Endpoint Agent Windows system components – Malwarebytes Business Support

The Malwarebytes Endpoint Agent installs and uses the following components to provide functionality on a Windows endpoint. Some components only exist if the associated feature, capability, or plugin is enabled in the policy assigned to the endpoint.

Directories
Services
Drivers
Processes
Plugins

Directories

The following directories contain files utilized by the Malwarebytes Endpoint Agent and its plugins on a Windows endpoint:

Path	Description
C:\Program Files\Malwarebytes Endpoint Agent	Application files for the Malwarebytes Endpoint Agent and component plugins.
C:\Program Files\Malwarebytes\Anti-Malware	Application files used by Malwarebytes Endpoint Protection and Malwarebytes Incident Response.
C:\ProgramData\Malwarebytes Endpoint Agent	Global application data store for the Malwarebytes Endpoint Agent and component plugins.
C:\ProgramData\Malwarebytes\MBAMInstallerService	Global application data store for the Malwarebytes Installer Service.
C:\ProgramData\Malwarebytes\MBAMService	Global application data store for the Malwarebytes Endpoint Protection and Malwarebytes Incident Response.

Services

The following table lists the Malwarebytes services that run on a Windows endpoint:

Service Name	Process Path	Description
MBEndpointAgent	C:\Program Files\Malwarebytes Endpoint Agent\MBCloudEA.exe	The Malwarebytes Endpoint Agent Service provides the Endpoint Agent Engine, plugin framework, and communication to Malwarebytes Nebula.
EAServiceMonitor	C:\Program Files\Malwarebytes Endpoint Agent\ServiceMonitor\EAServiceMonitor.exe	The Malwarebytes Endpoint Agent Service Monitor checks the health of the Malwarebytes Endpoint Agent and provides recovery if needed.
dnscrypt-proxy	C:\Program Files\Malwarebytes Endpoint Agent\Services\DNSProxy\dnscrypt-proxy.exe	The DNSCrypt Proxy Service provides a proxy Server that sends DNS requests using DNS over HTTPS for Malwarebytes DNS Filtering.
MBAMService	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	The Malwarebytes Service provides the protection layers and scanning engine of Malwarebytes Endpoint Protection and Malwarebytes Incident Response.
MBAMInstallerService	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	The Malwarebytes Installer Service provides installation functionality for new versions of Malwarebytes Endpoint Protection.

Drivers

The following table lists the Malwarebytes drivers that run on a Windows endpoint:

Service Name	Image Path	Description
MBAMChameleon	C:\windows\system32\drivers\MbamChameleon.sys	The Malwarebytes Self-Protection Driver provides Malwarebytes product protection and Device Control functionality.
MBAMElam	C:\windows\system32\drivers\MbamElam.sys	The Malwarebytes Early-Launch Anti-Malware Driver (ELAM) provides Windows ELAM functionality.
MBAMFarflt	C:\windows\system32\drivers\farflt.sys	The Malwarebytes Anti-Ransomware Driver provides ransomware behavior protection.
MBAMProtection	C:\windows\system32\drivers\mbam.sys	The Malwarebytes Real-Time Protection Driver provides real-time threat protection
MBAMSwissArmy	C:\windows\system32\drivers\mbamswissarmy.sys	The Malwarebytes Swiss Army Driver provides specialized threat detection and remediation functionality for rootkits and other similar malware.
MBAMWebProtection	C:\windows\system32\drivers\mwac.sys	The Malwarebytes Web Access Control Driver provides malicious web traffic protection.
ESProtectionDriver	C:\windows\system32\drivers\mbae64.sys C:\windows\system32\drivers\mbae.sys	The Malwarebytes Anti-Exploit Driver provides exploit behavior protection.
FlightRecorder	C:\windows\system32\drivers\FlightRecorder.sys	The Malwarebytes Flight Recorder provides Suspicious Activity Monitoring, Ransomware Rollback, Endpoint Isolation, and Active Response Shell functionality
mbdnsfilter	C:\windows\system32\drivers\mbdnsfilter.sys	The Malwarebytes DNS Filter Driver provides Malwarebytes DNS Filtering functionality.

Processes

The following table lists the common Malwarebytes processes that run on a Windows endpoint:

Path	Description
C:\Program Files\Malwarebytes Endpoint Agent\ConfigurationRecoveryTool.exe	The utility for recovering a corrupted Endpoint Agent Configuration file.
C:\Program Files\Malwarebytes Endpoint Agent\MBCloudEA.exe	Provides the Malwarebytes Endpoint Agent Service, Endpoint Agent Engine, plugin framework, and communication to Malwarebytes Nebula.
C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Active Response Shell\x64\ARSLauncher.exe C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Active Response Shell\Win32\ARSLauncher.exe	Provides Active Response Shell functionality.
C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Active Response Shell\x64\Timeliner.exe C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Active Response Shell\Win32\Timeliner.exe	Provides access to Malwarebytes Forensic Timeliner capabilities in Active Response Shell.
C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Asset Manager\Malwarebytes.AssetPro.Launcher.exe	Hosts and executes the OPSWAT OESIS SDK for performing advanced asset scans, installing 3rd party software updates, and applying operating system patches.
C:\Program Files\Malwarebytes Endpoint Agent\ServiceMonitor\EAServiceMonitor.exe	Provides the Malwarebytes Endpoint Agent Service Monitor Service.
C:\Program Files\Malwarebytes Endpoint Agent\Services\AssetPro\native\wa_3rd_party_host_64.exe C:\Program Files\Malwarebytes Endpoint Agent\Services\AssetPro\native\wa_3rd_party_host_32.exe	The host process for the OPSWAT OESIS SDK used by Malwarebytes Vulnerability Assessment and Patch Management.
C:\Program Files\Malwarebytes Endpoint Agent\Services\DNSProxy\dnscrypt-proxy.exe	The proxy Server that sends DNS requests using DNS over HTTPS for Malwarebytes DNS Filtering functionality.
C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\EACmd.exe	The command-line utility for managing specific tasks of the Malwarebytes Endpoint Agent.
C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\Endpoint Agent Tray.exe	Provides the Malwarebytes Endpoint Agent Tray.
C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe	Provides functionality for Malwarebytes Real-Time Protection.
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Provides the Malwarebytes Service process and the protection layers and scanning engine of Malwarebytes Endpoint Protection and Malwarebytes Incident Response.
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe	Provides Malwarebytes products with functionality to interact with Windows Security Center.
C:\Program Files\Malwarebytes\Anti-Malware\ig.exe	Provides Malwarebytes Endpoint Protection and Incident Response with advanced threat detection and remediation capabilities.
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Provides the Malwarebytes Installer Service and installation functionality for new versions of Malwarebytes Endpoint Protection and Malwarebytes Incident Response.

Plugins

The following table lists the Malwarebytes plugins and their associated DLL file on a Windows endpoint:

Name	Path	Description
Asset Manager	C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Asset Manager\EAAssetMgmtPlugin.dll	Enables the Malwarebytes Asset Manager for hardware and software asset inventory
Asset Manager Pro	C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Asset Manager\Malwarebytes.AssetPro.dll	Enables the Malwarebytes Asset Manager Pro and the OPSWAT OESIS SDK for Vulnerability Assessment and Patch Management features
Endpoint Protection (EP, MBAM Plugin, NCEP Plugin)	C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Endpoint Protection\EAMBAMPlugin.dll	Enables the following features: Malwarebytes Endpoint Protection: On-demand threat scanning Real Time Protection Malware Protection Ransomware Protection Exploit Protection Web Protection Malwarebytes Incident Response: On-demand threat scanning Malwarebytes Device Control for removable storage devices
DNS Content Filtering	C:\Program Files\Malwarebytes Endpoint Agent\Plugins\DNS Content Filtering\DNSFilterPlugin.dll	Enables the Malwarebytes DNS Filtering feature powered by Cloudflare.
Endpoint Detection and Response (EDR)	C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Endpoint Detection and Response\EDRPlugin.dll	Enables the following EDR features: Suspicious Activity Monitoring Ransomware Rollback Endpoint Isolation Active Response Shell
Active Response Shell (ARS)	C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Active Response Shell\ARSPlugin.dll	Enables the following Malwarebytes Active Response Shell features in EDR: Active Response Shell Malwarebytes Forensic Timeliner
Windows Remote Intrusion Detection and Prevention / Brute Force Protection (BFP)	C:\Program Files\Malwarebytes Endpoint Agent\Plugins\Windows Remote Intrusion Detection and Prevention\BFPPlugin.dll	Enables Malwarebytes Brute Force Protection to prevent brute force attacks over common remote communication protocols.

For information on system components for other operating systems, see the links below:

Directories

Services

Drivers

Processes

Plugins

Related articles