Overview

overview

8

Static

static

1

MBSetup-3.3.exe

windows10-2004-x64

8

MBSetup-3.3.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 18:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MBSetup-3.3.exe
  • Size 2.7MB
  • Sample260705-wlpp1aew6x
  • SHA256 0385b06957b7f5b2c3c7132f8ebd8414f64f00407ea2baf07acbffa8d6eca334
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Drops file in Drivers directory 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Sets service image path in registry 3 TTPs 4 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 13 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 15 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MBSetup-3.3.exe
    "C:\Users\Admin\AppData\Local\Temp\MBSetup-3.3.exe"
    1⤵
    • Drops file in Drivers directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:1056
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
    1⤵
    • Drops file in Drivers directory
    • Impair Defenses: Safe Mode Boot
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1844
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Modifies registry class
      PID:3920
  • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Event Triggered Execution: Netsh Helper DLL
    PID:4088
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000174" "Service-0x0-3e7$\Default" "0000000000000188" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:1964
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
    1⤵
    • Executes dropped EXE
    PID:4392
  • C:\Windows\system32\DRIVERS\MbamElam.sys
    C:\Windows\system32\DRIVERS\MbamElam.sys
    1⤵
    • Executes dropped EXE
    PID:4648
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Checks BIOS information in registry
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
      "C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      PID:832
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5612
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2196
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4740
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2992
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:6024
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5380
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4216
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4144
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2152
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:1100
    • C:\Windows\system32\DRIVERS\mbamswissarmy.sys
      C:\Windows\system32\DRIVERS\mbamswissarmy.sys
      1⤵
      • Executes dropped EXE
      PID:5956
    • C:\Windows\system32\DRIVERS\MbamChameleon.sys
      C:\Windows\system32\DRIVERS\MbamChameleon.sys
      1⤵
      • Executes dropped EXE
      PID:4652
    • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
        2⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4784
    • C:\Windows\system32\DRIVERS\mbam.sys
      C:\Windows\system32\DRIVERS\mbam.sys
      1⤵
      • Executes dropped EXE
      PID:6116

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Safe Mode Boot

          1
          T1562.009

          Modify Registry

          3
          T1112

          Subvert Trust Controls

          2
          T1553

          Install Root Certificate

          2
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          6
          T1012

          System Information Discovery

          7
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Remote Services

          1
          T1021

          Remote Desktop Protocol

          1
          T1021.001

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          mbtun.cat
          • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
          • Size 10KB
          • SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbtun.sys
          • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
          • Size 107KB
          • SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
          • Size 1.6MB
          • SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AEControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
          • Size 4.9MB
          • SHA256 f15b0afd904825c8e653fb305bf5248571566a9d59aac9d3202aad549d746e1a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Actions.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
          • Size 6.1MB
          • SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ActionsShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
          • Size 3.7MB
          • SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ArwControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
          • Size 5.5MB
          • SHA256 4c0ed13fa8a08e2d8f7673ddf1efbf47721559de4b47d38de3346802a1272032
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BrowserSDKDLL.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
          • Size 7.0MB
          • SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BrowserSDKDLLShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
          • Size 3.7MB
          • SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CleanControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
          • Size 8.7MB
          • SHA256 d85916bd0b4ef3f1aa9abf108d0f6a9541b0ff690fe71af8fb90dd4139f411a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CloudControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
          • Size 6.9MB
          • SHA256 71b6312c8f6bd8e62c7f766ed56dea99f9daca0963039128ba11e4b6842b0922
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LicenseControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
          • Size 7.1MB
          • SHA256 14d0f6b8a3c404e7773458b731edcde63a94f3f09adf2489ff837e0e3b9f7098
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBAMInstallerService.exe
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
          • Size 10.6MB
          • SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBAMShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
          • Size 4.3MB
          • SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBVpnTunnelService.exe
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
          • Size 4.1MB
          • SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBVpnTunnel_mbtun.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
          • Size 4.2MB
          • SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MWACControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
          • Size 7.5MB
          • SHA256 de2dae4a12a73667b42dc5eaeb3789e03481d8797c0257e32eb86ed5e83c5e3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Malwarebytes.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.dll
          • Size 10.8MB
          • SHA256 7614667bd520d84f6f448e9e63d43e692705180391734f51d77222313d2e96f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Malwarebytes.exe
          • Path C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
          • Size 304KB
          • SHA256 6ee6ed189cb0fecfc628c6e74bce9b019d33b947d9c1e4d98a7f3cc58a933b30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PoliciesControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
          • Size 6.1MB
          • SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RTPControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
          • Size 6.4MB
          • SHA256 ca857f122db3d8d65e81969cefc3e9d42243e85f72a0567a369236b82ca0ee34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SPControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
          • Size 4.5MB
          • SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScanControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
          • Size 6.9MB
          • SHA256 f41c5a9754861fd06b05470a267fa9d6f801a0dce1834ad36aeec3212458841c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SelfProtectionSdk.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
          • Size 4.6MB
          • SHA256 fc37ffdcd7d89b95c6848677973c8dff654e4a65f3d067961144c92b6f71150e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SelfProtectionShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
          • Size 4.0MB
          • SHA256 49b3feefcda8c839dfd591a04ed73d7321db278f061d5d4735f1ff520bb78288
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ServiceConfig.json
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
          • Size 621B
          • SHA256 2613035bacb9ac4b9be05ed8351752bb02f1a2c91ac22a5ba4612e7f12f6cf99
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ServiceConfig.json
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
          • Size 784B
          • SHA256 2c00b9fe0ac334209b0ea9007a55f54166e581368d7d215df92a0ac7fcd70b79
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Swissarmy.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
          • Size 5.3MB
          • SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SwissarmyShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
          • Size 3.8MB
          • SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TelemetryControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
          • Size 7.3MB
          • SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
          • Size 4.5MB
          • SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VPNControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
          • Size 3.5MB
          • SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostfxr.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\hostfxr.dll
          • Size 391KB
          • SHA256 40ea98fad0d3455cb2842689c4ac97582f0de5fac00d09b26f526854c0910c89
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbshlext.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
          • Size 3.1MB
          • SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbtun.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
          • Size 2.8MB
          • SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbtun.inf
          • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
          • Size 1KB
          • SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          offreg.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
          • Size 140KB
          • SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pkgvers.dat
          • Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
          • Size 78B
          • SHA256 e3656a6dc99b6c4a5ed318c0c6b473f2ec6bf0f83936c7bdafe776cd0a871bfe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MBAMSwissArmy.cat
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
          • Size 11KB
          • SHA256 33dbca74f9364b66974d987b20505fd9298707f42fa8d2f636d8362e470b410e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBAMSwissArmy.inf
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
          • Size 2KB
          • SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MBAMSwissArmy.sys
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
          • Size 240KB
          • SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          farflt11.cat
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat
          • Size 11KB
          • SHA256 492b9a6cd8affe9d15353d7dd2d49e4fc7abf67b0275500263602607bca83fdb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          farflt11.inf
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf
          • Size 3KB
          • SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          farflt11.sys
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys
          • Size 211KB
          • SHA256 3f59425564e9d5a3ca651c35688aabd433d95218b4c287d8b07c823f45ec8a90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbamchameleon.cat
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
          • Size 11KB
          • SHA256 e4357437faec3b5de5d8089e3a92fe5640f5948a3a29971f12a7f764f4b77509
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbamchameleon.inf
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
          • Size 3KB
          • SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Private.CoreLib.dll
          • Size 15.4MB
          • SHA256 7aa6e90e2dce12c08ab8ccbab63d67c16cb68addf6b4a9d3d191753788f636cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          coreclr.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\coreclr.dll
          • Size 4.5MB
          • SHA256 599d0c0ca4739fb965c44b51a466ace34d5dfbb53b255ae9c5bca49713cdc8f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostpolicy.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\hostpolicy.dll
          • Size 390KB
          • SHA256 a1a4111aecfa597cfeae28e304e1faab5b74226ce4a25ee696345c2cdabd2a8c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PresentationFramework.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework.dll
          • Size 15.2MB
          • SHA256 4715cc17a523aa28f47e7ac5ecc1093d6d229a8d6e22e8e667e1604782e605e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.dll
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\7z.dll
          • Size 1.6MB
          • SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBAMService.exe
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\ctlrpkg\MBAMService.exe
          • Size 11.0MB
          • SHA256 10715f7321fcf50ee7a7cbdeb46035634c3aa4bf314cfd02a0aa1c16d34b0669
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBAMWsc.exe
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\ctlrpkg\MBAMWsc.exe
          • Size 4.2MB
          • SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Malwarebytes_Assistant.runtimeconfig.json
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
          • Size 559B
          • SHA256 ff0c15737963951550db7cc1bb116e49cb15c61bd93c61ac1861bd8e12efb61a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mbae.sys
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\ctlrpkg\mbae.sys
          • Size 155KB
          • SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbamelam.cat
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\ctlrpkg\mbamelam.cat
          • Size 11KB
          • SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbamelam.inf
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\ctlrpkg\mbamelam.inf
          • Size 2KB
          • SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mbamelam.sys
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\ctlrpkg\mbamelam.sys
          • Size 21KB
          • SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          srvversion.dat
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\ctlrpkg\srvversion.dat
          • Size 9B
          • SHA256 b3e9c3ae109bbe9c08500dc2caeee7ecb59dc2f0737baba2133306ecfa3e7fd3
          • MD5 SHA1 SHA512
          Submit Download

          MBAMCoreV5.dll
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\dbclspkg\MBAMCoreV5.dll
          • Size 8.7MB
          • SHA256 15ea0e58a63840c705681cd9bdd4024d347816f99e5bcce7194b475e27f040b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .version
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_86f0d5cf789b11f1bcf0fa1e86fc9412\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
          • Size 50B
          • SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mbae-default.log
          • Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.log
          • Size 1KB
          • SHA256 a4fcdb8557bc80b79dc2d79d2145f9af088076ed7e39de5fe9149e9d5c4c7b6b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AeConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
          • Size 47KB
          • SHA256 b0c5fcde8dbef927ef1e891b799d2a84775546cb3bc7e751bf7c74105e6c37ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AeConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
          • Size 66KB
          • SHA256 bc3a13452ed57af02b2ff9ef23a61f24dcffae8a8a77a126b749bd9798f0f10b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ArwControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
          • Size 1KB
          • SHA256 3587cbd109f0e97e2bb3e8e4f325bfcd4d1933de8aae4b45302665ef40815f46
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CleanControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
          • Size 948B
          • SHA256 624506468d73a7e3b8ce1640d09f28d8cd6d121dc7704685bf66fe8d5e062a5d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LicenseConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
          • Size 12KB
          • SHA256 070f4799d3fef091eb4a3357ebd88be833f07adef2da9ad8c08f1bd1ba728695
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LicenseConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
          • Size 12KB
          • SHA256 347d0d90428500e94fcee920ef5010a55934bce90796f1cfb2be036e9c43128d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LicenseConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
          • Size 12KB
          • SHA256 b1f85a0eab53720ccfb471e28b2bcffa5a6f8e4fa86fac0c4d3d923d2e1c01c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MwacControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
          • Size 2KB
          • SHA256 0763b5ab3184dc7ff596f3ccbdee2058430f21f1d504bf9e55b6e197ae17000a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MwacControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
          • Size 2KB
          • SHA256 e7acee45b6e6f9cbb21b3cdd6da3a6841998dfcf748605d44be79c070ed3a981
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RtpConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
          • Size 2KB
          • SHA256 fd2d673da35cdd2e293d696a77cf880fd42c42fe784b2e845fedf96895fde6df
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScanConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
          • Size 5KB
          • SHA256 d676abddec6876170b4282985e270f773cabf7337dc5b4a1274b3ff04dcdc41d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScanConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
          • Size 8KB
          • SHA256 6211a61fa663dc4519f1f9176afe9526e3c0d6211d5141aaa08b08ecc3886c41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SpConfigFile.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
          • Size 12KB
          • SHA256 20a333002b7f28ef4a4ae346d15fa7bb107431c00a67ab5008be1379f3684892
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TelemCtrlConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
          • Size 1KB
          • SHA256 17fe621dc8f29f48bb4a6a6bc74dda53b0b6e7eb45c734cc9b0f28ef281e8bb5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TelemCtrlConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
          • Size 1KB
          • SHA256 ab0e94333db93dfe5b784b7090775b9bd040431f028138c376ae7374f63ff427
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TelemCtrlConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
          • Size 1KB
          • SHA256 409b1fd15a3bb70a5a75d10fd6715f073f2b38f80044d2174624ea766177f55a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TelemCtrlConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
          • Size 1KB
          • SHA256 f0fe644e7e4c43c75ecc617385b00e46fc61e3d8073dd7c6d19d3f36bbd05e54
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TelemCtrlConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
          • Size 1KB
          • SHA256 d0bb04ee1ccd037ac385cb4add61b6c9b656764a56cf8a5a1fb55dfa14c316af
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          UI_IrisSettings.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json
          • Size 322KB
          • SHA256 e08c980abf4dd731ea65cda447578e5a71ed2ab079483254ec1c4f4b37f23c9e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
          • Size 1KB
          • SHA256 92c24ab8b2a8f59e99536591be2104a1643fbe667fa5fe88b076df89e856991d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          UpdateControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
          • Size 1KB
          • SHA256 8ef9091ab570db37ca3ca11b1bfe32061042c4e22d7bedf6ec1d0b9351d7d48c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          UpdateControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
          • Size 1KB
          • SHA256 092965c1a60f875d46bd832a50882f92cf520a58226cb419accba73ec5f4ec3e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MBSetup.exe
          • Path C:\ProgramData\Malwarebytes\MBAMService\rmode\MBSetup.exe
          • Size 2.7MB
          • SHA256 0b9465643cd2609856e7ebdebc34296670a2b388c2bcf6e5ee0b59430c97bf41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbrescue.exe
          • Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
          • Size 7.7MB
          • SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 69KB
          • SHA256 05ed6b2b780b4a0e57f39200dc7010cbc464a44ba5df4243bceceec17dfdb528
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 69KB
          • SHA256 bcab4253a0e14a7b540961cb40b632b70742c688cf989d05ef92a2ac9d6434c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbtun.inf_amd64_add82795013a7c3b.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
          • Size 409B
          • SHA256 1ffb0fbf0e169928ee6edde9cdbb93057bbef695b723a7e3c0d70c766077a0fb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\catroot2\dberr.txt
          • Size 69KB
          • SHA256 609700166365a15ee42bd37ee3f8b2da7acf868b2a32646a12bb2303001a665b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MbamChameleon.sys
          • Path C:\Windows\System32\drivers\MbamChameleon.sys
          • Size 230KB
          • SHA256 1d0c63d9d7328822fcbb5e06770270bc28aad0debc6e3bf77a89a8ce2d9b4bfa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mb_errors999.log
          • Path C:\Windows\TEMP\mb_errors999.log
          • Size 429B
          • SHA256 03156ac88c4e5743a41d54c5fb673dd7f7cb4a491de7c78ad3c81be8ae844948
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mb_D4FA.tmp
          • Path C:\Windows\Temp\mb_D4FA.tmp
          • Size 107KB
          • SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3512-2325-0x000001EFAD0E0000-0x000001EFAD7EC000-memory.dmp
          Download

          memory/3512-2663-0x000001EFAD0E0000-0x000001EFAD7EC000-memory.dmp
          Download

          memory/3512-2517-0x000001EFAD0E0000-0x000001EFAD7EC000-memory.dmp
          Download

          memory/3512-2944-0x000001EFAD0E0000-0x000001EFAD7EC000-memory.dmp
          Download