AI
Legitimate KL Setup installer
Local reference
Suspicious dependency
Inferred
Mal-ecule
O₂(CI)H₅(DbF₆Os₅Po₅U)Md₄(Bi₄BkPaPt)
Elevated NSIS loader with reboot and clipboard access: 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360.exe:0x9f2e
Elevated NSIS overlay loader with reboot and clipboard access: 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360.exe:0x9f2e
| 0x9eae | 720020006c00610075006e0063006800 | r. .l.a.u.n.c.h. |
| 0x9ebe | 69006e006700200069006e0073007400 | i.n.g. .i.n.s.t. |
| 0x9ece | 61006c006c0065007200000000004e00 | a.l.l.e.r.....N. |
| 0x9ede | 53004900530020004500720072006f00 | S.I.S. .E.r.r.o. |
| 0x9eee | 720000005c00540065006d0070000000 | r...\.T.e.m.p... |
| 0x9efe | 4c006f0077000000540045004d005000 | L.o.w...T.E.M.P. |
| 0x9f0e | 000054004d00500000007e006e007300 | ..T.M.P...~.n.s. |
| 0x9f1e | 7500250058002e0074006d0070000000 | u.%.X...t.m.p... |
| 0x9f2e | 53006500530068007500740064006f00 | S.e.S.h.u.t.d.o.Elevated NSIS overlay loader with reboot and clipboard access |
| 0x9f3e | 77006e00500072006900760069006c00 | w.n.P.r.i.v.i.l. |
| 0x9f4e | 65006700650000000000000000000000 | e.g.e........... |
| 0x9f5e | 000055585448454d450055534552454e | ..UXTHEME.USEREN |
| 0x9f6e | 56005345545550415049004150504845 | V.SETUPAPI.APPHE |
| 0x9f7e | 4c500050524f505359530044574d4150 | LP.PROPSYS.DWMAP |
| 0x9f8e | 4900435259505442415345004f4c4541 | I.CRYPTBASE.OLEA |
| 0x9f9e | 434300434c4243415451004e544d4152 | CC.CLBCATQ.NTMAR |
| 0x9fae | 54410000000000000000000000000000 | TA.............. |
| 0x9fbe | 0000250075002e002500750025007300 | ..%.u...%.u.%.s. |
| 0x9fce | 2500730000006f00700065006e000000 | %.s...o.p.e.n... |
| 0x9fde | 00002e0065007800650000005f004e00 | ....e.x.e..._.N. |
| 0x9fee | 620000000000975c4000616a40006860 | b......\@.aj@.h` |
| 0x9ffe | 4000f474400092594000520069006300 | @..t@..Y@.R.i.c. |
| 0xa00e | 68004500640069007400000000005200 | h.E.d.i.t.....R. |
| 0xa01e | 69006300680045006400690074003200 | i.c.h.E.d.i.t.2. |
| 0xa02e | 30005700000052696368456433320000 | 0.W...RichEd32.. |
| 0xa03e | 000052 | ..R |
| 0x16ea6 | 32015368656c6c457865637574654578 | 2.ShellExecuteEx |
| 0x16eb6 | 57000d00417070656e644d656e755700 | W...AppendMenuW. |
| 0x16ec6 | 1200426567696e5061696e7400002300 | ..BeginPaint..#. |
| 0x16ed6 | 43616c6c57696e646f7750726f635700 | CallWindowProcW. |
| 0x16ee6 | 3400436861724e657874410036004368 | 4.CharNextA.6.Ch |
| 0x16ef6 | 61724e65787457003900436861725072 | arNextW.9.CharPr |
| 0x16f06 | 657657004500436865636b446c674275 | evW.E.CheckDlgBu |
| 0x16f16 | 74746f6e00005200436c6f7365436c69 | tton..R.CloseCli |
| 0x16f26 | 70626f61726400006d00437265617465 | pboard..m.Create |
| 0x16f36 | 4469616c6f67506172616d5700007500 | DialogParamW..u. |
| 0x16f46 | 437265617465506f7075704d656e7500 | CreatePopupMenu. |
| 0x16f56 | 790043726561746557696e646f774578 | y.CreateWindowEx |
| 0x16f66 | 5700aa0044656657696e646f7750726f | W...DefWindowPro |
| 0x16f76 | 63570000b80044657374726f7957696e | cW....DestroyWin |
| 0x16f86 | 646f7700be004469616c6f67426f7850 | dow...DialogBoxP |
| 0x16f96 | 6172616d5700c1004469737061746368 | aramW...Dispatch |
| 0x16fa6 | 4d657373616765570000e20044726177 | MessageW....Draw |
| 0x16fb6 | 546578745700ee00456d707479436c69 | TextW...EmptyCliElevated NSIS loader with reboot and clipboard access |
| 0x16fc6 | 70626f6172640000ef00456e61626c65 | pboard....Enable |
| 0x16fd6 | 4d656e754974656d0000f500456e6162 | MenuItem....Enab |
| 0x16fe6 | 6c6557696e646f770000f800456e6444 | leWindow....EndD |
| 0x16ff6 | 69616c6f6700fa00456e645061696e74 | ialog...EndPaint |
| 0x17006 | 000015014578697457696e646f777345 | ....ExitWindowsE |
| 0x17016 | 7800160146696c6c5265637400001901 | x...FillRect.... |
| 0x17026 | 46696e6457696e646f77457857003101 | FindWindowExW.1. |
| 0x17036 | 476574436c617373496e666f57003701 | GetClassInfoW.7. |
| 0x17046 | 476574436c69656e7452656374004601 | GetClientRect.F. |
| 0x17056 | 4765744443005001476574446c674974 | GetDC.P.GetDlgIt |
| 0x17066 | 656d00005301476574446c674974656d | em..S.GetDlgItem |
| 0x17076 | 5465787457008b014765744d65737361 | TextW...GetMessa |
| 0x17086 | 6765506f7300c701476574537973436f | gePos...GetSysCo |
| 0x17096 | 6c6f7200ca0147657453797374656d4d | lor...GetSystemM |
| 0x170a6 | 656e7500cb0147657453797374656d4d | enu...GetSystemM |
| 0x170b6 | 6574726963730000eb0147657457696e | etrics....GetWin |
| 0x170c6 | 646f774c6f6e67570000f20147657457 | dowLongW....GetW |
| 0x170d6 | 696e646f7752656374002502496e7661 | indowRect.%.Inva |
| 0x170e6 | 6c69646174655265637400004b024973 | lidateRect..K.Is |
| 0x170f6 | 57696e646f7700004d02497357696e64 | Window..M.IsWind |
| 0x17106 | 6f77456e61626c656400510249735769 | owEnabled.Q.IsWi |
| 0x17116 | 6e646f7756697369626c65005d024c6f | ndowVisible.].Lo |
| 0x17126 | 6164437572736f72570061024c6f6164 | adCursorW.a.Load |
| 0x17136 | 496d6167655700008e024d6573736167 | ImageW....Messag |
| 0x17146 | 65426f78496e6469726563745700a202 | eBoxIndirectW... |
| 0x17156 | 4f70656e436c6970626f61726400b002 | OpenClipboard...Elevated NSIS overlay loader with reboot and clipboard access |
| 0x17166 | 5065656b4d657373616765570000b502 | PeekMessageW.... |
| 0x17176 | 506f7374517569744d65737361676500 | PostQuitMessage. |
| 0x17186 | e7025265676973746572436c61737357 | ..RegisterClassW |
| 0x17196 | 0000040352656c656173654443001103 | ....ReleaseDC... |
| 0x1e7ee | 00000000000000000000000000000000 | ................ |
| 0x1e7fe | 00000000000000000000000000000000 | ................ |
| 0x1e80e | 00000000000000000000440234000000 | ..........D.4... |
| 0x1e81e | 560053005f0056004500520053004900 | V.S._.V.E.R.S.I. |
| 0x1e82e | 4f004e005f0049004e0046004f000000 | O.N._.I.N.F.O... |
| 0x1e83e | 0000bd04effe00000000150003000000 | ................ |
| 0x1e84e | 00001500030000000000000000000000 | ................ |
| 0x1e85e | 00000400000001000000000000000000 | ................ |
| 0x1e86e | 000000000000a2010000000053007400 | ............S.t. |
| 0x1e87e | 720069006e006700460069006c006500 | r.i.n.g.F.i.l.e. |
| 0x1e88e | 49006e0066006f0000007e0100000000 | I.n.f.o...~..... |
| 0x1e89e | 30003800300034003000330061003800 | 0.8.0.4.0.3.a.8. |
| 0x1e8ae | 00004a001500010043006f006d007000 | ..J.....C.o.m.p. |
| 0x1e8be | 61006e0079004e0061006d0065000000 | a.n.y.N.a.m.e... |
| 0x1e8ce | 00004e006500740077006f0072006b00 | ..N.e.t.w.o.r.k. |
| 0x1e8de | 200049006e0063006f00720070006f00 | .I.n.c.o.r.p.o. |
| 0x1e8ee | 72006100740065006400000000003a00 | r.a.t.e.d.....:. |
| 0x1e8fe | 09000100460069006c00650044006500 | ....F.i.l.e.D.e. |
| 0x1e90e | 73006300720069007000740069006f00 | s.c.r.i.p.t.i.o. |
| 0x1e91e | 6e00000000004b004c00200053006500 | n.....K.L. .S.e. |
| 0x1e92e | 74007500700000000000320009000100 | t.u.p.....2..... |
| 0x1e93e | 460069006c0065005600650072007300 | F.i.l.e.V.e.r.s. |
| 0x1e94e | 69006f006e000000000033002e003200 | i.o.n.....3...2. |
| 0x1e95e | 31002e0030002e003000000000004a00 | 1...0...0.....J. |
| 0x1e96e | 130001004c006500670061006c004300 | ....L.e.g.a.l.C. |
| 0x1e97e | 6f007000790072006900670068007400 | o.p.y.r.i.g.h.t. |
| 0x1e98e | 000043006f0070007900720069006700 | ..C.o.p.y.r.i.g. |
| 0x1e99e | 68007400200028006300290020003200 | h.t. .(.c.). .2. |
| 0x1e9ae | 30003200360000000000260003000100 | 0.2.6.....&..... |
| 0x1e9be | 500072006f0064007500630074004e00 | P.r.o.d.u.c.t.N. |
| 0x1e9ce | 61006d006500000000004b004c000000 | a.m.e.....K.L... |
| 0x1e9de | 0000360009000100500072006f006400 | ..6.....P.r.o.d. |
| 0x1e9ee | 75006300740056006500720073006900 | u.c.t.V.e.r.s.i. |
| 0x1e9fe | 6f006e00000033002e00320031002e00 | o.n...3...2.1... |
| 0x1ea0e | 30002e00300000000000440000000000 | 0...0.....D..... |
| 0x1ea1e | 560061007200460069006c0065004900 | V.a.r.F.i.l.e.I. |
| 0x1ea2e | 6e0066006f0000000000240004000000 | n.f.o.....$..... |
| 0x1ea3e | 5400720061006e0073006c0061007400 | T.r.a.n.s.l.a.t. |
| 0x1ea4e | 69006f006e00000000000408a8030000 | i.o.n........... |
| 0x1ea5e | 00003c3f786d6c2076657273696f6e3d | ..<?xml version=Elevated NSIS loader with reboot and clipboard access |
| 0x1ea6e | 22312e302220656e636f64696e673d22 | "1.0" encoding=" |
| 0x1ea7e | 5554462d3822207374616e64616c6f6e | UTF-8" standalon |
| 0x1ea8e | 653d22796573223f3e3c617373656d62 | e="yes"?><assemb |
| 0x1ea9e | 6c7920786d6c6e733d2275726e3a7363 | ly xmlns="urn:sc |
| 0x1eaae | 68656d61732d6d6963726f736f66742d | hemas-microsoft- |
| 0x1eabe | 636f6d3a61736d2e763122206d616e69 | com:asm.v1" mani |
| 0x1eace | 6665737456657273696f6e3d22312e30 | festVersion="1.0 |
| 0x1eade | 223e3c617373656d626c794964656e74 | "><assemblyIdent |
| 0x1ec3b | 67756167653d222a22202f3e3c2f6465 | guage="*" /></de |
| 0x1ec4b | 70656e64656e74417373656d626c793e | pendentAssembly> |
| 0x1ec5b | 3c2f646570656e64656e63793e3c7472 | </dependency><tr |
| 0x1ec6b | 757374496e666f20786d6c6e733d2275 | ustInfo xmlns="u |
| 0x1ec7b | 726e3a736368656d61732d6d6963726f | rn:schemas-micro |
| 0x1ec8b | 736f66742d636f6d3a61736d2e763322 | soft-com:asm.v3" |
| 0x1ec9b | 3e3c73656375726974793e3c72657175 | ><security><requ |
| 0x1ecab | 657374656450726976696c656765733e | estedPrivileges> |
| 0x1ecbb | 3c726571756573746564457865637574 | <requestedExecutElevated NSIS overlay loader with reboot and clipboard access |
| 0x1eccb | 696f6e4c6576656c206c6576656c3d22 | ionLevel level=" |
| 0x1ecdb | 7265717569726541646d696e69737472 | requireAdministr |
| 0x1eceb | 61746f72222075694163636573733d22 | ator" uiAccess=" |
| 0x1ecfb | 66616c7365222f3e3c2f726571756573 | false"/></reques |
| 0x1ed0b | 74656450726976696c656765733e3c2f | tedPrivileges></ |
| 0x1ed1b | 73656375726974793e3c2f7472757374 | security></trust |
| 0x1ed2b | 496e666f3e3c636f6d7061746962696c | Info><compatibil |
| 0x1ed3b | 69747920786d6c6e733d2275726e3a73 | ity xmlns="urn:s |
| 0x1ed4b | 6368656d61732d6d6963726f736f6674 | chemas-microsoft |
| 0x1ed5b | 2d636f6d3a636f6d7061746962696c69 | -com:compatibili |
| 0x1ed6b | 74792e7631223e3c6170706c69636174 | ty.v1"><applicat |
| 0x1ed7b | 696f6e3e3c737570706f727465644f53 | ion><supportedOS |
| 0x1ed8b | 2049643d227b38653066376131322d62 | Id="{8e0f7a12-b |
| 0x1ed9b | 6662332d346665382d623961352d3438 | fb3-4fe8-b9a5-48 |
| 0x1edab | 666435306131356139617d222f3e3c73 | fd50a15a9a}"/><s |
| 0x1edbb | 7570706f727465644f532049643d227b | upportedOS Id="{ |
| 0x1edcb | 31663637366337362d383065312d3432 | 1f676c76-80e1-42 |
| 0x1eddb | 33392d393562622d3833643066366430 | 39-95bb-83d0f6d0 |
| 0x1edeb | 646137387d222f3e3c73 | da78}"/><s |
| 0x1ef80 | 00000000000000000000000000000000 | ................ |
| 0x1ef90 | 00000000000000000000000000000000 | ................ |
| 0x1efa0 | 00000000000000000000000000000000 | ................ |
| 0x1efb0 | 00000000000000000000000000000000 | ................ |
| 0x1efc0 | 00000000000000000000000000000000 | ................ |
| 0x1efd0 | 00000000000000000000000000000000 | ................ |
| 0x1efe0 | 00000000000000000000000000000000 | ................ |
| 0x1eff0 | 00000000000000000000000000000000 | ................ |
| 0x1f000 | 00000000efbeadde4e756c6c736f6674 | ........NullsoftElevated NSIS overlay loader with reboot and clipboard access |
| 0x1f010 | 496e73747c550000ff0f11055d000080 | Inst|U......]... |
| 0x1f020 | 00003e153c18a100680aa82e85d58478 | ..>.<...h......x |
| 0x1f030 | 9b05e8fb77f7434ad2538061a0ef7f81 | ....w.CJ.S.a.... |
| 0x1f040 | 4007dc4ddd788d7369c2fb2998c28dff | @..M.x.si..).... |
| 0x1f050 | 2862f25a62681f7e8ab249bf3213f96f | (b.Zbh.~..I.2..o |
| 0x1f060 | c45177d01e4d97ce939b80e3b4bb050e | .Qw..M.......... |
| 0x1f070 | 0bafc70e14f57cdd63bbba1ff952a951 | ......|.c....R.Q |
| 0x1f080 | 292ca75b577983d94acad9d1fbf2f890 | ),.[Wy..J....... |
| 0x1f090 | 44d14f918ac63fbc6788b526598d095e | D.O...?.g..&Y..^ |
| 0x1f0a0 | f0d6da673a97b050899de1ea556668c9 | ...g:..P....Ufh. |
| 0x1f0b0 | 66a54286136e9fe607d45eade7b76ab4 | f.B..n....^...j. |
| 0x1f0c0 | 3b8324be71c8705d4a3effb41e610a53 | ;.$.q.p]J>...a.S |
| 0x1f0d0 | 79920ac05ca52eedd9180109f3e12538 | y...\.........%8 |
| 0x1f0e0 | c7b332971192a9d71c98e3c10592663f | ..2...........f? |
| 0x1f0f0 | 52698e96bbb4a8bb11fb12c45e2a2f2d | Ri..........^*/- |
| 0x1f100 | a6d0f17ad19b9ac386871e8b3183bc22 | ...z........1.." |
| 0x1f110 | 88e5726adb30d8f64dcf1972aeceed0d | ..rj.0..M..r.... |
| 0x1f120 | 7ca3647966b5087c7eb25ec3b380b615 | |.dyf..|~.^..... |
| 0x1f130 | f223cf3dbf13e2b86512624af9ef57a9 | .#.=....e.bJ..W. |
| 0x1f140 | 389bfe6e611c571371938c90b373de43 | 8..na.W.q....s.C |
| 0x1f150 | 19aea7a44382f0462d7a7543f06dd1de | ....C..F-zuC.m.. |
| 0x1f160 | 39b501686021aac24b342134d390bd47 | 9..h`!..K4!4...G |
| 0x1f170 | 6b8d1b11318cabc8c14a0242f7531ce5 | k...1....J.B.S.. |
| 0x1f180 | 85f330633b494ee82447a8d0060981ac | ..0c;IN.$G...... |
| 0x1f190 | c11d2a7663fc6e1fb26763031d36a536 | ..*vc.n..gc..6.6 |
| 0x1f1a0 | ed0f73c06bd572e023f0ecf32ff4428b | ..s.k.r.#.../.B. |
| 0x1f1b0 | c5d7259c72a8d90922257d7d0415ef18 | ..%.r..."%}}.... |
| 0x1f1c0 | 9b706f3fc1742db3e3530735f92d69f1 | .po?.t-..S.5.-i. |
| 0x1f1d0 | 862167209dc65d0bea797262d564bc67 | .!g ..]..yrb.d.g |
| 0x1f1e0 | d7ea3797656c47a574ac81a66c1fc4b0 | ..7.elG.t...l... |
| 0x1f1f0 | b724ec8bbc7f895c4dada99721791994 | .$.....\M...!y.. |
| 0x1f200 | 19e44c2802b608d9272583cf43312ec3 | ..L(....'%..C1.. |
| 0x1f210 | 33efdd76e0366332906bf0a787d14a1d | 3..v.6c2.k....J. |
| 0x1f220 | 81280fa904441a390ad11146f998a938 | .(...D.9...F...8 |
| 0x1f230 | c8b52311b9d39bca47a76b6dae53e79b | ..#.....G.km.S.. |
| 0x1f240 | f5dfeaca5949a2602cf635372536ab76 | ....YI.`,.57%6.v |
| 0x1f250 | 4b4414fef65af3fb631f7a73ea82318a | KD...Z..c.zs..1. |
| 0x1f260 | 54072efe62e50070a38cf3b492e9cc9c | T...b..p........ |
| 0x1f270 | 334b8790c568f921cd602c750224cd54 | 3K...h.!.`,u.$.T |
Objectives
Micro-behaviors
Metadata
notable severity, 100% confident.
build
PE manifest requests admin
file
20 of 29 traits shown
Identity
| SHA-256 | 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360 |
|---|---|
| Filename | 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360.exe |
| Package | 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360 |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | windows |
| Domain | abuse.ch |
Timeline
| First seen | 18 Jul 2026 15:53 UTC |
|---|---|
| First analyzed | 19 Jul 2026 17:21 UTC |
| Last analyzed | 19 Jul 2026 17:21 UTC |
| Last updated | 19 Jul 2026 17:21 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 32522 |
Not seeing what you expected? Let us know