Setup[.]exe | Triage™

Setup.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 cf2cb87ad7efe52b506124b259832d0e074deb3a77cff29a9dce8d4d7521e8b7
MD5 9feb3e2d8e0a1c5371348206ea32863c
SHA1 e7f23674c3167b07bba2b3188fa74a366def7834
SHA512 3823a6e4e8cdb983fe1774f933567ea01c4d424c0773ee6a66bc6644569ffca74899c96785a7801a468018fe42ad772f521d4dd3f76b946dcadcd9d4933acd84
SSDEEP 24576:a0aOhu3LZOzTCEbNs0UB+LQcHKMzqvaoXhg443tqasJ:aJ3IzTCEbN/q+L9TWaYhn430J
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

5b:5f:0f:b0:0e:9a:5a:ae:bb:99:60:08:1a:c9:c3:73:a8:3e:9b:d4:b3:d8:fe:05:fe:6e:e0:db:c6:c2:df:fe:df:6e:e9:5e:63:84:bb:38:6d:9a:79:7d:ca:fc:36:fd:8f:b5:4a:84:45:a0:de:8c:63:54:9c:7e:e0:14:f6:00

Digest Algorithm

sha512

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=14843353,CN=BrowserWorks Ltd,O=BrowserWorks Ltd,STREET=153-157 Cleveland Street,L=London,ST=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 22, 2025

Minor OS version

0

Major OS version

5

Entry point

13289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/Approximately.wmv

SHA256 45c993297505d2ae618b38530831846e82c6aeab83be089fcff631db46d97396
MD5 caaa4f6ac927a62ec92513abb8546213
SHA1 ad26c447a129937409402e7c68f3f72e80a3b94c
SHA512 185e24b5e4956d2ab25d0d7e19342a53d0a3492ccc09a1298f36676a827a24373273765fe7dccd0148524bd1353730f84e1ac93abd4b37c0d5f578b81d9a8474
SSDEEP 1536:oN8RkwetqJI8GrXy2cGKC/jbF56tid/YV1P1KSCcMJ4TS/yRZ:W8ujWArXy2pKs/hBYPtKBJ4TS/yRZ
MD5 SHA1 SHA512 SSDEEP

$TEMP/Counts.wmv

SHA256 ae328c994a2d8f5816a111c1100047fa6fc3c2b4fe75a447191f382ef186a8c6
MD5 ab70a1632256046f01f3748512b43311
SHA1 cc350aacdd54cf74795a926a4cd1c414001ae0a1
SHA512 dfddade99bd0da287c0e7febfb9e0eb7bbf29f8e99e44dbffae7ab898d75c39c2c7e4fc378cd61723a3d11fd86dd27896260da0fd4adaee327214f1b0bff05c8
SSDEEP 1536:UhmVVYjkkDmn7YzZ1i+d+tnI18cLs+U1KNVNcnpDMk:UhmVCjkkDNzRotn6fgOjqL
MD5 SHA1 SHA512 SSDEEP

$TEMP/Epinions.wmv

SHA256 a55b1555e714b1babab8f9702bdfc1826e7a5dd641520108b8f9c3e149b9a83b
MD5 3cd4d802b3adbe4c32e0066cd2e87ac5
SHA1 02e17ea5362a4a8dd6a28bb78ca065d95338fff7
SHA512 50b04c7efaede3cf3f92c6545de7921477fe463770b06fc03142847d4d9e13eedcb559a4f075d30da3144d0f2c049d697dc4249d4ffce5d6ff6467804ad7aeb0
SSDEEP 12288:6HeezblnEfiH2YGzN1U06djX1MH5JzzMx7X36uGY5:6HeqhE6WBI06FXaH5925j5
MD5 SHA1 SHA512 SSDEEP

Adware

SHA256 0557971ee400e9c77ec2abfd9c14e2ff79dd8ea2ff27ee2a5d01f2a0edd1661f
MD5 39870986621d72f9403bb05dbc4b47f0
SHA1 335fb6a9b99c03c5b2282e9138e8451311123083
SHA512 8f7797ddb5210dc96892ccebfdf23949ff0ce7ebfebc6a32e9c6de77841760b19886b1a1522beb43bb4946fe2ee1ae24355ee9efb90e56110a1fd2bd80ce0b9d
SSDEEP 3072:ade6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNb5:ad314V14ZgP0JaAOz04pP
MD5 SHA1 SHA512 SSDEEP

Ampland

SHA256 9b0e59b0a8c21205f2e92e64612c46d7f3cdccb5a34796fd35cf308690d56c45
MD5 e2836316377fc5c360cf827922dc54be
SHA1 8fd684cad64d041b07bb6bd51019b409267470a9
SHA512 8c1e234d47da3924860cf9becff9818a50c135980152d9ac2f6ef4aa7acc90802ca96a9f1f0e60d73c7e762beb3f9b4598a0c6539ebb79dfaa45dc12dd89aebf
SSDEEP 1536:q1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfX:qZg5PXPeiR6MKkjGWoUlJUPv
MD5 SHA1 SHA512 SSDEEP

Assess

SHA256 bee34e854ab0a7d18ed3320bda1b0b528db26fbca25086e6f0e1e0162e98ba50
MD5 d4bae8c5c49c42210d71db8441928f3f
SHA1 6a643aea4f9960ff77e1d5cb99cd651fd21eb0b3
SHA512 81db1f89e1c15aec8932b78c18605f8d74f142a45d116616a130603e62803e3e5cfff08205cc69bfca90ee7b6ff8e1696645c3a26aeb84e4e272001be3c70f07
SSDEEP 1536:qMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxZ:qtCZEMnVIPPBxT/sZydTmRxlHS3NxrHl
MD5 SHA1 SHA512 SSDEEP

Boom

SHA256 607977efd8305269cb04208f0970594c142ea0c47ec2391ef22171591146da1e
MD5 f4b8c9c8e1413f32a61b9cc38593dfeb
SHA1 1f8a508f9e30489d69afd3720a39d43c5917dad9
SHA512 8a2c651892fd821f23a6efe9292e460e2ca4a44af3c5dddf3d1706d6327407d51c6e5c7acbc64da37a19f164405cebaa89f3d6110d5bb7a36233e534f9738c6e
SSDEEP 768:mhSaAwuXc/mex/SGKAGWRqA60dTcR4qYnGfAHE9AUsFx+:5aAwusPdKaj6iTcPAsAhx+
MD5 SHA1 SHA512 SSDEEP

Diet

SHA256 338f792605efbbc6e73b4aec70b6345ff619d88476ddaeb2e4fb41c66d3761e8
MD5 b2835e5959662c323086f4d3c288f081
SHA1 f4e98549684ab49f5b4ee979b786c18ed1794d39
SHA512 6050e35f88253b18a8c1e5b787a10bb089c92c2cb932b06f633888ed03b28a16205f295efeaf7c4e010eb02580e34e5c570c7e886ecc3a54c9340846ce1ff46c
SSDEEP 3072:PpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/y:Pp6vmVnjphfhnvO5bLezWWt/y
MD5 SHA1 SHA512 SSDEEP

Disable

SHA256 62c6cad4f514b89315ecf205eefd54b62c5ca86f005d7fb707442156e8b9c173
MD5 5a7f390c8e9e766cf2c5849dc237b763
SHA1 48660c36bdece60f371d2779ef2e065ca212108e
SHA512 087057e1dda1b549ed9b7cafbd6b840dad26b5d67eafb426144c4cce1b22d1ef27da33d4d6a4bd0c8f7e1ec36a7c82ecef76c47df5f41440b74537fe5e043107
SSDEEP 768:5LtVSQsbZgar3R/OWel3EYr8qcDP8WBosd0bHazf0Tye4Ur6:ogarB/5el3EYrDWyu0uZo6
MD5 SHA1 SHA512 SSDEEP

Honest

SHA256 55680808f0b550403b7c88d2b18900a9db294a0e761109d70780eef07fb032c2
MD5 669a502c6d6ef85c8d4fd333d25ec26e
SHA1 f2241559c9968c5f73aa64a4aec683d8b7e4155d
SHA512 25aa53e6503d4aec04ad616cf7a59b45cbc6affc717ea55b9a2d46d9e04d6b9a06eb0655a24d3c5fdc6f5a71e0a008d23fad66ed6b0c9dd9c8420af4f3a10357
SSDEEP 768:X+9BGmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:X+9BGmdATGODv7xvTphAiPChgZ2kOE6
MD5 SHA1 SHA512 SSDEEP

Nevertheless

SHA256 84bf74aca94f07e7ca9354e21f1cd51fdd20977649e5840462340337ce33af98
MD5 5ba84e9ceeb196ba2939ec05735021d1
SHA1 5c69ae5cc200a69cf6d44c9363687be02119c154
SHA512 b6e21968804eaa9e95d425cc46be6d4aff8f5ec71cb8d2cf0f0b970b787538af4ad43e7c024b5d6c5b7f4f141c69d3c8c6ad1a8d407ca88c10d36b6181ef0398
SSDEEP 3072:VgQa8Bp/LxyA3laW2UDQWf05mjccBiqXvpgF4qv+3c:VgQaE/loUDtf0accB3gBms
MD5 SHA1 SHA512 SSDEEP

O

SHA256 ff31ab0e8a634dc76899fe44520658027cbe4933d0708b0b82ce86f8e29d6743
MD5 e7d090fb3bb9d5c3a0cf4b46ec6b0cd6
SHA1 550d589491ecbf8f9accfc7f4b303ce5db0e87f2
SHA512 c7682cdba85b6c648eea4201c355f266acf96b0cba8953b7b38a061eac9ea695c58034689b38c0582b58942e808b76ec416ee239a71ab72edbe5f922c6d048e9
SSDEEP 1536:9eOypvcLSDOSpZ+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1Cw/:9eOyKODOSpQSAU4CE0Imbi80G
MD5 SHA1 SHA512 SSDEEP

Reduced

SHA256 595146a5ce4072d6513ea719f05ade9e261f7b98931b170c07700306b7215439
MD5 23c0ad7c89b4a11148b9460d55e8aa29
SHA1 e26e3551393468060c97f398c52a22993082ce56
SHA512 f55d2c2d7a1072a5bf6fd69a17c08b427d23d504fdacae75eedb65ff14f287e97a68ad0540c9d3b59abcdf4a79daa694f92185d73d7847689dbadf0a9af22371
SSDEEP 3072:MBRtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CTZ:GNPj0nEo3tb2j6AUkB0CTZ
MD5 SHA1 SHA512 SSDEEP

Term

SHA256 23c323aa87406a0d8c73021a317dc726c639452a8635bb63a175af9b321834c6
MD5 222f8c6573013c15a82990a5f977c04b
SHA1 3144d6b126d1394695504ae042dc9f5065a5d305
SHA512 884ef1a632c0f0e6db721a53fd93a5d253e91da3752ab199c0a2c199094943ae5e5878777b78cde1beee0c8700452a3a3660692cabb944c21d25df190bedbc8c
MD5 SHA1 SHA512

$TEMP/Leaf.wmv

SHA256 079f4865c9a983f7dc5eaf7b3c2d43a2ef62715a63e22cc14bc7d776c5d87140
MD5 651b948f6eb1c8f79346ff9ddef9593e
SHA1 871fc6a5eba4b10d448c39d7791075a23095df1c
SHA512 4fcf6749cfe72351becf8a527f784ae43bc17d9cee8046e9983b6207b9bbe974671fcc8f6bd58b42005bdaa8d8bb93fed29a38aa4dec8da10817c7a0315f0cfa
SSDEEP 1536:CSaG0GBre8QaxDhzFX4HjtySUblJZJIEaDOXfgmXP5WXUsCtaPz:CJqJQunEB9aYIxkCtaPz
MD5 SHA1 SHA512 SSDEEP

$TEMP/Macro.wmv

SHA256 a7fdd00d015b85f1889904dba0ee957665d2cc7035bec4316cf2d109a3fd6481
MD5 38c60f4f0faf1e878b6d416554f7add6
SHA1 fc3c8ab31f8fd19ffd9e80b47b2c13346700ac64
SHA512 5ef500b93379b52290ab60f49de6b193c4140fdd034564e0479e3c27d478f52be900a0b92b7713cab80c91c9373e18acca46dc8f59035b9ad5e818ad92bc62c7
SSDEEP 1536:uAO9dCaPe3fs74/jzsIl3PadfNpv5fyp2Kq2ibF1BDWYAFY4tQraSkFED9ClR:uAVaPePs7oE/dfjB6rq2ibF3CpFY4Cr2
MD5 SHA1 SHA512 SSDEEP

$TEMP/Mountains.wmv

SHA256 227720511a9d48f20ce19393ac2de7863735ced825c18e294b28100ef3ec9028
MD5 e4e3277fe4d08897173168dcad6cd1a8
SHA1 87bd9f8bf13138984d7787f21ba024da82504f56
SHA512 8184ac2a9b81bf3b591a84a8a1a508526689efcdbf20c25926afafab41734f1df679db7a2f95378f51d12f079da1b9ee15e7555492d023a05936814f3e2399ba
SSDEEP 1536:QB5eS5eQ4Api6+aKiiIN/Zt0s86EpiB5QwcM/E+yiS:aeS5eQNi6nKi5RCdcB5Qw9sqS
MD5 SHA1 SHA512 SSDEEP

$TEMP/Systematic.wmv

SHA256 b83ec027f1c49746d95856087353d373b5e5692023e997fc2e0a4a022039d42a
MD5 116e3cd5929199ab5298834039ac02a1
SHA1 008e7af7415a3027089e9bb6e35e1880c383b00f
SHA512 94c7fcfe7693bf7d4a9a2f4b048984d5b93662d335f80cf31a8c5d6e78af2ea9c463597e613e99e70ec99f5768d71a164ba43153c6596f807f6e1f5f3665f88f
SSDEEP 192:FU3rBucNfA7v7RqaQ+c3aevtD9YFr03CpAnPPBmZZmepZBQHkRRDUOr:FUFucS5QBKeyr+BmPVQuDUOr
MD5 SHA1 SHA512 SSDEEP

$TEMP/Was.wmv

SHA256 3231b2949e26099e2f454e6edf2e100950a0ccce70f3981165c5d504279f6c50
MD5 aee3d6907ff2df4f0700bf63f675cf8b
SHA1 880b35e01a06528e055ad945e75ba89ee5b7d7da
SHA512 8086ac93013e07a0bbb6e6033fa229392ab97b79a2c0763d1e2b4c5c90bf8e8fd4a64cff3efd977e82f61b83c012da84e5ee0e60e888dcc274d53b5ef291ea4a
SSDEEP 3072:y5nKJhxXU5FKFLFmBQhf+nM9BdA8enoTIPShK:hPxXmmxmSx+EdAfPUK
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer