File name:

MBSetup.exe

Full analysis: https://app.any.run/tasks/06b55fea-8ec1-4dce-8e31-9278bba032cf
Verdict: Malicious activity
Analysis date: June 18, 2025, 23:08:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

43DC0BEE6E91D28D0E2D2A40664DC5EE

SHA1:

206F2B1B32692E684145A9AAC41317EA71FD1220

SHA256:

09F8B72EBED762DD7C8CEE790E339BE81ADA29DB13DD9F46FEAFD1428C40DA98

SSDEEP:

98304:ZdwSrm2PRD40cWI22IT1PD222222272TSRTP4WG5N0aFvGSSRkrlcfABLqI141X1:xX6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process verifies whether the antivirus software is installed

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • MBAMService.exe (PID: 2632)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 6896)

    • Reads the BIOS version

      • MBSetup.exe (PID: 1160)
      • MBAMService.exe (PID: 6896)

    • Searches for installed software

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)

    • Creates files in the driver directory

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Executes as Windows Service

      • MBAMInstallerService.exe (PID: 3956)
      • MBAMService.exe (PID: 6896)

    • Executable content was dropped or overwritten

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBAMService.exe (PID: 2632)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 6896)

    • Drops 7-zip archiver for unpacking

      • MBAMInstallerService.exe (PID: 3956)

    • Drops a system driver (possible attempt to evade defenses)

      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Adds/modifies Windows certificates

      • MBAMInstallerService.exe (PID: 3956)

    • The process creates files with name similar to system file names

      • MBAMInstallerService.exe (PID: 3956)

    • Process drops legitimate windows executable

      • MBAMInstallerService.exe (PID: 3956)

    • Changes Internet Explorer settings (feature browser emulation)

      • MBAMInstallerService.exe (PID: 3956)
      • MBAMService.exe (PID: 6896)

    • The process drops C-runtime libraries

      • MBAMInstallerService.exe (PID: 3956)

    • The process checks if it is being run in the virtual environment

      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Creates/Modifies COM task schedule object

      • MBAMService.exe (PID: 6896)

    • Reads security settings of Internet Explorer

      • MBAMService.exe (PID: 6896)

    • Creates or modifies Windows services

      • MBAMService.exe (PID: 2632)

  • INFO

    • The sample compiled with english language support

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBAMService.exe (PID: 6896)

    • Create files in a temporary directory

      • MBSetup.exe (PID: 1160)

    • Checks supported languages

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • MBAMService.exe (PID: 2632)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 6896)

    • Reads the machine GUID from the registry

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 6896)

    • Reads the computer name

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • drvinst.exe (PID: 2280)
      • MBAMService.exe (PID: 2632)
      • MBVpnTunnelService.exe (PID: 6756)
      • MBAMService.exe (PID: 6896)

    • Reads the software policy settings

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • slui.exe (PID: 6408)
      • drvinst.exe (PID: 2280)

    • Creates files in the program directory

      • MBSetup.exe (PID: 1160)
      • MBAMInstallerService.exe (PID: 3956)
      • MBVpnTunnelService.exe (PID: 6756)
      • MBAMService.exe (PID: 6896)

    • Checks proxy server information

      • MBSetup.exe (PID: 1160)
      • slui.exe (PID: 6408)

    • The sample compiled with spanish language support

      • MBAMInstallerService.exe (PID: 3956)

    • Reads CPU info

      • MBAMService.exe (PID: 6896)

    • Reads the time zone

      • MBAMService.exe (PID: 6896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:02 00:24:44+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.38
CodeSize: 799744
InitializedDataSize: 1980416
UninitializedDataSize: -
EntryPoint: 0x90685
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.3.1.129
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Malwarebytes
FileDescription: Malwarebytes Setup
FileVersion: 5.3.1.129
LegalCopyright: Copyright (C) 2017 - 2024 Malwarebytes, Inc. All rights reserved.
InternalName: MBSetup.exe
OriginalFileName: MBSetup.exe
ProductName: Malwarebytes
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mbsetup.exe mbaminstallerservice.exe slui.exe mbvpntunnelservice.exe conhost.exe no specs drvinst.exe mbamservice.exe mbamservice.exe mbsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1160"C:\Users\admin\AppData\Local\Temp\MBSetup.exe" C:\Users\admin\AppData\Local\Temp\MBSetup.exe
explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
HIGH
Description:
Malwarebytes Setup
Version:
5.3.1.129
Modules
Images
c:\users\admin\appdata\local\temp\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
2280DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "00000000000000E8" "Service-0x0-3e7$\Default" "00000000000001E4" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2632"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /ProtectedC:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
MBAMInstallerService.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
Malwarebytes Service
Exit code:
0
Version:
3.2.0.1413
Modules
Images
c:\program files\malwarebytes\anti-malware\mbamservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
3956"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
services.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
Malwarebytes Installer Service
Version:
5.1.0.210
Modules
Images
c:\program files\malwarebytes\anti-malware\mbaminstallerservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\authz.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\cryptbase.dll
5116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—MBVpnTunnelService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6408C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6756"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtunC:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
MBAMInstallerService.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
MBVpnTunnelService.exe
Exit code:
0
Version:
5.0.0.101
Modules
Images
c:\program files\malwarebytes\anti-malware\mbvpntunnelservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6892"C:\Users\admin\AppData\Local\Temp\MBSetup.exe" C:\Users\admin\AppData\Local\Temp\MBSetup.exe—explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
MEDIUM
Description:
Malwarebytes Setup
Exit code:
3221226540
Version:
5.3.1.129
Modules
Images
c:\users\admin\appdata\local\temp\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6896"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
services.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
Malwarebytes Service
Version:
3.2.0.1413
Modules
Images
c:\program files\malwarebytes\anti-malware\mbamservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
Total events
67 937
Read events
67 053
Write events
873
Delete events
11

Modification events

(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes
Operation:writeName:id
Value:
bb48ca731d354d3f9e82d9fed8d23f3c
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Malwarebytes
Operation:writeName:id
Value:
bb48ca731d354d3f9e82d9fed8d23f3c
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\mbamtestkey
Operation:delete keyName:(default)
Value:
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:UserName
Value:
admin
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductCode
Value:
MBAM-C
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductBuild
Value:
consumer
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProgramDirectory
Value:
C:\Program Files\Malwarebytes\Anti-Malware
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:LocalAppDataDir
Value:
C:\Users\admin\AppData\Local
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:Channel
Value:
release
(PID) Process:(1160) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:Installer
Value:
C:\Users\admin\AppData\Local\Temp\MBSetup.exe
Executable files
1 251
Suspicious files
168
Text files
46
Unknown types
1

Dropped files

PID
Process
Filename
Type
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\ctlrpkg.7z —
MD5:—
SHA256:—
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\dbclspkg.7z —
MD5:—
SHA256:—
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\dotnetpkg.7z —
MD5:—
SHA256:—
1160MBSetup.exeC:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeexecutable
MD5:C81029E817A7812FF9DE07A9460B1936
SHA256:62D826FC76A6F192ED7666404416A549794CEFCACD35E21C864F65409291CCD9
1160MBSetup.exeC:\Program Files (x86)\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\servicepkg\mbamelam.infbinary
MD5:5D8C05CC4F9B4304D57EA10B87F2DCF0
SHA256:E26C2D3347E5F077DA92713C9DF3CD3EAE438FB7E29810BD5C3AFE567D2D3125
1160MBSetup.exeC:\ProgramData\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\servicepkg.7zcompressed
MD5:6F605A7E0FE5A4115271F4024141881F
SHA256:6ED9E1D563EF152137D1AB9F9E6371127A3F135FDCEA2F7F6462D718C2CA3D29
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.jsonbinary
MD5:D94CF983FBA9AB1BB8A6CB3AD4A48F50
SHA256:1ECA0F0C70070AA83BB609E4B749B26DCB4409784326032726394722224A098A
3956MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp22f38b894c9911f090290ad5b0b82896\servicepkg\srvversion.dattext
MD5:35BC43D96E8BE3AF32020DD6B7CC3A68
SHA256:614BAE3C6BE7BB988DF1EE255A3A54D3BF5DBB786E1093C08594FD19B03D1FCD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
38
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5232
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5232
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1160
MBSetup.exe
52.26.150.127:443
api2.amplitude.com
AMAZON-02
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2292
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.142
whitelisted
api2.amplitude.com
  • 52.26.150.127
  • 44.237.235.194
  • 44.241.30.238
  • 54.187.120.60
  • 35.167.49.124
  • 35.80.255.234
  • 52.13.205.76
  • 44.242.0.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.65
  • 40.126.32.133
  • 20.190.160.3
  • 20.190.160.66
  • 40.126.32.136
  • 20.190.160.128
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
ark.mwbsys.com
  • 18.233.209.184
  • 54.146.252.215
  • 34.207.36.95
whitelisted
cdn.mwbsys.com
  • 65.9.95.85
  • 65.9.95.38
  • 65.9.95.78
  • 65.9.95.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MBSetup.exe