWsc.exe
            • Size 4.2MB
            • SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Malwarebytes_Assistant.runtimeconfig.json
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
            • Size 559B
            • SHA256 ff0c15737963951550db7cc1bb116e49cb15c61bd93c61ac1861bd8e12efb61a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbae.sys
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\ctlrpkg\mbae.sys
            • Size 155KB
            • SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamelam.cat
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\ctlrpkg\mbamelam.cat
            • Size 11KB
            • SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamelam.inf
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\ctlrpkg\mbamelam.inf
            • Size 2KB
            • SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbamelam.sys
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\ctlrpkg\mbamelam.sys
            • Size 21KB
            • SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            srvversion.dat
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\ctlrpkg\srvversion.dat
            • Size 9B
            • SHA256 b3e9c3ae109bbe9c08500dc2caeee7ecb59dc2f0737baba2133306ecfa3e7fd3
            • MD5 SHA1 SHA512
            Submit Download

            MBAMCoreV5.dll
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\dbclspkg\MBAMCoreV5.dll
            • Size 8.7MB
            • SHA256 15ea0e58a63840c705681cd9bdd4024d347816f99e5bcce7194b475e27f040b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            .version
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_6641a2b6736d11f191d04ec30746bf4d\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
            • Size 50B
            • SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AeConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
            • Size 47KB
            • SHA256 091859bdf1c2dd0a838521343c7b01b4b4f3ffb724f6504a2c3aaf131abacc48
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AeConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
            • Size 66KB
            • SHA256 e709f21cecf8b1bf17dc956fb7938dd52e7143c4363eeb7e4d5f68f47aebe481
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ArwControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
            • Size 1KB
            • SHA256 c040fe30b19e4fa8f00e47a752cfcd214e781c458c4b24c4d8750e10b4da9a25
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LicenseConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
            • Size 12KB
            • SHA256 a7888ec936e7356634fc0e4b598dff36db6bc4a9e89e6cdeb7530e7983455651
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LicenseConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
            • Size 12KB
            • SHA256 e05b4433e5b6c4461b286713f902299cf63f9ce5407b8bafba1050556ec4d7c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MwacControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
            • Size 2KB
            • SHA256 a43ee5b50c02d51228f60412d20a7a7adc82edb75f3673babb4dc702082e91f9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MwacControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
            • Size 2KB
            • SHA256 bda229cb3307055b0051e6e64288aebf2e2c1365bdafce8d7b99f153ecda6adb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PoliciesConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
            • Size 814B
            • SHA256 8cee771584fc26e92ec6853c299ea52870e1371d4900701737b111195f12b5bb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RtpConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
            • Size 2KB
            • SHA256 a0a12ca760fc175794f882395d410322caf6c6a2814a9b17b13c200eb1421f48
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ScanConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
            • Size 5KB
            • SHA256 ae788c089fa7b0ca4b71bda107577737040fca89cf719aba701e441900ef6830
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScanConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
            • Size 8KB
            • SHA256 5e38fba52937ab96d6ca001acf88d22ba7200e5f02a5b2396a81a07eb0efb656
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 54d016ce7bf9a98ba8d29310e9ee288a99a0e7e245c287edf4f64d0bb6053850
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 97c2355ab4668cca234a8411e3f163a73d8cff571d0ecb952c2aa1136cf74d26
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 c4eb1b30390e42a88e9fbee2c6a0e5e74c4f1e27a73eb85a3da8e77eaf00a798
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UpdateControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
            • Size 1KB
            • SHA256 afd85890be90fdbe7b5e9ab40c9fd7044f4960e0ee14e7e85666ac989a5fed70
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UpdateControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
            • Size 1KB
            • SHA256 37f5f54b12ebb29d4d88ea9812c3b4c37c0b99f4035d2eeee3e04d19fd042654
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MBSetup.exe
            • Path C:\ProgramData\Malwarebytes\MBAMService\rmode\MBSetup.exe
            • Size 2.7MB
            • SHA256 0b9465643cd2609856e7ebdebc34296670a2b388c2bcf6e5ee0b59430c97bf41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbrescue.exe
            • Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
            • Size 7.7MB
            • SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 69KB
            • SHA256 3e47840f71d19a74e02f3cac01baa9cc7639a1724342f27fe066071a9136e90b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 69KB
            • SHA256 702ed5a6bfbd7eb8c411851d9c1da93e533df36b97e5bc17030b8dc9794ecb2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.inf_amd64_add82795013a7c3b.ini
            • Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
            • Size 409B
            • SHA256 51092d59a2053bddbfc05949232d9db84136dbbc71f9a4eec9a778787f9f4a05
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\catroot2\dberr.txt
            • Size 70KB
            • SHA256 d1776e803091aa9c0cfcb1c191e27ff84c55186610f6dd20b46ece5602d77998
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MbamChameleon.sys
            • Path C:\Windows\System32\drivers\MbamChameleon.sys
            • Size 230KB
            • SHA256 1d0c63d9d7328822fcbb5e06770270bc28aad0debc6e3bf77a89a8ce2d9b4bfa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamswissarmy.sys
            • Path C:\Windows\System32\drivers\mbamswissarmy.sys
            • Size 240KB
            • SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mb_errors999.log
            • Path C:\Windows\TEMP\mb_errors999.log
            • Size 429B
            • SHA256 81e2f0f96e7e10dd32baaea46b3b8dd03f3415dc33daa896b400f0f477094e4d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mb_EEBB.tmp
            • Path C:\Windows\Temp\mb_EEBB.tmp
            • Size 107KB
            • SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download