bee9e3434bd94fd65387d9be28cd467a41f61b1275383b55b0f59a1331270ae4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tesseract-ocr-w64-setup-5.5.3.20260724.exe
Size 25.3MB
Sample261102-ctqsgset7s
SHA256 bee9e3434bd94fd65387d9be28cd467a41f61b1275383b55b0f59a1331270ae4
MD5 5669f8e50ece28e7167facd2e345b7d5
SHA1 f62739b5f6c90b4450e2029719ca83dbc4249008
SHA512 6dbb4b6c1b829610753c3a1a46dc68950023b53e73bfca4e9cc357af65c68c5a88b4828d5c5254860619dd17c5328f2648fc5324ef88c5ef60345688ded2d0bc
SSDEEP 393216:/4JClEN/radOfAhvAh7XfM9RJ6sQQPMFH38RuykEhiLhPqZ0ggF7LyCWsiuN+ko1:/yKYTadS1XMFM9MILhu0r72CGuNvCfP9
TLSH
T1BF4733F6A07043FECBE182718C12FF93AD52BE5CC3946A8B7B61371D8A345D46189A35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
5092	tesseract-ocr-w64-setup-5.5.3.20260724.exe
5092	tesseract-ocr-w64-setup-5.5.3.20260724.exe
5092	tesseract-ocr-w64-setup-5.5.3.20260724.exe
5092	tesseract-ocr-w64-setup-5.5.3.20260724.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tesseract-ocr-w64-setup-5.5.3.20260724.exe

C:\Users\Admin\AppData\Local\Temp\tesseract-ocr-w64-setup-5.5.3.20260724.exe
"C:\Users\Admin\AppData\Local\Temp\tesseract-ocr-w64-setup-5.5.3.20260724.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nszC169.tmp\LangDLL.dll
Size 8KB
SHA256 1a3b738901baf1c82b37c7ee683cc31f2fabb518941eb876e3ef2257ff49653b
MD5 fe336b0f31a4353a7956058ebccffe5c
SHA1 99bc776ca80f436844603df1f9412924b9ffb626
SHA512 5983640897146ce063a8f4c42ccf8a91f4f5de244eb6e949104f679eef14fe86fc128ab76eefa596e2b2d28bfebb3a5483737c7a1bcc479168a6b28f089d8b8d
SSDEEP 192:NoZYkrGj20rjlK7uY/5yC1/2/cJPYL12NH:q6ks3lK7uYMCOw
TLSH
T1DD02A7EAFF1455F9D83396344196F25FC51D7026CA2B0D47FE170619BA2A9FC260D202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nszC169.tmp\System.dll
Size 28KB
SHA256 54167ae0968e05910ef8dcd8bbc345afe3dad810fd3c9d2d3f47ad4caffc456d
MD5 4fd5a2cd0c65c6552fea0cc11938f251
SHA1 e8f11c1f919eee06f8ebfde989ff53a15243e57f
SHA512 7703a4a59be8a1e349ae7435f9f3f25698aa774428c7e99cc34a27ce51cc41fe6ca09102dab6ead10fd71e30db14852f12ef57587845ec9ab85e70be2ad85609
SSDEEP 384:m9YwotlRxnX/+XWmsKP73mwYbhzc7qxD6jT6s6HXRes59:mOrRtXjtWGMqgjW6U
TLSH
T19DD2081AFF06C9F2C1E2D57049DFFB77C626B92847260E6BFF1E5E08B8236125909205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nszC169.tmp\UserInfo.dll
Size 7KB
SHA256 1b4111285f7a365fdbbe6aab4066cb9538fbf2835d59367b5bfbf9220069ac10
MD5 a2d8ded92e4815a45f45e19acdcadfcf
SHA1 cffb1d50a694f2b72c946ba3d6004e767f9777b2
SHA512 af6cf928b5bf8da67ad4221b39d9cbb39f2e3b21d4c927914308e9570b89ab7167e1c9e2e084cf8fde7c367ed7e2c6e8326fd7f5c9d055fd0e5106da4aadda88
SSDEEP 96:hkgP/nc/g5zVGuR6/qGG5n7ISObfy9uCnu:Rnc/oEY/57ISObiuCu
TLSH
T17BE1880AF73845F7D4A3E93080DFD22F7D197848561B1A09FF5B2D1A79266741C4E306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nszC169.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nszC169.tmp\nsDialogs.dll
Size 14KB
SHA256 3564ce8b510acfe456f7135e0c1ac1f71cfa39c787909192be8f8ed40dcbe305
MD5 a396d30099517546b62c0aa673929f93
SHA1 f3eea24ee7faf86638dfd8c730a544a94716378b
SHA512 b9d4f025c6858f0483cf34a53d07b60673dcba7e782bfe51a7e00294a87de8de0b5ede4c28bfc3869f2a11dff76a96d9da9dce2f1558a315116f182b73ba886f
SSDEEP 192:8SOu+kSRU4pMhMoITEZR1w5kY/5OlVcJSUDKCWw6SZS7ZDk7IQH:Ofk6TpMhMoIwZR6OYIlWJS6KCWw4UF
TLSH
T15E52D50DBB0A44F6D572E935548FE73F868CA515D66B4F06EF170B0CADA72B1281E342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5092-23-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/5092-4-0x0000000074569000-0x000000007456A000-memory.dmp

Download

memory/5092-25-0x0000000073F10000-0x0000000073F1C000-memory.dmp

Download

memory/5092-24-0x0000000074560000-0x000000007456E000-memory.dmp

Download

memory/5092-26-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/5092-28-0x0000000073F10000-0x0000000073F1C000-memory.dmp

Download

memory/5092-27-0x0000000074560000-0x000000007456E000-memory.dmp

Download

memory/5092-29-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/5092-31-0x0000000073F10000-0x0000000073F1C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads