Overview

overview

10

Static

static

1

2026-07-31...at.exe

windows10-2004-x64

10

2026-07-31...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 08:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_fd8c36692bc17fd3e19e9a6c841395ac_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
  • Size 2.8MB
  • Sample260731-klb85aff42
  • SHA256 918a02c8513e819b011ea79ffb5f0a87ddcf1ab108a37efd5959c350fe0e68e4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables built or packed with MPress PE compressor 2 IoCs
  • Detects executables packed with ConfuserEx Mod 1 IoCs
  • Detects executables packed with Goliath 1 IoCs
  • Detects executables packed with Themida 1 IoCs
  • Drops file in Drivers directory 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Sets service image path in registry 3 TTPs 4 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 40 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 13 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:752
      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_fd8c36692bc17fd3e19e9a6c841395ac_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-07-31_fd8c36692bc17fd3e19e9a6c841395ac_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Drivers directory
        • Checks BIOS information in registry
        • Downloads MZ/PE file
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2600
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
      1⤵
      • Drops file in Drivers directory
      • Impair Defenses: Safe Mode Boot
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies trusted root certificate store through registry
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
        2⤵
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1664
      • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Modifies registry class
        PID:5664
    • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Event Triggered Execution: Netsh Helper DLL
      PID:1236
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000178" "Service-0x0-3e7$\Default" "0000000000000174" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3060
    • C:\Windows\system32\DRIVERS\MbamElam.sys
      C:\Windows\system32\DRIVERS\MbamElam.sys
      1⤵
      • Executes dropped EXE
      PID:1536
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
      1⤵
      • Executes dropped EXE
      PID:5836
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
      1⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Checks BIOS information in registry
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies trusted root certificate store through registry
      • Checks processor information in registry
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3964
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:5080
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:3488
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:4420
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:1004
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:5744
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:4964
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:5664
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:1500
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:3352
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:5616
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:4780
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:4904
      • C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
        "C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"
        2⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        PID:3704
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
      1⤵
        PID:3300
      • C:\Windows\system32\DRIVERS\MbamChameleon.sys
        C:\Windows\system32\DRIVERS\MbamChameleon.sys
        1⤵
        • Executes dropped EXE
        PID:1480
      • C:\Windows\system32\DRIVERS\mbam.sys
        C:\Windows\system32\DRIVERS\mbam.sys
        1⤵
        • Executes dropped EXE
        PID:4844

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Safe Mode Boot

            1
            T1562.009

            Modify Registry

            3
            T1112

            Subvert Trust Controls

            2
            T1553

            Install Root Certificate

            2
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            5
            T1012

            System Information Discovery

            5
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Remote Services

            1
            T1021

            Remote Desktop Protocol

            1
            T1021.001

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            mbtun.cat
            • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
            • Size 10KB
            • SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.sys
            • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
            • Size 107KB
            • SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
            • Size 1.6MB
            • SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AEControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
            • Size 4.9MB
            • SHA256 878239e138180492b8e703203db1eeda5da1a88b7897c16e7323bb506ef28dfe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Actions.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
            • Size 6.1MB
            • SHA256 f2dc3b02c39cc92b945ebffc0be675251e93de87158eaf47bfeb5c3231488173
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ActionsShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
            • Size 3.7MB
            • SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ArwControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
            • Size 5.6MB
            • SHA256 a1904889632fce5fece6dbecda5e237423d571652350f24c8724bdeb3a30228a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BrowserSDKDLL.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
            • Size 7.0MB
            • SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BrowserSDKDLLShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
            • Size 3.7MB
            • SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CleanControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
            • Size 8.7MB
            • SHA256 8404395da4f44f39236e8265593f52dcbbdcb7e37e129498d4c18b56dee6902e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CloudControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
            • Size 6.9MB
            • SHA256 c1af072bd24fe47e5f2cd71faa900c7a1dd16520d3735f9cc8df40d671b5e9b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LicenseControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
            • Size 7.1MB
            • SHA256 223dd68b4fc42d3451d7631a56bf261517e400da2b9536969b7eda80b28a0e93
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMInstallerService.exe
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
            • Size 10.6MB
            • SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
            • Size 4.3MB
            • SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBVpnTunnelService.exe
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
            • Size 4.1MB
            • SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBVpnTunnel_mbtun.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
            • Size 4.2MB
            • SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MWACControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
            • Size 7.6MB
            • SHA256 de1f0248c81a86c1498ec703d90c2b7edb7d863b39380ff21c1f19d3edbe7075
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MwacLib.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll
            • Size 6.4MB
            • SHA256 b7bd08efeb605825a6fbddfb86f467017d015c39b498b1abadce3a1c2b9aec77
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PoliciesControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
            • Size 6.1MB
            • SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RTPControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
            • Size 6.4MB
            • SHA256 905e6da13fed3e931eb9180aa50b6f2058da73ec7e8c9735a6e03730de3f317c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SPControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
            • Size 4.5MB
            • SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScanControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
            • Size 6.9MB
            • SHA256 c247fc5913cdd73b37f6619b5e2019831635cac2786997e6e98965690b87d076
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SelfProtectionSdk.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
            • Size 4.6MB
            • SHA256 09b8ea52a6950390fa1f96720f0c7b4c527631b24d27466e5f9e5952701dbc0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SelfProtectionShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
            • Size 4.0MB
            • SHA256 ccb4ce36aa0887ed1017abd15b1019f31a8fe2c1afc55a6a063d94142d7483c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ServiceConfig.json
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
            • Size 621B
            • SHA256 e981eeb7c0525be4fa4d1e42e5e626a02bf69c15d5262f7bee5ab0b79e275880
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Swissarmy.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
            • Size 5.3MB
            • SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SwissarmyShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
            • Size 3.8MB
            • SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TelemetryControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
            • Size 7.3MB
            • SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UpdateControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
            • Size 4.5MB
            • SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VPNControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
            • Size 3.5MB
            • SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            arwlib.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\arwlib.dll
            • Size 7.2MB
            • SHA256 acc5508787ed40d3fd48c9428d3cbdb23ef9540ba4e9bcafc1e3c25e30fef526
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ig.exe
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
            • Size 1.8MB
            • SHA256 f0a1eb806f31c9aaacb91b61816ebbd5e13d93e5653b1bfe2dff71159582bb30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbae-api-na.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll
            • Size 723KB
            • SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbcut.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbcut.dll
            • Size 4.2MB
            • SHA256 cc9b2f7379351f5cb246fcab1823962716c3b90dce252292f3c7fabf718a0c23
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbshlext.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
            • Size 3.1MB
            • SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
            • Size 2.8MB
            • SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
            • Size 1KB
            • SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            offreg.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
            • Size 140KB
            • SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pkgvers.dat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
            • Size 78B
            • SHA256 71b355216aa88df3afe1fa02a60da0ca75384f40e709c165368cc2707744d15e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MBAMSwissArmy.cat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
            • Size 11KB
            • SHA256 33dbca74f9364b66974d987b20505fd9298707f42fa8d2f636d8362e470b410e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMSwissArmy.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
            • Size 2KB
            • SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MBAMSwissArmy.sys
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
            • Size 240KB
            • SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            farflt11.cat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat
            • Size 10KB
            • SHA256 8b19e3ad46d594e099eded7fdb784c48a98d620675982204bc7250c471f1719f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            farflt11.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf
            • Size 3KB
            • SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            farflt11.sys
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys
            • Size 211KB
            • SHA256 deab1165f6147404947248c5a7ad0a6be37a8b7dea3d764ce7c79ab871f9d940
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamchameleon.cat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
            • Size 11KB
            • SHA256 45bfd887f1969f364ecca95f32a46354bb463864a697d631a14082eb213aa04a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamchameleon.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
            • Size 3KB
            • SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            7z.dll
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\7z.dll
            • Size 1.6MB
            • SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMService.exe
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\ctlrpkg\MBAMService.exe
            • Size 11.0MB
            • SHA256 fd7a1428221fe7de747930cb3d9f2991610e2b1d809a0abc1f26590db5f5986c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMWsc.exe
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\ctlrpkg\MBAMWsc.exe
            • Size 4.2MB
            • SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Malwarebytes_Assistant.runtimeconfig.json
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
            • Size 615B
            • SHA256 61fca252e8e336706f4c153c16100b7b621f9092ed09bb6959e406ab5bb21e85
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbae.sys
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\ctlrpkg\mbae.sys
            • Size 155KB
            • SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamelam.cat
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\ctlrpkg\mbamelam.cat
            • Size 11KB
            • SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamelam.inf
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\ctlrpkg\mbamelam.inf
            • Size 2KB
            • SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbamelam.sys
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\ctlrpkg\mbamelam.sys
            • Size 21KB
            • SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            srvversion.dat
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\ctlrpkg\srvversion.dat
            • Size 9B
            • SHA256 af0cac103fb816b5059d8775d63406a2f410a8ed70826978cddc6d88d8ddc668
            • MD5 SHA1 SHA512
            Submit Download

            MBAMCoreV5.dll
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\dbclspkg\MBAMCoreV5.dll
            • Size 8.7MB
            • SHA256 b226e4e93acba45a3e6c0ee06d6fa1c62fac91ae37c86595ab395088ab9edbc4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            .version
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_cce6d5fe8cbb11f193bd52abbeedcfd6\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
            • Size 50B
            • SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbae-default.log
            • Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.log
            • Size 1KB
            • SHA256 1f59380428dfa97a69cd6dd32477bf63cc813ceca3950182eeeffaab1ba2988d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AeConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
            • Size 47KB
            • SHA256 17dd55147abd332a15a21d1aba1e4b5e0b4ae25ed731ba156ced6fea918b7c0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AeConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
            • Size 66KB
            • SHA256 ba6e3a42b59edf91b456d91bf3debd01078723ad7884f4c9e18ba805629c2ce1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ArwControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
            • Size 1KB
            • SHA256 dc01e4bb5aee00dfea42dae02bdb80a34a50946412b170e5de2ad249efdfad00
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LicenseConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
            • Size 12KB
            • SHA256 b0422bb85f0090928f26f5b1deb6ccd925def6663474d12799b187b164735319
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LicenseConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
            • Size 12KB
            • SHA256 b8c5290a0f10ae6bc71c0cb58b71c2e0bdee356dcfd4dd7e73cc6dd178372222
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MwacControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
            • Size 2KB
            • SHA256 b8620b51665c1a46aa1d3e1f78e4c708c17277e7f8565a9bf8d3425ee2467866
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MwacControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
            • Size 2KB
            • SHA256 32535636e2ccf2ae834230fe575e1df0025ba9cc15ac0c2fb9c222932cb767b3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PoliciesConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
            • Size 814B
            • SHA256 41e6aba630335637651678c1772ec11c44f0d04d21e8a1c457e15e66b8361618
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RtpConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
            • Size 2KB
            • SHA256 6dd4250d43001539dad5d0b57b9b6d7b8946be6be0f5de92cef8cf0d6acb6cf6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ScanConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
            • Size 5KB
            • SHA256 b897c44f680b3d389b365049e772afc51be48df1eb4c973d6645537547de2fb0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScanConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
            • Size 8KB
            • SHA256 22060f1891877a77f11a345d9b1410096c80a7518b60242dea513c08b601fd0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SpConfigFile.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
            • Size 12KB
            • SHA256 bacd02fedb2af4029a42b9994547cb1a80ae1dfc95f280417fc6944d596af6bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 a05d9997f85ed360a9a6f6a8fa0d5574c82e0f6b693875bd446253b1a4772806
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 99141e3427c588f61255303e2b7357d04b105e394b4699bc674b4d219f87b2db
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 9986c77233df5438b4116be645873b1852216a04dec55a03acf1952d7b95f703
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UpdateControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
            • Size 1KB
            • SHA256 f23b474eb3e2fe94c7bb04bd8627a495de6513b9e98d35efdbb6b1171b708ff2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UpdateControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
            • Size 1KB
            • SHA256 5ebc2870b2485c4debbb7aab41e360d3e1c1febac633a152df852f3f383e5955
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbrescue.exe
            • Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
            • Size 7.7MB
            • SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 63KB
            • SHA256 2691785a0a7c666d99df4072655ca5284b1957b97955bb77045dc76016c05667
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 64KB
            • SHA256 fccdf132dc5e6592ccb9e272fcccd931853f3f454b8c7e390044dbb1416fa9c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.inf_amd64_add82795013a7c3b.ini
            • Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
            • Size 409B
            • SHA256 800ff69e330c42e1d2585cecb72bce63d13678f4f5526d9a7da108a61e414608
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\catroot2\dberr.txt
            • Size 64KB
            • SHA256 a06f6e09ee312fcf63680e912d6364de042d9e1799980ea2b9ee7d6fe4c887e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MbamChameleon.sys
            • Path C:\Windows\System32\drivers\MbamChameleon.sys
            • Size 230KB
            • SHA256 a2f19edac47313a8d282ec88ff6da531d49ada37829328278be4b8d395819f0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mb_errors999.log
            • Path C:\Windows\TEMP\mb_errors999.log
            • Size 429B
            • SHA256 91942c33f667586a61c9ad14b06e281c284cf916b6f8d74fbda32c6bc294930e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mb_3D0A.tmp
            • Path C:\Windows\Temp\mb_3D0A.tmp
            • Size 107KB
            • SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3964-2698-0x0000017156260000-0x00000171566CE000-memory.dmp
            Download

            memory/3964-2355-0x0000017156260000-0x00000171566CE000-memory.dmp
            Download