Overview

overview

10

Static

static

1

2026-09-16...at.exe

windows10-2004-x64

10

2026-09-16...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 17:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-16_b6d8951ac9575981a88ee2ace857251d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
  • Size 2.8MB
  • Sample260916-wdyypsdr31
  • SHA256 34ff8a8822b1f4278cafa469cd77c7ff663494b613096decc5a5791e7b86a335
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables built or packed with MPress PE compressor 2 IoCs
  • Detects executables packed with ConfuserEx Mod 1 IoCs
  • Detects executables packed with Goliath 1 IoCs
  • Detects executables packed with Themida 1 IoCs
  • Drops file in Drivers directory 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Sets service image path in registry 3 TTPs 4 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 14 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:5080
      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b6d8951ac9575981a88ee2ace857251d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b6d8951ac9575981a88ee2ace857251d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Drivers directory
        • Checks BIOS information in registry
        • Downloads MZ/PE file
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3044
      • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
          "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5860
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
      1⤵
      • Drops file in Drivers directory
      • Impair Defenses: Safe Mode Boot
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies trusted root certificate store through registry
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1608
      • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
        "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
        2⤵
        • Drops file in Drivers directory
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Modifies registry class
        PID:3544
    • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Event Triggered Execution: Netsh Helper DLL
      PID:5900
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "00000000000000E0" "Service-0x0-3e7$\Default" "0000000000000194" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1684
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
      1⤵
      • Executes dropped EXE
      PID:5852
    • C:\Windows\system32\DRIVERS\MbamElam.sys
      C:\Windows\system32\DRIVERS\MbamElam.sys
      1⤵
      • Executes dropped EXE
      PID:2444
    • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
      1⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Checks BIOS information in registry
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies trusted root certificate store through registry
      • Checks processor information in registry
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5556
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:5044
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:2828
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:5036
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:2696
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:4148
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:5572
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:3336
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:4600
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:2240
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:2672
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:3048
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:4528
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:4108
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:1760
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:2168
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:1228
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:1396
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:3156
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:3876
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:3512
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:5564
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:4628
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:2272
      • C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
        ig.exe reseed
        2⤵
        • Executes dropped EXE
        PID:5684
      • C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
        "C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"
        2⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        PID:5368
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
      1⤵
        PID:5964
      • C:\Windows\system32\DRIVERS\mbamswissarmy.sys
        C:\Windows\system32\DRIVERS\mbamswissarmy.sys
        1⤵
        • Executes dropped EXE
        PID:3740
      • C:\Windows\system32\DRIVERS\MbamChameleon.sys
        C:\Windows\system32\DRIVERS\MbamChameleon.sys
        1⤵
        • Executes dropped EXE
        PID:1220
      • C:\Windows\system32\DRIVERS\mbam.sys
        C:\Windows\system32\DRIVERS\mbam.sys
        1⤵
        • Executes dropped EXE
        PID:960

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Safe Mode Boot

            1
            T1562.009

            Modify Registry

            3
            T1112

            Subvert Trust Controls

            2
            T1553

            Install Root Certificate

            2
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            5
            T1012

            System Information Discovery

            6
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Remote Services

            1
            T1021

            Remote Desktop Protocol

            1
            T1021.001

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            mbtun.cat
            • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
            • Size 10KB
            • SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.sys
            • Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
            • Size 107KB
            • SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
            • Size 1.6MB
            • SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AEControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
            • Size 4.9MB
            • SHA256 878239e138180492b8e703203db1eeda5da1a88b7897c16e7323bb506ef28dfe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Actions.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
            • Size 6.1MB
            • SHA256 f2dc3b02c39cc92b945ebffc0be675251e93de87158eaf47bfeb5c3231488173
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ActionsShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
            • Size 3.7MB
            • SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ArwControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
            • Size 5.6MB
            • SHA256 a1904889632fce5fece6dbecda5e237423d571652350f24c8724bdeb3a30228a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BrowserSDKDLL.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
            • Size 7.0MB
            • SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BrowserSDKDLLShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
            • Size 3.7MB
            • SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CleanControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
            • Size 8.7MB
            • SHA256 da31dae7f2286e8bd66a59e59380d597e406af8842ca33f04ef92b49806d9ee7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CloudControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
            • Size 6.9MB
            • SHA256 f2a57bc3f6cba22305bd8a16844d2e94c26813333155092596d7a9bd5b12e981
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LicenseControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
            • Size 7.1MB
            • SHA256 460df9e3357e6525b0960c708573772f0e89044c47aeb1c7c44ea72693c22b67
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMInstallerService.exe
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
            • Size 9.3MB
            • SHA256 5befd103ca4bf84732cc2fbf5b3a8638ce62df5730a8ffe5e72165a930cb65cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
            • Size 4.3MB
            • SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBVpnTunnelService.exe
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
            • Size 4.1MB
            • SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBVpnTunnel_mbtun.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
            • Size 4.2MB
            • SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MWACControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
            • Size 7.7MB
            • SHA256 6a566d33c8e8a2557056f522dca48f89078175a6bfba06e1d064c168fe1b3025
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MwacLib.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll
            • Size 6.5MB
            • SHA256 4c9ad5dc47f28beaa044ff285637c3ab7865b78af7d4f3388a2ff106b8e72c4f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PoliciesControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
            • Size 6.1MB
            • SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RTPControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
            • Size 6.4MB
            • SHA256 8fad4447c08ee8b9eeab6508754b264f92013f487c6dce6ae8337ae4de1a3483
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SPControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
            • Size 4.5MB
            • SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScanControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
            • Size 7.0MB
            • SHA256 6f012a9fdf1a27900205de7680d602d150d1a1f0e725b5d674eabcc0cf557822
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SelfProtectionSdk.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
            • Size 4.6MB
            • SHA256 09b8ea52a6950390fa1f96720f0c7b4c527631b24d27466e5f9e5952701dbc0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SelfProtectionShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
            • Size 4.0MB
            • SHA256 ccb4ce36aa0887ed1017abd15b1019f31a8fe2c1afc55a6a063d94142d7483c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ServiceConfig.json
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
            • Size 621B
            • SHA256 84d023249933c8bf40470f723d8862107041e79efc8e1d282f5707bcc106fe46
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Swissarmy.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
            • Size 5.3MB
            • SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SwissarmyShim.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
            • Size 3.8MB
            • SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TelemetryControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
            • Size 7.4MB
            • SHA256 f38d5b96f2184a5a9da4a7ebe2bf8f1c7c0474a608b7ddb47ae47c95dc1739f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UpdateControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
            • Size 4.5MB
            • SHA256 a5afbc290f4d9c9f2adb96c54af150459e871c990c5b9ff094e4b6c565a6d662
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VPNControllerImpl.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
            • Size 4.9MB
            • SHA256 44dedb891727c9196fe934890594c49c13c255c7b42b5102a98fea44a8d12f99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            arwlib.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\arwlib.dll
            • Size 7.2MB
            • SHA256 16f57da0a45e18b8a0bae9cccc78724bd1276c8ff35fbb52b9cb5a9b895efe0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ig.exe
            • Path C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
            • Size 1.8MB
            • SHA256 c3913062dc7cd67b009244db4acd7a265fc2116515adb7d7a4c77bfa50c44433
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbae-api-na.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll
            • Size 723KB
            • SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbcut.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbcut.dll
            • Size 4.2MB
            • SHA256 cc9b2f7379351f5cb246fcab1823962716c3b90dce252292f3c7fabf718a0c23
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbshlext.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
            • Size 3.1MB
            • SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
            • Size 2.8MB
            • SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
            • Size 1KB
            • SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            offreg.dll
            • Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
            • Size 140KB
            • SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pkgvers.dat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
            • Size 78B
            • SHA256 14fb27a6c7fe3ec52bbefc2b3ea835745a20026d2e93791296f998e26056784f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MBAMSwissArmy.cat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
            • Size 11KB
            • SHA256 33dbca74f9364b66974d987b20505fd9298707f42fa8d2f636d8362e470b410e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMSwissArmy.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
            • Size 2KB
            • SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MBAMSwissArmy.sys
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
            • Size 240KB
            • SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            farflt11.cat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat
            • Size 10KB
            • SHA256 52d1fd0bf9a978178fc7f4d117e6054e1f6cff6f891bea822a06647dc24d13b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            farflt11.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf
            • Size 3KB
            • SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            farflt11.sys
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys
            • Size 212KB
            • SHA256 7acb34e6c9ec95d6343b6cc51995226b30c51441d50122a739921f42bf580def
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamchameleon.cat
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
            • Size 11KB
            • SHA256 45bfd887f1969f364ecca95f32a46354bb463864a697d631a14082eb213aa04a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamchameleon.inf
            • Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
            • Size 3KB
            • SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            7z.dll
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\7z.dll
            • Size 1.6MB
            • SHA256 37fa780bc230081691a105a3c1aed525ceec10ac1e64c1d1867137ce75e1b668
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMService.exe
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\ctlrpkg\MBAMService.exe
            • Size 11.1MB
            • SHA256 8a639583e24e9ed319d69d08a4027ccbe4fc686e765e504fbc72b7d00c521d3b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MBAMWsc.exe
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\ctlrpkg\MBAMWsc.exe
            • Size 4.2MB
            • SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Malwarebytes_Assistant.runtimeconfig.json
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
            • Size 615B
            • SHA256 61fca252e8e336706f4c153c16100b7b621f9092ed09bb6959e406ab5bb21e85
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbae.sys
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\ctlrpkg\mbae.sys
            • Size 155KB
            • SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamelam.cat
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\ctlrpkg\mbamelam.cat
            • Size 11KB
            • SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbamelam.inf
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\ctlrpkg\mbamelam.inf
            • Size 2KB
            • SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbamelam.sys
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\ctlrpkg\mbamelam.sys
            • Size 21KB
            • SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            srvversion.dat
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\ctlrpkg\srvversion.dat
            • Size 9B
            • SHA256 ec8e44ee9b66014682911ed4d32bdc1ab3cdc2bb20ccc5591b2030ad32738f17
            • MD5 SHA1 SHA512
            Submit Download

            MBAMCoreV5.dll
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\dbclspkg\MBAMCoreV5.dll
            • Size 8.7MB
            • SHA256 5b35d150a5d2c693511760b49f906b4e8df6efecccf982a1ed7c92ab12d0181d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            .version
            • Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_f7c894f0b1f611f1a888f61ce478c80f\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
            • Size 50B
            • SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbae-default.log
            • Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.log
            • Size 1KB
            • SHA256 035aa008b9d3d4a6eadd3c6d0d9c2c887320ef62a5161f23e496f9e098e5ba73
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AeConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
            • Size 47KB
            • SHA256 c22987e4b30ae0265fdd2aa83c49ca03869e8c2fc001cb97703dc2bd90389b36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AeConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
            • Size 66KB
            • SHA256 87dbd2fd08c0b777c167e2fe81754cc882eebd728929e7ee9060cfa0584bee6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ArwControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
            • Size 1KB
            • SHA256 7e3ce6107c8de1affc1f462a59e4edca64bb633911f12598a0c4b06611e2d7c9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LicenseConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
            • Size 12KB
            • SHA256 10b891aca6018864e73dba4e4c8bd5e8724fb217ecfd32961a6c941b112e0b53
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LicenseConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
            • Size 12KB
            • SHA256 61c144aa658046bf30adb2316fa93757672c19d4821e2111069de30de74d271d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LicenseConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
            • Size 12KB
            • SHA256 12815a108fd0488c4f0ff379bcd992764affca3f05368f6c3def895e4b8f136a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MwacControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
            • Size 2KB
            • SHA256 4443d8ee7b535093ce1e56204dd58c9ddfa12eca0d201d7e9c7bf034a6c04f85
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PoliciesConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
            • Size 814B
            • SHA256 28f0bbc961c857f6f2627bc661bbd5be3ce2a6ba5b15c84f8a519b41dbf1e9e0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RtpConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
            • Size 2KB
            • SHA256 5f533a01b888fb2481311c24de0fea9db244a171c454704caa6f3493aca5578e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ScanConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
            • Size 5KB
            • SHA256 b5a690c636ffda1881d11311585743de29ce58d3f8141a1d71ac8e849506752a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScanConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
            • Size 8KB
            • SHA256 16ee5fd171c06da3264c29a4f0d432ad79699d81bc99c036c64b1b5ce57e1776
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SpConfigFile.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
            • Size 12KB
            • SHA256 92af5d7247329ee44a8adfc0d71b751fbddf80663e006b4986f6365a444fd99a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 e297fd7b63f23aabd398027b831782225e316141a646b19124fd3db88d072d6e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 c409764bf105991ab9f94a9f4402e5ceb45f1f1d76dc1f8dcee509986362b6f2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 8da77f85cefc93f6bff11f9ba80a920ff126fc6fe59bf249210494a1f57c6456
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TelemCtrlConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
            • Size 1KB
            • SHA256 80655ea63fd16253b6510ae3c976dcc1b11ec814547a07b5cc3baf0cafff9fef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UI_IrisSettings.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json
            • Size 3KB
            • SHA256 a992f1385058aae53f4df8d2bb1445f0c1596d6a083e1d526e133f95249bed25
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UpdateControllerConfig.json
            • Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
            • Size 1KB
            • SHA256 e2333bcbeb999195dc90b1b616725ab9c09dce048957266943b4ba26d21bf6b6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mbrescue.exe
            • Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
            • Size 7.7MB
            • SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 69KB
            • SHA256 a7a0626bc0a3adbfa7a6d5350737635f8f84b36458abc53bcb1a2a05b78a169b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 70KB
            • SHA256 b74415877a5d43e6586266241689357031c6bfbfb8538b3e5bd4f23217938ccb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mbtun.inf_amd64_add82795013a7c3b.ini
            • Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
            • Size 409B
            • SHA256 4dbb6e572cbbccf64c553870c06b2e65256e5d296c009a4532722c67f25e9dda
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\catroot2\dberr.txt
            • Size 70KB
            • SHA256 6c09584c63bce45b4cbb5d63106c4d162028c6a64fee41749b37b7e9bae256bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MbamChameleon.sys
            • Path C:\Windows\System32\drivers\MbamChameleon.sys
            • Size 230KB
            • SHA256 a2f19edac47313a8d282ec88ff6da531d49ada37829328278be4b8d395819f0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mb_errors999.log
            • Path C:\Windows\TEMP\mb_errors999.log
            • Size 429B
            • SHA256 ddd551f1363fe204892eff9dff2bd9289ed6d5a2344e2c324451bc5c6e5d6aac
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mb_A087.tmp
            • Path C:\Windows\Temp\mb_A087.tmp
            • Size 107KB
            • SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/5556-2676-0x0000019AEA380000-0x0000019AEAA93000-memory.dmp
            Download

            memory/5556-2738-0x0000019AEA380000-0x0000019AEAA93000-memory.dmp
            Download

            memory/5556-2320-0x0000019AEA380000-0x0000019AEAA93000-memory.dmp
            Download