Analysis
- user interaction
yes - max time kernel
127s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/07/2026, 15:24
Behavioral task
behavioral1
Sample
uzsetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
900 seconds
Behavioral task
behavioral2
Sample
uzsetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
900 seconds
General
- Target uzsetup.exe
- Size 7.4MB
- Sample260721-stem8abf85
- SHA256 d7c0f87b6a65a8ec7e387a6b7a6f7a6effcb1d1d98ff6abd12753ed0c1bae143
- MD5 f8d23866d1d9befeef65564b0ceed388
- SHA1 a50d654696a5d508ffdc4c4ead14aa5b628b50f8
- SHA512 a0820719dc8614115d8e78309114f802ef1b7593ad4095e68d63790d8971b2cd9f1b7921644999eb3a030ab590cdbb41f514c0654816949cb2637f0fe9f7db56
- SSDEEP 98304:43ASJn0nwXdeyrzjTLRAaxAwMYt6c/EfSxIq8HvOzwcubWkU7lFpuN8FVfz09Jbb:NOuwM076nPIV7kU7LpXwbBb6U0PdnE
- TLSH T119763356D49220F6E8F3F0B1073D268A9377ADDA167306F07A46794F6DB48C4E223789
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation uzsetup.tmp - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UltimateZip Quick Start.lnk uzsetup.tmp - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 3 IoCs
pid Process 984 uzsetup.tmp 4768 uzqkst.exe 4468 uzip.exe - Loads dropped DLL 7 IoCs
pid Process 3944 regsvr32.exe 3944 regsvr32.exe 3636 regsvr32.exe 1732 regsvr32.exe 1732 regsvr32.exe 4468 uzip.exe 4468 uzip.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 56 IoCs
description ioc Process File created C:\Program Files (x86)\UltimateZip\is-3N7C7.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\sfx\is-OA621.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-O0PMK.tmp uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uz7z.dll uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzreg.exe uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\unins000.dat uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-SCSVN.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-91B54.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-EUS1R.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-3DMU2.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\sfx\is-S44AT.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-J0EPQ.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-LA7UM.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-T0GC0.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-28QP7.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-IDD9Q.tmp uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzext.exe uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\UltimateZip_de.chm uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\UltimateZip.chm uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-65BHE.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-K4L2A.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-MTIC5.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-7IVJF.tmp uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\unins000.dat uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\unrar.dll uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzcloud.exe uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-CF9H4.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-06KH8.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-GGJJM.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-ITN98.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-SGUOG.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-P91M6.tmp uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzcomp.exe uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\UltimateZip_fr.chm uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-ENJ70.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-PCN90.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-3S73B.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-0NA77.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-861C0.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-E5J02.tmp uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\unace.dll uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzshl.exe uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzqkst.exe uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\icons\is-8Q4BQ.tmp uzsetup.tmp File created C:\PROGRA~2\ULTIMA~1\$_Temp_$.$$$ uzqkst.exe File created C:\Program Files (x86)\UltimateZip\$_Temp_$.$$$ uzip.exe File opened for modification C:\Program Files (x86)\UltimateZip\cabinet.dll uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzshlex.dll uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzshlex64.dll uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-G5FLG.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-VV2O0.tmp uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzip.exe uzsetup.tmp File opened for modification C:\Program Files (x86)\UltimateZip\uzsfx.exe uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-TALHQ.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-6ELFC.tmp uzsetup.tmp File created C:\Program Files (x86)\UltimateZip\is-AR3QC.tmp uzsetup.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uzsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uzsetup.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uzqkst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uzip.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x0000000000414000-memory.dmp innosetup behavioral1/memory/2916-10-0x0000000000400000-0x0000000000414000-memory.dmp innosetup behavioral1/memory/2916-125-0x0000000000400000-0x0000000000414000-memory.dmp innosetup - Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltimateZip regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Shell\Open uzip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2450}\ = "UltimateZip Shell Extension 32" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2450}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\*\shellex regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2490} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\DefaultIcon uzip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2450}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2450}\InprocServer32\ = "C:\\PROGRA~2\\ULTIMA~1\\uzshlex.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2490}\InprocServer32\ = "C:\\PROGRA~2\\ULTIMA~1\\UZSHLE~1.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2490}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\*\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\UltimateZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\*\shellex\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\UltimateZip\ = "{2F860D81-AF3C-11D4-BDB3-00E0987D2490}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.ace uzip.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\*\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\*\shellex\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\UltimateZip\ = "{2F860D81-AF3C-11D4-BDB3-00E0987D2450}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltimateZip\ = "{2F860D81-AF3C-11D4-BDB3-00E0987D2450}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\*\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\*\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Shell uzip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\UltimateZip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltimateZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltimateZip\ = "{2F860D81-AF3C-11D4-BDB3-00E0987D2490}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2450} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2490}\ = "UltimateZip Shell Extension 32" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\*\shellex\ regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Shell\Open\Command uzip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F860D81-AF3C-11D4-BDB3-00E0987D2490}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings uzsetup.tmp - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 984 uzsetup.tmp 984 uzsetup.tmp - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 984 uzsetup.tmp 4768 uzqkst.exe 4768 uzqkst.exe 4768 uzqkst.exe 4768 uzqkst.exe 4768 uzqkst.exe 4768 uzqkst.exe - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 4768 uzqkst.exe 4768 uzqkst.exe 4768 uzqkst.exe 4768 uzqkst.exe 4768 uzqkst.exe 4768 uzqkst.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4768 uzqkst.exe 4468 uzip.exe 4468 uzip.exe 4468 uzip.exe 4468 uzip.exe 4468 uzip.exe 4468 uzip.exe 4468 uzip.exe 4468 uzip.exe 4468 uzip.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2916 wrote to memory of 984 2916 uzsetup.exe 84 PID 984 wrote to memory of 3944 984 uzsetup.tmp 93 PID 984 wrote to memory of 3636 984 uzsetup.tmp 94 PID 3636 wrote to memory of 1732 3636 regsvr32.exe 96 PID 984 wrote to memory of 2472 984 uzsetup.tmp 101 PID 984 wrote to memory of 4468 984 uzsetup.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\uzsetup.exe"C:\Users\Admin\AppData\Local\Temp\uzsetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\is-49TIU.tmp\uzsetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-49TIU.tmp\uzsetup.tmp" /SL5="$80060,7495163,56832,C:\Users\Admin\AppData\Local\Temp\uzsetup.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltimateZip\uzshlex.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3944
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltimateZip\uzshlex64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\UltimateZip\uzshlex64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
PID:1732
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\UltimateZip\readme.txt3⤵
- System Location Discovery: System Language Discovery
PID:2472
-
-
C:\Program Files (x86)\UltimateZip\uzip.exe"C:\Program Files (x86)\UltimateZip\uzip.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4468
-
-
-
C:\PROGRA~2\ULTIMA~1\uzqkst.exeC:\PROGRA~2\ULTIMA~1\uzqkst.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\UltimateZip\English.lng
- Size 152KB
- SHA256 edad582884d44a8fd45b6916e9c34e3af4fddaadc28ed2b4754369dd0174d04c
- MD5 206103d1140e40b3301be2eff7e95ac9
- SHA1 3fc466714c58f3716f912baa8b39bb8a438b3ba0
- SHA512 42e4de1aebb8d432dd53ff2d9f8758538e3bc177fc19f35e7d444d004e25e3384fa4c48b61ad99e480e4dd456fb096055588c1b7a634b0d11b19e039e95b0a87
- SSDEEP 3072:lygd0vcS08VSOoSzYIUkOdQVQCcsj9qyAluFwbkSBEqyS6sJ5ItfLBS1ymuRMEM0:lUjuu2lK
- TLSH T12AE3871233FD0704F1F3ABA6AEF6C1615A7ABD65ED38C35C5186121D09F1A4188A2FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\UltimateZip\cabinet.dll
- Size 58KB
- SHA256 a6db369b7782c2773361d878ef74ef1d9d817ae6f2bfca5c0569ec58f4dc7245
- MD5 733df8797f95e6149eb34bbd4b5d111d
- SHA1 628c2efe73500314e289e4b5d47d2987f9c7c16c
- SHA512 ce0fe78acc1fd86633a44c716a46336a7f56566868c8b709203752a6a9123092c41ed7e1059e0293d9d935ce154803d3c51b756e4907c138e9952f9bfcb52930
- SSDEEP 1536:nXdn8Rzk7BmSA05eJdJgJbxKLd2mzvK6J0uRAzGM:nX1UIVH2dyJbsvi6GuRQd
- TLSH T1ED439E91F3C385B5C0A66331C50A3B2F7BEA6FF42215B99A57901D883513BC2ED89793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\UltimateZip\readme.txt
- Size 11KB
- SHA256 d587566295dd44567e055c61c72655fbe22821538365d8773f0cf176770e9ec8
- MD5 bcee871e8be1dacf67047fbfbf4c65e1
- SHA1 435a91033bfe3251bea782ea9c0b8931c0f7b0bf
- SHA512 313a17ea699364bc923b55876d63811a74f9255b331ecb2e061358c2be68ed1b9cca3fac39b7421ef268837befee1b5032270d5576f8c354e686eeca8e7aa134
- SSDEEP 192:8pleMNEVM6ZwQu+FCLtU8XI8nS/PnCd/OtzvlJWrXtVSWflvST1eEwFK7fv62fM8:8cVvZwQu5q8nSnnCd/OtzvQVSWflKT1F
- TLSH T17732815CE8833D6637B3040617533BC79F3A213AFA6149687DA7B26C771D981AB6C068
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\UltimateZip\unrar.dll
- Size 222KB
- SHA256 3a9779ae106d5cb5725ef8354136d6a34133522b0ddf6ee2bc035e6e1e433551
- MD5 052304e02eaa7bbfe788b8fd66c47d8d
- SHA1 84fa63bdc6ea555c2df7a6f70b66f11895fae8e6
- SHA512 7e35156d726e009d93dbe60b07958f074918b1959fed55787a80541ec043237c1345452c0bb8a5b9eca913af8a2b2f20892f0e220d08d7a66d88d07d2411367d
- SSDEEP 3072:xJdh1v/iKDerZN7Jk9CTu1mIotcxfcVX3EHSlTNlnrglORseaCM5Q+/8hLx:xVBiKcaQpIotcVcVNX0asT9R8
- TLSH T14D24BE817687C1B2D91E1D3040AFE72ABD7CA3251331C5DBB7905E3A6D12BE0A6352DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\UltimateZip\uzip.exe
- Size 8.1MB
- SHA256 2f189c56906880da5458ed051864f9df935ad77c208a0eaa915c3ebb50fbda09
- MD5 43fa0acda876d9206925234416d51d68
- SHA1 beafe4a39d03de117f8f2b7e57be7f30b010db37
- SHA512 7887efb4d9546e3ee05c4fec0bbb72e93e0618eecdeac2d4528f37564649ab61876a84beec163e682cef2e0d243e946d11ae05f678239817427b5e7982c6fc83
- SSDEEP 196608:wcE1riDZauFL/vr4chl33tl3wi6oF8HgcbwjZ8:wc2eDZauFL/vr4chVdlA1WoUZ
- TLSH T11D868C11F782C877D0731A38DC5B97ECA829BE106E34989B7BA43E1C6F356417839297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\UltimateZip\uzqkst.exe
- Size 2.0MB
- SHA256 1aca0d85ffc9ad1bb9dbfaddc9c6a4a7d63d1b3ef7e0da44deb2093143682a5b
- MD5 f24aacd5affb3171d7afc710287b6abc
- SHA1 f66aa74335efc2a7671f7876061e8ed5a6e95ce2
- SHA512 1b0e32b011956a33da7da70e5c6b2764742479f32d91f8fb63219da288e00f6959975060b0a00d5719dc80fec042abee4e697ae9acab4d643ee52fc3cfbb7e20
- SSDEEP 24576:0EnmP9ia176VtBLtPwmB9kKzwKekVJee15ItubArlhuPNZGqw53AySjH48vEzejd:0GCS3fCtubArlhuPNZO3Y+0RzqQzx1
- TLSH T1FCA56B12E3C0D932D1221A79DC6B57F1683AFD20EA28985B27943F5C7F79F816922743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\UltimateZip\uzshlex.dll
- Size 1.6MB
- SHA256 b6e8889505d7ff457405ff726e01e8e351f2b05cc9c4c3bf641d37bd51c4182c
- MD5 9aad66b64853a9331419653a8dc5de47
- SHA1 85d291a0c5cf1f07822142353f93fe5f84e73ff4
- SHA512 81505a596fa1ec771b651e82be8d3317858bda7e57fd39d6d9afb7786b123356dc4866777b1da2d9a6209ad33242a6b14ecdace5fcf77ef24bee4809ffc151df
- SSDEEP 24576:GTGWmNL4SckR+kxRbMCJtuPHY0txBISTjq74ZO7JMO0SkzxAJdOOd3XQX:GiFr5RYC/sx2STjxO7S4kzxAJd5n
- TLSH T178757D13B2E4143AD07A363A5C779348993FB9106AE69D4F1FA4CC4C6E76E802C39797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\UltimateZip\uzshlex64.dll
- Size 2.3MB
- SHA256 dfa730187c0a92fb221aa7fdc1a6209f9003cb378ece1300747587bfbc7c098d
- MD5 6c663d1343d54763cc15e8cf01290894
- SHA1 41341ae3e48f57a0e1e19e2d2d2a48a7a52e8348
- SHA512 50d2f7edbd06ae282a81721c31f39fcbe26d3021f51f9eab80f860c7405c44dbdfa80f15ba45034bff300859618f8a12fb69f0dc5598e24efb508c4883f5ce83
- SSDEEP 24576:CqCncuS89/yhBVSvQa8SSyGTgbxo+yDf9X4oyR:5CncuS89/yhDSnS/TgO+
- TLSH T18BB5196772A0827DC16BC23AC4A3CB50D93BB0B52732C5FF568116AD1E16DC94E7E7A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-49TIU.tmp\uzsetup.tmp
- Size 692KB
- SHA256 e442e83c27e94bc37eb6c02411a88edd8cb83777d50312b9ef7bfc214c4cc7b2
- MD5 2c10db017057dce22651243244e4fee6
- SHA1 b8ea54a0cbfa98bb866d19e5b800769eea24e881
- SHA512 5f9e014129e4077e8e4745ddc8580890048f09f458d2dee2f3833931e29b6be89cfc7ef71a5837689dd3d25882ef0601ac13ddf36a2b8805092d7cd956e5c8ac
- SSDEEP 12288:UQCCh1TaLSSKrPD37zzH2A6QGgx/nstpq9KgER19zrNidb1gUHayxyF:UQPh1eLSSKrPD37zzH2A6QD/srqggEjX
- TLSH T141E47C32F2A08837D1B31E789D1B82D55936FE103E39A59736E91F0C4F796817A272D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\UltimateZip\uz.config.ini
- Size 68B
- SHA256 9a157588d8e0cc577d075276caa66a239d9587409c97909e02ceb1827dc56597
- MD5 07999052cc253c6fe55667ae85e0b088
- SHA1 0aadb518e55a62b107b543eb82544aaeffd59537
- SHA512 3873d04f098f15751a535b04a38a8a39c500b4cd1397f841b83458517d51e10fac703fe18c04d79fa041598f253bc17ea3af1550319ced143a5db0b266b942ca
- TLSH T1C0A02208CA00CEC03A88302CA3C88CA003038A0C332080A23088AA0EE082E00823C282
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\UltimateZip\uz.config.ini
- Size 86B
- SHA256 f126c35395a61acd507e2f76b10996233533168098c9fbba99f9d3f930805bc5
- MD5 f1713c76b245373eaac49bcbf4c9bc96
- SHA1 0a676646abfc5d936f77cd588a601e1e78450ee5
- SHA512 fbd762f28fdc89ac988dfab20fa538459d381b0cf6041b4affdc429813829f1a600d1b6ddaf9109f2a99c54c868ef4baa2e3eb75fbef8296fb6350909eca4a8d
- TLSH T11FA01208C900CDC9B969241DA38488A00343590D321040562148950DA541D00C16C24A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\UltimateZip\uz.config.ini
- Size 223B
- SHA256 5f14506a70f0c7e617f2f2c7af61308ece4c7794ec0ae083c5b098cad32df25d
- MD5 a7a9fa68aa4c61f625775bef73a1eb8c
- SHA1 5dcc6b2cebb1aca7d13e8e33edf4e451bbabe51e
- SHA512 79576c50ec564e0e8978ec1d8255c6ff9e18b9c434b5b8bee5fa40fc12cac3f0f5b7ec2f4c4c132e4d52e64c5b3910ac3621f046e5fe52a645354c0698d8607c
- TLSH T133D012CC9F30CDDDE875748C975745940F926938271D7CE6934458CC7CC4564935D24B
- MD5 SHA1 SHA512 TLSH