File name:

EzExtractSetup.exe

Full analysis: https://app.any.run/tasks/4d615fcf-4349-404c-ad78-d7aae9d11f8b
Verdict: Malicious activity
Analysis date: November 02, 2024, 14:31:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

7399EBE1E1B9C99F3CB4A2521D424384

SHA1:

7A560782421FEB72B1E84F162CF0ABD0809FDA28

SHA256:

4704846C5605552A2573AEB62F176630FD2BA5498457420C3FB36A27CAE6800F

SSDEEP:

98304:QBXfMTSPotXjLlZa6XloPaUP0KsdzGP5shhrLAvKxKEczZRNNYyWs0CbXnoGAyvp:QioCUm5m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • EzExtractSetup.exe (PID: 5920)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • EzExtractSetup.exe (PID: 5920)

    • Checks Windows Trust Settings

      • EzExtractSetup.exe (PID: 5920)

    • The process creates files with name similar to system file names

      • EzExtractSetup.exe (PID: 5920)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 4812)

    • Executable content was dropped or overwritten

      • EzExtractSetup.exe (PID: 5920)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • EzExtractSetup.exe (PID: 5920)

  • INFO

    • Creates files or folders in the user directory

      • EzExtractSetup.exe (PID: 5920)

    • Checks proxy server information

      • EzExtractSetup.exe (PID: 5920)

    • Reads the software policy settings

      • EzExtractSetup.exe (PID: 5920)

    • Reads the machine GUID from the registry

      • EzExtractSetup.exe (PID: 5920)

    • Checks supported languages

      • EzExtractSetup.exe (PID: 5920)

    • Reads the computer name

      • EzExtractSetup.exe (PID: 5920)

    • Manual execution by a user

      • WinRAR.exe (PID: 7084)
      • EzExtractProApp.exe (PID: 7076)

    • Create files in a temporary directory

      • EzExtractSetup.exe (PID: 5920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:58:45+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 186880
UninitializedDataSize: 2048
EntryPoint: 0x3665
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Empire Security Services Inc
FileDescription: EzExtractPro
FileVersion: 1.0.0.1
LegalCopyright: Copyright © Empire Security Services Inc 2024
ProductName: EzExtractPro
ProductVersion: 1.0.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ezextractsetup.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs explorer.exe no specs explorer.exe no specs ezextractproapp.exe sppextcomobj.exe no specs slui.exe no specs winrar.exe no specs ezextractproapp.exe ezextractsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2648C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
3608 /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll"C:\Windows\System32\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4812"C:\WINDOWS\explorer.exe" "C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe"C:\Windows\explorer.exe—EzExtractSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
5920"C:\Users\admin\AppData\Local\Temp\EzExtractSetup.exe" C:\Users\admin\AppData\Local\Temp\EzExtractSetup.exe
explorer.exe
User:
admin
Company:
Empire Security Services Inc
Integrity Level:
HIGH
Description:
EzExtractPro
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\ezextractsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5952"C:\Users\admin\AppData\Local\Temp\EzExtractSetup.exe" C:\Users\admin\AppData\Local\Temp\EzExtractSetup.exe—explorer.exe
User:
admin
Company:
Empire Security Services Inc
Integrity Level:
MEDIUM
Description:
EzExtractPro
Exit code:
3221226540
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\ezextractsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6168C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6268C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell.dll"C:\Windows\SysWOW64\regsvr32.exe—EzExtractSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6544C:\WINDOWS\system32\regsvr32.exe /s "C:\Program Files (x86)\EzExtractPro\EzExtractProShell32.dll"C:\Windows\SysWOW64\regsvr32.exe—EzExtractSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6892"C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe" C:\Program Files (x86)\EzExtractPro\EzExtractProApp.exe
explorer.exe
User:
admin
Company:
Empire Security Services Inc
Integrity Level:
MEDIUM
Description:
EzExtractPro
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files (x86)\ezextractpro\ezextractproapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7048"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
8 344
Read events
8 245
Write events
96
Delete events
3

Modification events

(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EzExtractPro
Operation:writeName:InstallPath
Value:
C:\Program Files (x86)\EzExtractPro
(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EzExtractPro
Operation:writeName:DisplayName
Value:
EzExtractPro 1.0.0.1
(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EzExtractPro
Operation:writeName:InstallDate
Value:
20241102
(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EzExtractPro
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\EzExtractPro\
(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EzExtractPro
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\EzExtractPro\uninstall.exe
(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EzExtractPro
Operation:writeName:DisplayVersion
Value:
1.0.0.1
(PID) Process:(5920) EzExtractSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EzExtractPro
Operation:writeName:Publisher
Value:
Copyright © Empire Security Services Inc 2024
Executable files
9
Suspicious files
8
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5920EzExtractSetup.exeC:\Users\admin\AppData\Local\Temp\nsuB8BB.tmp —
MD5:—
SHA256:—
5920EzExtractSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8der
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
5920EzExtractSetup.exeC:\Users\admin\AppData\Local\Temp\nsjB8CB.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
5920EzExtractSetup.exeC:\Users\admin\AppData\Local\Temp\nsjB8CB.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
5920EzExtractSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:7B4A29C927FCE9749661C1A730624150
SHA256:20B21D2830E5A116D81151DD83F1D76A34D5F3DF654CAB524904CF9FEA688AAB
5920EzExtractSetup.exeC:\Users\admin\AppData\Local\Temp\nsjB8CB.tmp\INetC.dllexecutable
MD5:40D7ECA32B2F4D29DB98715DD45BFAC5
SHA256:85E03805F90F72257DD41BFDAA186237218BBB0EC410AD3B6576A88EA11DCCB9
5920EzExtractSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:67E486B2F148A3FCA863728242B6273E
SHA256:FACAF1C3A4BF232ABCE19A2D534E495B0D3ADC7DBE3797D336249AA6F70ADCFB
5920EzExtractSetup.exeC:\Users\admin\AppData\Local\Temp\nsjB8CB.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
5920EzExtractSetup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\EzExtractPro\EzExtractPro.lnkbinary
MD5:C8C2E803C0776795CF7FA617F67D8D92
SHA256:27D14209631E62FF8FDA98C34DDEA2D3B78CD87475B2C57EC8A1AD46AC0EC1AB
6892EzExtractProApp.exeC:\Users\admin\AppData\Roaming\EzExtractProApp\EzExtractProAppConfig.jsontext
MD5:974C740142D45D47282FF301FFD18336
SHA256:0AB330F8E59722EAC8596C97A1334C040550A84C7C2A90336EA0BCDFC12719DB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
48
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5920
EzExtractSetup.exe
GET
200
172.217.18.3:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7124
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4700
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5920
EzExtractSetup.exe
GET
200
172.217.18.3:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1248
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7124
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1252
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5920
EzExtractSetup.exe
172.67.181.227:443
ezextractinstaller.com
CLOUDFLARENET
US
unknown
5920
EzExtractSetup.exe
172.217.18.3:80
c.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 104.126.37.153
  • 104.126.37.170
  • 104.126.37.160
  • 104.126.37.171
  • 104.126.37.137
  • 104.126.37.130
  • 104.126.37.179
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.161
  • 104.126.37.163
  • 104.126.37.178
  • 104.126.37.162
  • 104.126.37.176
  • 104.126.37.154
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 172.217.18.14
whitelisted
ezextractinstaller.com
  • 172.67.181.227
  • 104.21.32.2
unknown
c.pki.goog
  • 172.217.18.3
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.159.2
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.0
  • 20.190.159.75
whitelisted
th.bing.com
  • 104.126.37.171
  • 104.126.37.170
  • 104.126.37.160
  • 104.126.37.161
  • 104.126.37.178
  • 104.126.37.186
  • 104.126.37.153
  • 104.126.37.179
  • 104.126.37.185
whitelisted

Threats

No threats detected
Process
Message
EzExtractProApp.exe
Start save config
EzExtractProApp.exe
End save config
EzExtractProApp.exe
Start save config
EzExtractProApp.exe
End save config
EzExtractProApp.exe
End save config
EzExtractProApp.exe
Start save config
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EzExtractSetup.exe