File name:

MBSetup.exe

Full analysis: https://app.any.run/tasks/5d273440-d3c8-42c2-8ca2-7d167cafc512
Verdict: Malicious activity
Analysis date: August 01, 2025, 16:19:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

4A4EF66B72BF03675DE07043894C2882

SHA1:

C54FB0858F6F3E845A5ACDD32BC1845B714F7F38

SHA256:

B33C43AA476315E94E54F5CAD1B8A225A2655EBB7AEE8CABB3F9CB5AFCD8D8C7

SSDEEP:

98304:DfwSrm2PRD40cWV22IT1PD222222272TSRTP4WG5N0aFvGSSRkrlcfABLqI141Xy:yXV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the BIOS version

      • MBSetup.exe (PID: 6508)

    • Searches for installed software

      • MBSetup.exe (PID: 6508)

    • Creates files in the driver directory

      • MBSetup.exe (PID: 6508)

    • The process verifies whether the antivirus software is installed

      • MBSetup.exe (PID: 6508)

  • INFO

    • Create files in a temporary directory

      • MBSetup.exe (PID: 6508)

    • The sample compiled with english language support

      • MBSetup.exe (PID: 6508)

    • Reads the computer name

      • MBSetup.exe (PID: 6508)

    • Reads the machine GUID from the registry

      • MBSetup.exe (PID: 6508)

    • Creates files in the program directory

      • MBSetup.exe (PID: 6508)

    • Checks supported languages

      • MBSetup.exe (PID: 6508)

    • Reads the software policy settings

      • MBSetup.exe (PID: 6508)
      • slui.exe (PID: 5992)

    • Checks proxy server information

      • MBSetup.exe (PID: 6508)
      • slui.exe (PID: 5992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:07:22 16:25:47+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.38
CodeSize: 799744
InitializedDataSize: 1980416
UninitializedDataSize: -
EntryPoint: 0x90685
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.3.5.130
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Malwarebytes
FileDescription: Malwarebytes Setup
FileVersion: 5.3.5.130
LegalCopyright: Copyright (C) 2017 - 2024 Malwarebytes, Inc. All rights reserved.
InternalName: MBSetup.exe
OriginalFileName: MBSetup.exe
ProductName: Malwarebytes
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mbsetup.exe slui.exe mbsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5436"C:\Users\admin\Desktop\MBSetup.exe" C:\Users\admin\Desktop\MBSetup.exe—explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
MEDIUM
Description:
Malwarebytes Setup
Exit code:
3221226540
Version:
5.3.5.130
Modules
Images
c:\users\admin\desktop\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5992C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6508"C:\Users\admin\Desktop\MBSetup.exe" C:\Users\admin\Desktop\MBSetup.exe
explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
HIGH
Description:
Malwarebytes Setup
Exit code:
9
Version:
5.3.5.130
Modules
Images
c:\users\admin\desktop\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
Total events
7 088
Read events
7 085
Write events
2
Delete events
1

Modification events

(PID) Process:(6508) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes
Operation:writeName:id
Value:
f42a318c34ef4a4aba8d9fc6ed665bb0
(PID) Process:(6508) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Malwarebytes
Operation:writeName:id
Value:
f42a318c34ef4a4aba8d9fc6ed665bb0
(PID) Process:(6508) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\mbamtestkey
Operation:delete keyName:(default)
Value:
Executable files
0
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6508MBSetup.exeC:\ProgramData\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
6508MBSetup.exeC:\Program Files (x86)\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
6508MBSetup.exeC:\Windows\SysWOW64\drivers\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
6508MBSetup.exeC:\Users\admin\AppData\Local\Temp\mbsetup.logtext
MD5:EB3A3868BCAA517A278F32649883F337
SHA256:AE31C073D1886E5CF0D958B358D5E0B802161D5C7B83D061A1215F394F503A6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
34
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1040
RUXIMICS.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
—
—
POST
200
44.241.255.42:443
https://api2.amplitude.com/batch
US
binary
92 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
72.246.29.11:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
1040
RUXIMICS.exe
GET
200
72.246.29.11:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
—
—
GET
302
192.0.66.233:443
https://ark.mwbsys.com/mbam-c.isvc.64bitv5/release
US
—
—
unknown
1268
svchost.exe
GET
200
72.246.29.11:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
—
—
GET
—
13.35.58.13:443
https://cdn.mwbsys.com/packages/mbam-c.isvc.64bitv5/c/8/1/0/c81029e817a7812ff9de07a9460b1936/b1d48e54-9c1f-4eb2-842b-e7293e0fc39a.exe
US
—
—
unknown
—
—
GET
302
192.0.66.233:443
https://ark.mwbsys.com/mbam-c.isvc.64bitv5/release
US
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1040
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6508
MBSetup.exe
35.166.105.128:443
api2.amplitude.com
AMAZON-02
US
whitelisted
1040
RUXIMICS.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1040
RUXIMICS.exe
72.246.29.11:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
api2.amplitude.com
  • 35.166.105.128
  • 35.81.65.217
  • 44.230.154.115
  • 52.13.83.247
  • 35.81.242.93
  • 44.241.255.42
  • 52.89.59.154
  • 52.27.199.98
  • 44.233.158.233
  • 44.236.48.143
  • 54.69.88.53
  • 52.34.79.32
  • 44.226.235.191
  • 54.70.129.147
  • 52.39.135.76
  • 35.82.10.212
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.14
whitelisted
www.microsoft.com
  • 72.246.29.11
whitelisted
ark.mwbsys.com
  • 18.204.61.124
  • 52.0.150.92
  • 52.2.220.174
whitelisted
cdn.mwbsys.com
  • 13.35.58.84
  • 13.35.58.113
  • 13.35.58.13
  • 13.35.58.106
whitelisted
self.events.data.microsoft.com
  • 51.11.192.50
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MBSetup.exe