Overview

overview

8

Static

static

1

MBSetup-8.8.exe

windows10-2004-x64

8

MBSetup-8.8.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 19:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MBSetup-8.8.exe
  • Size 2.7MB
  • Sample260722-yjkdlstdkd
  • SHA256 0385b06957b7f5b2c3c7132f8ebd8414f64f00407ea2baf07acbffa8d6eca334
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Drops file in Drivers directory 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Sets service image path in registry 3 TTPs 4 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 50 IoCs
  • Loads dropped DLL 39 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 13 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MBSetup-8.8.exe
    "C:\Users\Admin\AppData\Local\Temp\MBSetup-8.8.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks BIOS information in registry
    • Downloads MZ/PE file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:2696
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
    1⤵
    • Drops file in Drivers directory
    • Impair Defenses: Safe Mode Boot
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      PID:6044
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Modifies registry class
      PID:5744
  • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Event Triggered Execution: Netsh Helper DLL
    PID:2344
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "00000000000000F0" "Service-0x0-3e7$\Default" "0000000000000114" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:4692
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
    1⤵
    • Executes dropped EXE
    PID:2456
  • C:\Windows\system32\DRIVERS\MbamElam.sys
    C:\Windows\system32\DRIVERS\MbamElam.sys
    1⤵
    • Executes dropped EXE
    PID:3060
  • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Checks BIOS information in registry
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5740
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4472
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5796
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5928
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4964
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3188
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2332
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4692
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5716
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4312
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5132
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3896
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3152
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1084
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1340
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4516
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4908
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2716
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5744
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4620
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4944
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1604
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2296
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2076
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5680
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5184
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4536
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:4884
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2452
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:952
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:1752
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:5976
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2456
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2792
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3224
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2024
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3484
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:2216
    • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
      ig.exe reseed
      2⤵
      • Executes dropped EXE
      PID:3324
    • C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
      "C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      PID:4828
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:1668
    • C:\Windows\system32\DRIVERS\mbamswissarmy.sys
      C:\Windows\system32\DRIVERS\mbamswissarmy.sys
      1⤵
      • Executes dropped EXE
      PID:4288
    • C:\Windows\system32\DRIVERS\MbamChameleon.sys
      C:\Windows\system32\DRIVERS\MbamChameleon.sys
      1⤵
      • Executes dropped EXE
      PID:3808
    • C:\Windows\system32\DRIVERS\farflt11.sys
      C:\Windows\system32\DRIVERS\farflt11.sys
      1⤵
      • Executes dropped EXE
      PID:2764
    • C:\Windows\system32\DRIVERS\mbam.sys
      C:\Windows\system32\DRIVERS\mbam.sys
      1⤵
      • Executes dropped EXE
      PID:2336

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Safe Mode Boot

          1
          T1562.009

          Modify Registry

          3
          T1112

          Subvert Trust Controls

          2
          T1553

          Install Root Certificate

          2
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          5
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Remote Services

          1
          T1021

          Remote Desktop Protocol

          1
          T1021.001

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          mbtun.cat
          • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
          • Size 10KB
          • SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbtun.sys
          • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
          • Size 107KB
          • SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
          • Size 1.6MB
          • SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AEControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
          • Size 4.9MB
          • SHA256 878239e138180492b8e703203db1eeda5da1a88b7897c16e7323bb506ef28dfe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Actions.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
          • Size 6.1MB
          • SHA256 f2dc3b02c39cc92b945ebffc0be675251e93de87158eaf47bfeb5c3231488173
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ActionsShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
          • Size 3.7MB
          • SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ArwControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
          • Size 5.6MB
          • SHA256 a1904889632fce5fece6dbecda5e237423d571652350f24c8724bdeb3a30228a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BrowserSDKDLL.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
          • Size 7.0MB
          • SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BrowserSDKDLLShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
          • Size 3.7MB
          • SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CleanControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
          • Size 8.7MB
          • SHA256 8404395da4f44f39236e8265593f52dcbbdcb7e37e129498d4c18b56dee6902e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CloudControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
          • Size 6.9MB
          • SHA256 c1af072bd24fe47e5f2cd71faa900c7a1dd16520d3735f9cc8df40d671b5e9b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LicenseControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
          • Size 7.1MB
          • SHA256 223dd68b4fc42d3451d7631a56bf261517e400da2b9536969b7eda80b28a0e93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBAMInstallerService.exe
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
          • Size 10.6MB
          • SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBAMShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
          • Size 4.3MB
          • SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBVpnTunnelService.exe
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
          • Size 4.1MB
          • SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBVpnTunnel_mbtun.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
          • Size 4.2MB
          • SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MWACControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
          • Size 7.6MB
          • SHA256 de1f0248c81a86c1498ec703d90c2b7edb7d863b39380ff21c1f19d3edbe7075
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MwacLib.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll
          • Size 6.4MB
          • SHA256 b7bd08efeb605825a6fbddfb86f467017d015c39b498b1abadce3a1c2b9aec77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PoliciesControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
          • Size 6.1MB
          • SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RTPControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
          • Size 6.4MB
          • SHA256 905e6da13fed3e931eb9180aa50b6f2058da73ec7e8c9735a6e03730de3f317c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SPControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
          • Size 4.5MB
          • SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScanControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
          • Size 6.9MB
          • SHA256 c247fc5913cdd73b37f6619b5e2019831635cac2786997e6e98965690b87d076
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SelfProtectionSdk.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
          • Size 4.6MB
          • SHA256 09b8ea52a6950390fa1f96720f0c7b4c527631b24d27466e5f9e5952701dbc0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SelfProtectionShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
          • Size 4.0MB
          • SHA256 ccb4ce36aa0887ed1017abd15b1019f31a8fe2c1afc55a6a063d94142d7483c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ServiceConfig.json
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
          • Size 621B
          • SHA256 256750a864f414305b74698826a08eac3d2e0230a254d0182021cea595b0ed4d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Swissarmy.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
          • Size 5.3MB
          • SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SwissarmyShim.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
          • Size 3.8MB
          • SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TelemetryControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
          • Size 7.3MB
          • SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
          • Size 4.5MB
          • SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VPNControllerImpl.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
          • Size 3.5MB
          • SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          arwlib.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\arwlib.dll
          • Size 7.2MB
          • SHA256 acc5508787ed40d3fd48c9428d3cbdb23ef9540ba4e9bcafc1e3c25e30fef526
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ig.exe
          • Path C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
          • Size 1.8MB
          • SHA256 f0a1eb806f31c9aaacb91b61816ebbd5e13d93e5653b1bfe2dff71159582bb30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbae-api-na.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll
          • Size 723KB
          • SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbcut.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\mbcut.dll
          • Size 4.2MB
          • SHA256 44497e517a18870547bd5e565e00822c5a3ddd8f24de88afc98b7b44d6af059f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbshlext.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
          • Size 3.1MB
          • SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbtun.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
          • Size 2.8MB
          • SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbtun.inf
          • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
          • Size 1KB
          • SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          offreg.dll
          • Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
          • Size 140KB
          • SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pkgvers.dat
          • Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
          • Size 78B
          • SHA256 d3ef34093a88f0e4002631817263fc7b04f87e1f29c0ceaaffd67574f4303db8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          farflt11.cat
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat
          • Size 10KB
          • SHA256 8b19e3ad46d594e099eded7fdb784c48a98d620675982204bc7250c471f1719f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          farflt11.inf
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf
          • Size 3KB
          • SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mbamchameleon.cat
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
          • Size 11KB
          • SHA256 45bfd887f1969f364ecca95f32a46354bb463864a697d631a14082eb213aa04a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbamchameleon.inf
          • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
          • Size 3KB
          • SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7z.dll
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\7z.dll
          • Size 1.6MB
          • SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBAMService.exe
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\ctlrpkg\MBAMService.exe
          • Size 11.0MB
          • SHA256 fd7a1428221fe7de747930cb3d9f2991610e2b1d809a0abc1f26590db5f5986c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MBAMWsc.exe
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\ctlrpkg\MBAMWsc.exe
          • Size 4.2MB
          • SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Malwarebytes_Assistant.runtimeconfig.json
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
          • Size 559B
          • SHA256 ff0c15737963951550db7cc1bb116e49cb15c61bd93c61ac1861bd8e12efb61a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mbae.sys
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\ctlrpkg\mbae.sys
          • Size 155KB
          • SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbamelam.cat
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\ctlrpkg\mbamelam.cat
          • Size 11KB
          • SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbamelam.inf
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\ctlrpkg\mbamelam.inf
          • Size 2KB
          • SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mbamelam.sys
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\ctlrpkg\mbamelam.sys
          • Size 21KB
          • SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          srvversion.dat
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\ctlrpkg\srvversion.dat
          • Size 9B
          • SHA256 68dd8af1181189786acc04862ebf835611e90ec74ff672fe75d2197ede49e9da
          • MD5 SHA1 SHA512
          Submit Download

          MBAMCoreV5.dll
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\dbclspkg\MBAMCoreV5.dll
          • Size 8.7MB
          • SHA256 b226e4e93acba45a3e6c0ee06d6fa1c62fac91ae37c86595ab395088ab9edbc4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .version
          • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_836dd528860611f1986e5ec22d2638fe\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
          • Size 50B
          • SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mbae-default.log
          • Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.log
          • Size 1KB
          • SHA256 0f5a4ab54b8e4da9d62626acc898201f262ba7ce5f01d616eb483396cee88694
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AeConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
          • Size 47KB
          • SHA256 e6111e93c822d37154625cdf050e12d2df49da837d1487973062aed57f3e1437
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AeConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
          • Size 66KB
          • SHA256 07e600d515723c196c1b322546175fbe75c67739040ad7d27553ec37782bb4f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ArwControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
          • Size 1KB
          • SHA256 ad8ef1de723ca2da2ed4617ba2bed2a79e5f1567d84d7a4ab92fdb0428bf3cd4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LicenseConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
          • Size 12KB
          • SHA256 0a5f37a8415239c9b3c7fc4a1a25e32c04a9a14c9a371ed05adbe1592064ce13
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LicenseConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
          • Size 12KB
          • SHA256 8e6a6b9a6a567b5cfe7e881100f7eda7df83dc0e343ee25f299805e36a130673
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MwacControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
          • Size 2KB
          • SHA256 2a4fa89ee739441a548f096d3cf93fea4c0473a4eb3321ffa34692ea0d48fdfc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MwacControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
          • Size 2KB
          • SHA256 1389ff07037a6ecead527946451401dcb80610a808faa7b24372398f87f05857
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PoliciesConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
          • Size 814B
          • SHA256 d18d6292017ef4f33ea1a265e50f412b5715c66306014e2a728fbd56efd202af
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RtpConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
          • Size 2KB
          • SHA256 9d7f0745423af9e93560a9ac84f9c099ff0dd27ceee25ba7d727ed3608b8f7f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScanConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
          • Size 5KB
          • SHA256 4990fd6b552cf9b22494f15b6b8596bb7ed2c9f561544cac919108fd354f5f28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScanConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
          • Size 8KB
          • SHA256 0e4ed273ef09ea55312ffff42cba9ef065f9b81f02221d74d26b6e0717ca1cf7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TelemCtrlConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
          • Size 1KB
          • SHA256 031582a3bacb7e075c7bead2596a3cdfe2e8cdc9f9a34ec901cdc8f792490b60
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TelemCtrlConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
          • Size 1KB
          • SHA256 a5b7a35bb9d84ee937a1669f4f1022574ee194be926b2b081aeeab2e1f238509
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TelemCtrlConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
          • Size 1KB
          • SHA256 394711c9b04fa687f73026eda391ecb6c323a695963fbfa466b49cc56968c478
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          UpdateControllerConfig.json
          • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
          • Size 1KB
          • SHA256 f5609df743edd4b6de98f0887766abd0c72fa864f285315f119471b8ec665167
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mbrescue.exe
          • Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
          • Size 7.7MB
          • SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 64KB
          • SHA256 ddde768c2be33d291139395dbe94782dc38816e96f66f17f5f1339022765b9cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 64KB
          • SHA256 522901e59d640ee5ba5cc77f139cfbf1ce4ad127255bc89b2c7ca74dbab0b078
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbtun.inf_amd64_add82795013a7c3b.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
          • Size 409B
          • SHA256 d4cbf14f5b0d879e1c0410a33d51e23857b6cb1067fa19caeb0d502941e7dbf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\catroot2\dberr.txt
          • Size 64KB
          • SHA256 ffc274843fa0f784c2ebb58b6490ad8ee732b9870de4159d87395e446caa8af5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MbamChameleon.sys
          • Path C:\Windows\System32\drivers\MbamChameleon.sys
          • Size 230KB
          • SHA256 a2f19edac47313a8d282ec88ff6da531d49ada37829328278be4b8d395819f0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          farflt11.sys
          • Path C:\Windows\System32\drivers\farflt11.sys
          • Size 211KB
          • SHA256 deab1165f6147404947248c5a7ad0a6be37a8b7dea3d764ce7c79ab871f9d940
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mbamswissarmy.sys
          • Path C:\Windows\System32\drivers\mbamswissarmy.sys
          • Size 240KB
          • SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mb_errors999.log
          • Path C:\Windows\TEMP\mb_errors999.log
          • Size 429B
          • SHA256 78ee33eda11fd286e592c35edaa62448fc900996677dc80b1a0e71c6c79be893
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mb_810.tmp
          • Path C:\Windows\Temp\mb_810.tmp
          • Size 107KB
          • SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download