File name:

MBSetup.exe

Full analysis: https://app.any.run/tasks/06b55fea-8ec1-4dce-8e31-9278bba032cf
Verdict: Malicious activity
Analysis date: June 18, 2025, 23:08:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

43DC0BEE6E91D28D0E2D2A40664DC5EE

SHA1:

206F2B1B32692E684145A9AAC41317EA71FD1220

SHA256:

09F8B72EBED762DD7C8CEE790E339BE81ADA29DB13DD9F46FEAFD1428C40DA98

SSDEEP:

98304:ZdwSrm2PRD40cWI22IT1PD222222272TSRTP4WG5N0aFvGSSRkrlcfABLqI141X1:xX6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the BIOS version

      • MBSetup.exe (PID: 1160)
      • MBAMService.exe (PID: 6896)

    • Searches for installed software

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)

    • The process verifies whether the antivirus software is installed

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Creates files in the driver directory

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Executable content was dropped or overwritten

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Executes as Windows Service

      • MBAMInstallerService.exe (PID: 3956)
      • MBAMService.exe (PID: 6896)

    • Drops 7-zip archiver for unpacking

      • MBAMInstallerService.exe (PID: 3956)

    • Drops a system driver (possible attempt to evade defenses)

      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • The process creates files with name similar to system file names

      • MBAMInstallerService.exe (PID: 3956)

    • Process drops legitimate windows executable

      • MBAMInstallerService.exe (PID: 3956)

    • The process drops C-runtime libraries

      • MBAMInstallerService.exe (PID: 3956)

    • Changes Internet Explorer settings (feature browser emulation)

      • MBAMInstallerService.exe (PID: 3956)
      • MBAMService.exe (PID: 6896)

    • Adds/modifies Windows certificates

      • MBAMInstallerService.exe (PID: 3956)

    • The process checks if it is being run in the virtual environment

      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Creates/Modifies COM task schedule object

      • MBAMService.exe (PID: 6896)

    • Reads security settings of Internet Explorer

      • MBAMService.exe (PID: 6896)

    • Creates or modifies Windows services

      • MBAMService.exe (PID: 2632)

  • INFO

    • Create files in a temporary directory

      • MBSetup.exe (PID: 1160)

    • The sample compiled with english language support

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • drvinst.exe (PID: 2280)
      • MBVpnTunnelService.exe (PID: 6756)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Checks supported languages

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Reads the computer name

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Reads the machine GUID from the registry

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 6896)

    • Reads the software policy settings

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • slui.exe (PID: 6408)
      • drvinst.exe (PID: 2280)

    • Creates files in the program directory

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • MBAMService.exe (PID: 6896)

    • Checks proxy server information

      • MBSetup.exe (PID: 1160)
      • slui.exe (PID: 6408)

    • The sample compiled with spanish language support

      • MBAMInstallerService.exe (PID: 3956)

    • Reads the time zone

      • MBAMService.exe (PID: 6896)

    • Reads CPU info

      • MBAMService.exe (PID: 6896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:02 00:24:44+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.38
CodeSize: 799744
InitializedDataSize: 1980416
UninitializedDataSize: -
EntryPoint: 0x90685
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.3.1.129
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Malwarebytes
FileDescription: Malwarebytes Setup
FileVersion: 5.3.1.129
LegalCopyright: Copyright (C) 2017 - 2024 Malwarebytes, Inc. All rights reserved.
InternalName: MBSetup.exe
OriginalFileName: MBSetup.exe
ProductName: Malwarebytes
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mbsetup.exe mbaminstallerservice.exe slui.exe mbvpntunnelservice.exe conhost.exe no specs drvinst.exe mbamservice.exe mbamservice.exe mbsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1160"C:\Users\admin\AppData\Local\Temp\MBSetup.exe" C:\Users\admin\AppData\Local\Temp\MBSetup.exe
explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
HIGH
Description:
Malwarebytes Setup
Version:
5.3.1.129
Modules
Images
c:\users\admin\appdata\local\temp\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
2280DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "00000000000000E8" "Service-0x0-3e7$\Default" "00000000000001E4" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2632"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /ProtectedC:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
MBAMInstallerService.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
Malwarebytes Service
Exit code:
0
Version:
3.2.0.1413
Modules
Images
c:\program files\malwarebytes\anti-malware\mbamservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
3956"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
services.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
Malwarebytes Installer Service
Version:
5.1.0.210
Modules
Images
c:\program files\malwarebytes\anti-malware\mbaminstallerservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\authz.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\cryptbase.dll
5116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—MBVpnTunnelService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6408C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6756"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtunC:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
MBAMInstallerService.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
MBVpnTunnelService.exe
Exit code:
0
Version:
5.0.0.101
Modules
Images
c:\program files\malwarebytes\anti-malware\mbvpntunnelservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6892"C:\Users\admin\AppData\Local\Temp\MBSetup.exe" C:\Users\admin\AppData\Local\Temp\MBSetup.exe—explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
MEDIUM
Description:
Malwarebytes Setup
Exit code:
3221226540
Version:
5.3.1.129
Modules
Images
c:\users\admin\appdata\local\temp\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6896"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
services.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
Malwarebytes Service
Version:
3.2.0.1413
Modules
Images
c:\program files\malwarebytes\anti-malware\mbamservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
Total events
67 937
Read events
67 053
Write events
873
Delete events
11

Modification events

(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes
Operation:writeName:id
Value:
bb48ca731d354d3f9e82d9fed8d23f3c
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Malwarebytes
Operation:writeName:id
Value:
bb48ca731d354d3f9e82d9fed8d23f3c
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\mbamtestkey
Operation:delete keyName:(default)
Value:
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:UserName
Value:
admin
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductCode
Value:
MBAM-C
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductBuild
Value:
consumer
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProgramDirectory
Value:
C:\Program Files\Malwarebytes\Anti-Malware
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:LocalAppDataDir
Value:
C:\Users\admin\AppData\Local
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:Channel
Value:
release
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:Installer
Value:
C:\Users\admin\AppData\Local\Temp\MBSetup.exe
Executable files
1 251
Suspicious files
168
Text files
46
Unknown types
1

Dropped files

PID
Process
Filename
Type
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\ctlrpkg.7z —
MD5:—
SHA256:—
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\dbclspkg.7z —
MD5:—
SHA256:—
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\dotnetpkg.7z —
MD5:—
SHA256:—
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\ctlrpkg\Assistant.deps.jsonbinary
MD5:26D5540F2674A1E33722EAF225EF7591
SHA256:064A06E32F5A36F010A26737DEDEFD24CDBE5112FD08757B78449C3548447954
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\ctlrpkg\Malwarebytes.runtimeconfig.jsonbinary
MD5:EDAF04AFDA9B2C6D778D7042E7824A2F
SHA256:AE076CC42958355D8E061A4D3D020BED0EF3CD0C37C1851BDF84844503F9880C
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\ctlrpkg\mbamelam.catbinary
MD5:BD4CEAE54AF081D6B1DD91FF584C5D61
SHA256:C3C4967B05CD00C31CAFC39B57000EC2E82CCF2CA295C72365F5CF6E5D191034
1160MBSetup.exeC:\ProgramData\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\servicepkg.7zcompressed
MD5:6F605A7E0FE5A4115271F4024141881F
SHA256:6ED9E1D563EF152137D1AB9F9E6371127A3F135FDCEA2F7F6462D718C2CA3D29
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\ctlrpkg\Assistant.runtimeconfig.jsonbinary
MD5:D94CF983FBA9AB1BB8A6CB3AD4A48F50
SHA256:1ECA0F0C70070AA83BB609E4B749B26DCB4409784326032726394722224A098A
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\ctlrpkg\Malwarebytes_Assistant.deps.jsonbinary
MD5:0C0163F65B5457C15ABE97834ECA99D7
SHA256:426998F682589E0700286C17D7FDC33125CE6B4334DD2DFDC505A4F3CC3C33A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
38
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5232
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5232
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1160
MBSetup.exe
52.26.150.127:443
api2.amplitude.com
AMAZON-02
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2292
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.142
whitelisted
api2.amplitude.com
  • 52.26.150.127
  • 44.237.235.194
  • 44.241.30.238
  • 54.187.120.60
  • 35.167.49.124
  • 35.80.255.234
  • 52.13.205.76
  • 44.242.0.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.65
  • 40.126.32.133
  • 20.190.160.3
  • 20.190.160.66
  • 40.126.32.136
  • 20.190.160.128
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
ark.mwbsys.com
  • 18.233.209.184
  • 54.146.252.215
  • 34.207.36.95
whitelisted
cdn.mwbsys.com
  • 65.9.95.85
  • 65.9.95.38
  • 65.9.95.78
  • 65.9.95.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MBSetup.exe