setup[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/nsExec.dll

setup.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 9717a2f7f85ffa49ae0ca0b8f9b72ecf2fc54a79a74771ea3c16c1acd21846ea
MD5 50051b9dff3efc84e827693fe39b95cd
SHA1 ee0e6dce567c015095fb617fc1bc83b8dc021533
SHA512 ab7b28da29192766556ffd47196d356e10d1b01b81d64ea1741a64e3f953e5250adebbec29c93eb9e587a5f7630186ad59338d03d5313322d40258ebcfc5b03d
SSDEEP 24576:yzZtZsbSiUnoZ1HKwhMtN8U4a/xgOkvUL0MKLXFbtM8un:yx6SiUne1s4mvVotLXvU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

86:7d:86:bb:24:ab:2b:ae:1e:fb:13:7d:a8:c3:d9:7d:95:4f:da:e4:da:2e:0e:45:2c:ca:d2:ee:ff:19:87:36

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Chains

Jul 8, 2025

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Serial Number

03:8a:4a:4c:4d:aa:6a:ad:4c:64:bc:63:bf:08:2c:4d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2024 - Feb 13, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Dummy certificate

Serial Number

01

Issuer

CN=Dummy issuer

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

5

Entry point

13333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Beneficial.mpg

SHA256 6be414f2c07ba33606441a32a8498d6489eb6cf5fe1ba9de8a74fc23478df560
MD5 9a24edbda2385452f6e969a0a5350f49
SHA1 ebf9c0ce769f693ddcd1d58db4f4cf7b8cee79b9
SHA512 009002e42316ca84fc847b5ef2cd95898c2d2e2f6e2bf48cb3e4e29b1462e193de956324b2ccb1cfd5e1ee76638321a9aac8d7e883a70c83b90432b57b438c5e
SSDEEP 384:n91CHx5LS65Rr6NaY5PS437yb38wdVKMeiumHm+U7aUErrfJJXnoF8:91+x5TR+76r3RVDAmG7aZJJXn
MD5 SHA1 SHA512 SSDEEP

$TEMP/Census.mpg

SHA256 4e12f90b428e3eea595271a4fd32f8801083466b831e9e79a55df330ea67a1d1
MD5 3010becaa869d4da79fb63e570af10e5
SHA1 2aeda986739e37aee9380cd2838069482f709daf
SHA512 279bf534c226533a3a871a0c5315a57f4e2d85361498f8e39e907305158d43ab0d2084796ea44c0bda22b42ec24a458d79a4b4df63d1fbfa8f0dc95c5b397080
SSDEEP 1536:lxFiLgcqBSPen78kXN73GVXyHtvfZYVO6MA58j/j+g7guxbsGz90utt9IC1KodhA:DFiLQXn78kXN73GByHFkO6M487jT7gSA
MD5 SHA1 SHA512 SSDEEP

$TEMP/Classroom.mpg

SHA256 8403a59c6ae535f29bc72c0c13e5202125bc1392481871ea0ae910e93543ef87
MD5 dc559d834abc0666f1cba085f6e51a5b
SHA1 08c4b62a4a4a568d562508c57ff3304c7aabc40a
SHA512 a27769164020766021912006f20fe1db4c20b8e070bbc1119409a02645b388dd2514590bda65ab0cb6e50874296cbfbc94e595b8209a6714a29ddc863c7dee39
SSDEEP 1536:yWYZ0szcDMhLghWQKIziAyaDdnA7jyn1RR4lauFW0jHZ/TV+iyO/2Amz:4micDMhLghWLMiAIW1UacV/cOu9
MD5 SHA1 SHA512 SSDEEP

$TEMP/Congressional.mpg

SHA256 39128b642d7bc0477b6a9727a090ab5d09714d34af9efde7e07b4901b0e00d68
MD5 36038566349f44aba743de154ed41237
SHA1 9c0a2dafbac587c03dbe3b48eac7b1298803f390
SHA512 91ccbb8cb849e8c7eba856233c38f79ccfedee5978960b052fcdaa202799433ee1028f7bd039164e7bed576e403b0a3a71c33bca37b3af5b47f11f1b90d8b6d2
SSDEEP 768:guMw+qSy6DW03P36ofg+46CIYJcROb2zFapqUuEmuiNpQowpzcQOvTGSow0dSEF8:gv8SpSofgSCIYJcROSzF1Co87Sp+5G4M
MD5 SHA1 SHA512 SSDEEP

$TEMP/Grown.mpg

SHA256 74c180f081062a6ebc555d472e5f09b3520388bc9f080d04c7e14a566375f9f2
MD5 38f697b17fa6583e9194b63271c8bf90
SHA1 1397786cb85aceeb8c8a03eb2527298843d48723
SHA512 79b4bc5201c160f0f643d705602fcbf00c59883225bb117bc5558fe650e50b282263ec0edf24d564fb725b6219ab722c954a38c8a165f4ce632ce0b7b6250d3e
SSDEEP 1536:wJRvqSTrfUs9s23y07eyBU1ChEc0ANWJZNWwDIo5y8WfDuVYAIeM/mLsjmhg73TA:IRvqSEr4Bn07JZNWIIqqfDT/4sjmSbs
MD5 SHA1 SHA512 SSDEEP

$TEMP/Seating.mpg

SHA256 b6a6e9cf58d64c012db76c4145b5820fe07a2f15a4a7d6a6c0788fe70a2c130b
MD5 38770d97320f81f4edb428acbf59765f
SHA1 b6f6698f46dbca8c70cd05fb5f85d804ed26f8b7
SHA512 50bd283b8f4b41dd8e3a12a1fab785c95eeaeba12b73b2715066074b9b0d0a6e055899098457af0f81a121e0e80cbe6d9f02dfa43c11b5eb04439d8ce9554f32
SSDEEP 1536:RH9f1gCYTSGvdyKVcqxpMdABUdG0yK21GrOGN:hTgCYTSGvdyK9SABO/eGr/N
MD5 SHA1 SHA512 SSDEEP

$TEMP/Ul.mpg

SHA256 c5527b1f95d943a47a53dc130c4f49a2be2718226cb3094b67176a94947c5a8a
MD5 384f3c8044aa910623a8b7298d8f06bd
SHA1 c5c4d001cbdef2aa7a4ceff586879f21e75fb7eb
SHA512 8c6371ae5ee5562381c50d0eefa4120748e0c7611647add3d053b220df025d8a0015cb4604e0996b652328894883ab781886a6e2a05c0c82c3bb7b358996befc
SSDEEP 1536:j4qgMSS30KUBsL2N0yjXyyh/30P4tEzZpjT1RMVSCl18+73YUC8ml6Kn:8qg60tGLhyF30P4tEzZ578l1F3YdzPn
MD5 SHA1 SHA512 SSDEEP

$TEMP/Vegetables.mpg

SHA256 1ad86b859841c9d9ae47a5a1b759d8454cee0cee8a0ea9e146528274efbcdee6
MD5 ce3b3288d5471efb54056884c1675da8
SHA1 3d21d9594dfb841068a14c5cc542e84ae36bef9a
SHA512 3cd42218d9bd14e7f2e1cc1fe3202382f27afeebaa5556cbb96544e513cd0ae30ea6f1654c123ba46600b4aa8a958dc88fca01c42f57d3da04960b188d80ce50
SSDEEP 6144:TijoA74sOdbwjeTRUCRTBd2A7/KjZOWoEaC0C4vy9WufUsJgJevsT69VBtagtCzZ:TiFOujehBBwYC9nQyJpgJoVBtbVTTedV
MD5 SHA1 SHA512 SSDEEP

Carl

SHA256 74440ed2165f72adc08dcc8e6f0f0b3c3f066e35ec6f5084246ab75f73d115a4
MD5 bf0f8ad157e28975017fbae7bea434b0
SHA1 d112f9e8ffa248d488b0a33df4ce0b0da2edf269
SHA512 4abaeda8d39e80dc383d1f31d9f31b64457244d94bd6334a0a0af36358d1ed5956b5766672823ffc1b1992ef3a5d99b556196d2613395268dbcaef75569281e2
SSDEEP 768:uUzSLKPDvFQC7Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXc/mex/SGY:Pz08QuklMBNIimuzaAwusPdY
MD5 SHA1 SHA512 SSDEEP

Cheese

SHA256 cd95c9f1ea27f3aec81cb44a34e80133f422609258d078f0bfb35c34047b1fff
MD5 3e5acdac885c7c647cfef81a9b536dfe
SHA1 308ebb2508e7e6d0214dff95f933055052cbf4f4
SHA512 cc48f940df406f23a6fe52dadc1e4f04e9584b002f75869d44e6d2df68edb5280cbb83915ebf108529e504cf33b4713c78e0b6e69bd6d0d49f63f1ee696a2d63
MD5 SHA1 SHA512

Continuity

SHA256 d02cb09a542e3e2a0aabd88da684004bd84625442d4f9306b984431992284899
MD5 6c860303c2f752d1650a1a142fd0ea9e
SHA1 0fcc570ae51118bdf6a1e0cb676dde9bf3f3f9b7
SHA512 a970bdcaa72d82a8c55ff002770ee33c56ddcaf4dcc695623a8cf948850804b6df411a1456b928cc22b18d6440cf802aca06025114a480cf7c56206142486d3a
SSDEEP 3072:vv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLg:nphfhnvO5bLezWWt/Dd314V14ZgP0Ja1
MD5 SHA1 SHA512 SSDEEP

Look

SHA256 2d3f1182e40fa340a4da5889d5f7c587a0e14c3f2f31d696750af9f36ad01aef
MD5 d077c0d7a3d623380d4b5720815dc417
SHA1 3e6c429335ddcdd117ce6b4eb2312c4226b430ad
SHA512 76b68ac18ed3729000aa9c4d470871aff27c12c73e9fc6b6675602e465e4ed10a5130861189de3ca1654155a07a620207a08487a0e48a3c8c955b535cbf6fd9f
SSDEEP 1536:3E5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUz:aPtCZEMnVIPPBxT/sZydTmRxW
MD5 SHA1 SHA512 SSDEEP

Numeric

SHA256 17f3d04bc17d3d6f361a5554a599e8706c2e9448c7e34f33145a7bf1407778cf
MD5 75fc5876d6f6c7d6ce44efb0210c2bd6
SHA1 0282ab911969fc58807545d148ef221da6f61bce
SHA512 b340731476708eb49c75acfa7666974e5930bc3a9ef76d869e8be1ef6929eab4a500262f4e70244c026abb04adef86a170aa33066f37cabd8c870dcea44527aa
SSDEEP 1536:9Ku2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcLSDO5:9ccBiqXvpgF4qv+32eOyKODO5
MD5 SHA1 SHA512 SSDEEP

Piece

SHA256 ece4c656c1c8e3bfa595e533f70624559b4a4d54ddba931b7b5a8ab142bbc831
MD5 d84f939a549fb61d37a770b1ae8c03e4
SHA1 5e1dd1e5e0fddee404a2ba937e8e599e45863d19
SHA512 a68be0cae6f1d3e67f7537a30d41846fcaf47444d82d5464dcf07e4a343872d1d601429a9e771e89ae413265423abb6289c297817615ccedd14173f3ffd4f59c
SSDEEP 1536:4HS3cctlxWboHdMJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmoJiKwtk2ukC5:4HS3NxrHSBRtNPnj0nEoXnmowS2u55
MD5 SHA1 SHA512 SSDEEP

Rest

SHA256 ab6e52494e05ed25dc46a4a92ab7c6426cada31009ce0400aa2078dca446e3f1
MD5 7b42294c1ca5ac54f9c32ed74045c908
SHA1 6dcbe7a81fbfc48dcf85326ee68a69fdcfef6bab
SHA512 9362b5923b577afb1ae3c840dd5a35841efac52c879dbad9384386e21e68d0a0eeded0c0875fef51990588d8f4960830d3b29fab08e9978a6ccb0bb0fe708878
SSDEEP 768:jQ18OWrM81EyJqx9EdzGGXZVfmlqTmN5WAQIGK2ud5lS87uzh7JCQ/sE7mOB6XSX:U1/AD1EsdzVXnP94SGGLpRB6M3
MD5 SHA1 SHA512 SSDEEP

Russia

SHA256 ecf23be239a40c5f7aae1ff2ad4d692630dbc3b552b6395bad3af624d82ce041
MD5 a2e743a441b8e94f20eae3568679705a
SHA1 1c696c1a1390222186a6dde9aee672834bf7607c
SHA512 11d517b43c7fb7bfa8fabe6c8b385577fede448a20d2f55e9ed34b24d826b36feff5ce4637152c43abc137e292bdb2835c1e10be0b6177be70fde9eaaa438fb2
SSDEEP 1536:rRu+OoQjz7nts/M26N7oKzYkBvRmLORuCYm9PrpmESvn+pqFqaynB6GMKY99z+ag:rVOoQ7t8T6pUkBJR8CThpmESv+AqVnBt
MD5 SHA1 SHA512 SSDEEP

Score

SHA256 4c2c14f5cb9ea7aa86c9e0230e9e8448bb59cc0998e1d1f9e6f02ba356987498
MD5 bc503d3650bc49754d242b877d940f45
SHA1 f9c1c5d3aabaf6a4d53920f7154f577f6bd27e1a
SHA512 8b75577324956b39cc11fce0f30b613936b56cddac6a72f5dfb4b7f229462c0b566bc228fdffac51211b5d58703691ebcce8bd3b25dbd0c0c059157425a9e05e
SSDEEP 1536:m8eFvMVpYhWoXElJUzdlDfFgQa8BpDzdZPp7HE+tKA3QkvyNf7Xw2U0pkzUWBh2s:akjGWoUlJUPdgQa8Bp/LxyA3laW2UDQi
MD5 SHA1 SHA512 SSDEEP

Seasons

SHA256 56782ef1195963b85f65cd8a83ab3f7478af1498d6c3d06c51a20277aed2bac5
MD5 669b639e86f52f33838627d86f574649
SHA1 2961a8fbd493c7217f2d90d66d5d55a16a8e6e65
SHA512 6003055f551541543b7b68fc1ff47c172fddc458684ea9ca9362b20845037756bf5b7a0dd19df0e925e8c8d6aba871cd519642c7b774588f8214fbdda864c73f
SSDEEP 1536:0pZ+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGV5:0pQSAU4CE0Imbi81
MD5 SHA1 SHA512 SSDEEP

Secret

SHA256 61fe0238284fcb29ec193a8354f93df81fb4f6fb9016797dead84e977bec5324
MD5 f53ac283e3677fd424bf7d57d8e5fcff
SHA1 9b43fdd0a77c523e5ed091f646468fd63f0b606e
SHA512 0e94b300fb2b33fe87084f520b7589074def5655347173a58cd06475ab0bdb8ddf687810d36c6b6b44e8c67225f94c7a4c9b8d1559341e619baf56f57cd18bc6
SSDEEP 192:ZAH6N8VEVFJ84kcGNq4/C+Q3ISVSWMZMQ3rw:qrVEVFJ8ZcGwGBk7/UMQ3rw
MD5 SHA1 SHA512 SSDEEP

Ts

SHA256 cfda7ddda8dc498bfe11770a2581ee7519a992e54ccc9c90e72a967859823bf8
MD5 6bca8a30067132af88126eb2db79703e
SHA1 1e09c8bb3dfc330e64c641ab7bdf962c0ba8993b
SHA512 0eece37469d04546c02aa65cccd72bf583e253fcd13fcf6b38ea7087408dc094ac69cc5878a9d5aa8692727eb491d1037fef3dbaf21fe47ff3ba79e5689f6f56
SSDEEP 3072:U6whxjgarB/5elDWy4ZNoGmROL7F1G7ho27:U6ggarZ8aBZ2GmRq76t7
MD5 SHA1 SHA512 SSDEEP

setup.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Beneficial.mpg

$TEMP/Census.mpg

$TEMP/Classroom.mpg

$TEMP/Congressional.mpg

$TEMP/Grown.mpg

$TEMP/Seating.mpg

$TEMP/Ul.mpg

$TEMP/Vegetables.mpg

Carl

Cheese

Continuity

Look

Numeric

Piece

Rest

Russia

Score

Seasons

Secret

Ts

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Beneficial.mpg

$TEMP/Census.mpg

$TEMP/Classroom.mpg

$TEMP/Congressional.mpg

$TEMP/Grown.mpg

$TEMP/Seating.mpg

$TEMP/Ul.mpg

$TEMP/Vegetables.mpg

Carl

Cheese

Continuity

Look

Numeric

Piece

Rest

Russia

Score

Seasons

Secret

Ts