4704846c5605552a2573aeb62f176630fd2ba5498457420c3fb36a27cae6800f

Analysis

user interaction
yes
max time kernel
126s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EzExtractSetup.exe
Size 4.4MB
Sample260705-121vesf12v
SHA256 4704846c5605552a2573aeb62f176630fd2ba5498457420c3fb36a27cae6800f
MD5 7399ebe1e1b9c99f3cb4a2521d424384
SHA1 7a560782421feb72b1e84f162cf0abd0809fda28
SHA512 80b6b5b2a93656211073560e3eb93063edec44d54a4346b64cab5898162936d3109e7d213d73a93e50ce3a20d163ce6f8eb27e3f31e72bae6c684e528413981d
SSDEEP 98304:fH85t/nKfACE3rHQc6cdxaf3JZ4csu+VCnkcayYl:fKhKfTkAzfHnstVCkcayYl
TLSH
T16726E02112C6E68CFC8C3979E5BB9726AA945E2827F05857570778039A375C370FE23B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/files/0x000d00000001c4d9-53.dat	ConfuserEx

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\EzExtractPro\uninstall.exe	EzExtractSetup.exe
File created	C:\Program Files (x86)\EzExtractPro\EzExtractProCoreDll.dll	EzExtractSetup.exe
File created	C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll	EzExtractSetup.exe
File created	C:\Program Files (x86)\EzExtractPro\EzExtractProShell32.dll	EzExtractSetup.exe
File created	C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe	EzExtractSetup.exe

Executes dropped EXE 1 IoCs

pid	Process
5448	EzExtractProApp.exe

Loads dropped DLL 14 IoCs

pid	Process
4108	EzExtractSetup.exe
4108	EzExtractSetup.exe
4108	EzExtractSetup.exe
4108	EzExtractSetup.exe
4108	EzExtractSetup.exe
4108	EzExtractSetup.exe
4108	EzExtractSetup.exe
4108	EzExtractSetup.exe
4108	EzExtractSetup.exe
2488	regsvr32.exe
3568	regsvr32.exe
2868	regsvr32.exe
4108	EzExtractSetup.exe
5448	EzExtractProApp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EzExtractSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Control Panel\Colors	EzExtractProApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	EzExtractProApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.uue\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.x	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.uue	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.uue\shellex	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	EzExtractProApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	EzExtractProApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cab\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	EzExtractProApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.iso\shellex	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bgz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	EzExtractProApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cab\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.iso\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.zipx\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.gz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EzExtractPro.Archive\DefaultIcon\ = "\"C:\\Program Files (x86)\\EzExtractPro\\EzExtractProShell.dll\",-107"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rar\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	EzExtractProApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	EzExtractProApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lz\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.arj\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cab\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.lzh\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	EzExtractProApp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ManualSafeSave = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cab	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.zst\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.bgz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	EzExtractProApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.iso\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.iso\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.jar\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	EzExtractProApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	EzExtractProApp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ManualSafeSave = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.cab\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	EzExtractProApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	EzExtractProApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\InProcServer32\ = "C:\\Program Files (x86)\\EzExtractPro\\EzExtractProShell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.uue\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zst\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bgz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bz2\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jar\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lzh\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}\ = "EzExtractPro Context Menu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.arj\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.xz\shellex\ContextMenuHandlers\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	EzExtractProApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	EzExtractProApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3D983473-BB31-4609-9F85-3A93CE453FC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lz	regsvr32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5012	explorer.exe
5448	EzExtractProApp.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 2488	4108	EzExtractSetup.exe	89
PID 4108 wrote to memory of 3568	4108	EzExtractSetup.exe	90
PID 3568 wrote to memory of 2868	3568	regsvr32.exe	91
PID 4108 wrote to memory of 1368	4108	EzExtractSetup.exe	92
PID 5012 wrote to memory of 5448	5012	explorer.exe	94

C:\Users\Admin\AppData\Local\Temp\EzExtractSetup.exe
"C:\Users\Admin\AppData\Local\Temp\EzExtractSetup.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell32.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2488
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2868
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe"
  2⤵
  PID:1368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe
  "C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EzExtractProApp.exe

Path C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe
Size 881KB
SHA256 554ef8f1d2b201421a53dbbf897fcbea20dbba9d6e8fa881ad0b52be60c11f5e
MD5 3b67b6026237810356f5aefb373d2b15
SHA1 1a4d565f81195adb9c048f8eb7fa7d77018ee3d1
SHA512 4e4a7445b1580c2076174c336414d5918a3fc0afbb13d56d29bd1fc18ca114affad1ced06fd52624292012dff2b95a76b19f4e3f9940c2d9a333c290a95d4641
SSDEEP 12288:Er1++AWc0pZGkwSt12FdlQfc2S3x3xby/+5XnrdJ/wNsCNpjs8TWGWSbSfk8hXos:8g+AWP7GowTZ2Yhe8hXos
TLSH
T13815A32422C2F5CDEC4D7879E6BA9E21EE906E2923F54803530378569A3F4C3A5BD137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EzExtractProCoreDll.dll

Path C:\Program Files (x86)\EzExtractPro\EzExtractProCoreDll.dll
Size 1.9MB
SHA256 6f9b0b8e8d1efbe25b81b0676a5902ec97aac1bfdc84a1a2d1b58659eb44dc5d
MD5 ede6796697abfd295b96322048642a69
SHA1 d0e7aaa407c4576eee42032bf743e9194a9c21e7
SHA512 88daf23e91c542c7348aa5c0fd16d382ef2fa95d7d5f91a4d5e39cf5d5b361eeaf4f33fcb43a71b52e4cea20c2b9dcb2b4e909d7ca3e5ab0c6d569f672dd385f
SSDEEP 24576:8diAakp5QsUmDCKTgo/A1HGFnpzRsFDEDmCjJMcqvbBHwrqRh:8d9p5QXwAxGFpz2EDmeJp8bX
TLSH
T1F9956C57B2B500E8D5E6D0788667570BFAB1749647308BEB16E08B2A2F13BF18D7D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EzExtractProShell.dll

Path C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll
Size 167KB
SHA256 08ccd848487f570175e3c5b8fa70b04ce30e3afb9f43b4105180e2eb079c85c6
MD5 968e162057c49c860813e465bfd3c2fa
SHA1 78e5b2e365a3cd7bd3f7fc4dfd9991568ee2ec8d
SHA512 5c41164239607fd32393742943e588d461b8a1d276d9e8142929aa7a22b6f5a82a723b2fff0389ed84677cb9ea9cbf1d793a66d27c367b8f7b9909a242f94eec
SSDEEP 3072:Bq7Kl734yjiELlcCQyUTaM+iK5BVlnJPO4RD5Hb0CreXKL6XSV:BZB34yjBBjQyUdO3VNN5wLK
TLSH
T15EF36C47B7E400B7E577927489A35A12F772B8111B209BAF03A0477A1F637D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EzExtractProShell32.dll

Path C:\Program Files (x86)\EzExtractPro\EzExtractProShell32.dll
Size 126KB
SHA256 2d3a1c7e0e6256344648a054bc5526d4804538fef9cc87efab9edb426bf1f4a6
MD5 24be51bce468016e106b55b19a2cbc80
SHA1 c7e18c81ebe523a1fefd845c9f9e09b881fccd11
SHA512 697d736f24b8e28db98885ad248048f43d6bf26237dc0e9651d37810d992fb2482cfd23a26d10164a2a30ad326fbbaca9390730ec498972cc91f673b77756859
SSDEEP 3072:y/jBvy5HvTzwlKF75GsZMV8/bvQ3MOfJUES6Xm:y/+v/wlCtG+VgRBUEX2
TLSH
T1CEC38C01B6D090B2D5BE1D380874DB725F3EB930DF545D9B67A41ABA9E702C1CE34A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nskF72E.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NsisPlugin.dll

Path C:\Users\Admin\AppData\Local\Temp\nskF72E.tmp\NsisPlugin.dll
Size 280KB
SHA256 23abc9395b36419700f31b507f13a189ec2eeb70c7e1a1fe9406c2b9e0728298
MD5 1d0e98e6817a35237509731e1398b47a
SHA1 2690a72941f1641495a1cf51ebf5399987a74e5c
SHA512 5cf919baa11e3cdc3518a351e206a5dc84bb1beaf933194d27fb0a96edbc6b90a58106c45a357e8c7af9de815b4e74cf5e42a22bc91b5fac02bb386a6638d0ce
SSDEEP 6144:XqvqVlHTqbHKd7kapR1hlfOhykuOP/BtVF:FuHKR78hwOP/DVF
TLSH
T1CC548D11B4818031D8AE16311638EBB65A7DB9704FE5D9CBA7D44D3E4F322C2AB35B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nskF72E.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nskF72E.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nskF72E.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5448-70-0x000000001B600000-0x000000001B746000-memory.dmp

Download

memory/5448-68-0x00000000006C0000-0x000000000079E000-memory.dmp

Download

memory/5448-73-0x000000001B3D0000-0x000000001B3D8000-memory.dmp

Download

memory/5448-74-0x000000001CAB0000-0x000000001CAEE000-memory.dmp

Download

memory/5448-75-0x000000001C790000-0x000000001C79E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads