Extracted

• • Target

    af6d44dfa7faec24f0cfd2da5d6afbf50c25d85c02af6dcd816c224d1198651b

  • Size

    556KB

  • MD5

    66c4a1199972a1712996ef9c09048124

  • SHA1

    9a7a183e8be933d5b10512a00d21a94499cb5116

  • SHA256

    af6d44dfa7faec24f0cfd2da5d6afbf50c25d85c02af6dcd816c224d1198651b

  • SHA512

    ca5e2ab7b4977e310912bc874fdbe500bdac53cf3f2fe94cfd3ada1f2e7cb77393751ec51707e4675869979633179483204ff91caba56f1ef2974754f350bc8f

  Score

  9^/10

  collectionpersistence

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Sets file execution options in registry

    persistence

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2