Threat LensFile scan report

Is ebonhold_1.0.5_x64-setup.exe safe?

Item: ebonhold_1.0.5_x64-setup.exe
Rating: 2.5
Author: MalwareTips File Scanner

58/100

Safety rating

Elevated risk

Verdict

Suspicious

Suspicious file assessment

3 high-confidence signature or behavior rules matched this file.

Do not install it until verified

Do not install it until verified

Read the full analysis

Saved file evidenceAntivirus consensus

1of 75 flagged

Flagged 1No detection 74

Digital specimenebonhold_1.0.5_x64-setup.exe8680fac1ecd0b0ce58…9399206f7a7e26

Size10.2 MB

Code signingSigner not verified

SandboxRuntime complete

First seen6d ago

Evidence3 priority signals

3 high-confidence signature or behavior rules matched this file.

Before installing

Do not install it until the source and publisher can be verified independently.

If you already installed it

Stop using it, scan the device, and watch for unexpected behavior or security alerts. Download a fresh installer from the developer's official site or an official app store.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

No saved analyst narrative

This report keeps the verified scan facts available below without inventing an analysis that was not saved with the scan.

Scan transparency

Coverage & freshness

4 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
1 of 75 engines flagged the file.
Updated Jun 25, 2026, 6:53 PM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated Jun 25, 2026, 7:55 PM UTC
Network
Partial
1 runtime contact was observed without a completed reputation cross-check.
Updated Jun 25, 2026, 7:55 PM UTC
YARA
Complete
5 signature or behavior rules matched.
Updated Jun 25, 2026, 7:55 PM UTC
External intel
Complete
3 of 3 independent reference sources completed.
Updated Jun 25, 2026, 7:55 PM UTC

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime flight recorder

Capture complete

1isolated sandbox run
21MITRE ATT&CK techniques
11spawned processes
1network contacts
23filesystem & mutex artifacts

What this file does

Observed actions and their security significance

High concern: Injected code into another process, a technique that can conceal execution.
High concern: Changed an auto-start location that can make code run after sign-in or restart.
High concern: Manipulated how the operating system loads code, which can redirect execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Scans through your files and folders.

These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

FileObserved
ebonhold_1.0.5_x64-setup.exe
8680fac1ecd0b0ce58e99dcbe5c9764c8842bf69af75cfb9699399206f7a7e26
01Uploaded file

Processes

Runtime execution

ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\ebonhold_1.0.5_x64-setup.exe"
02Isolated runtime analysis
ProcessObserved
Observed process
C:\Windows\Explorer.EXE
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

Written fileObserved
nssC66D.tmp
C:\Users\<USER>\AppData\Local\Temp\nssC66D.tmp
04Isolated runtime analysis
Written fileObserved
System.dll
C:\Users\<USER>\AppData\Local\Temp\nssC66E.tmp\System.dll
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

Network

Hosts contacted

Contacted hostObserved
162.159.36.2
Contact observed during runtime.
06Isolated runtime analysis

6 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1010T1012T1027· Obfuscated codeT1033· Reads user infoT1055· Process injectionT1057· Lists programsT1059· Runs commandsT1071· Application protocolT1082· System reconT1083· Scans your filesT1112T1115T1125T1129· Loads modulesT1134T1222T1485T1518· Checks your AVT1529T1547.009· Auto-startT1574· Execution hijack

Spawned processes

$(unnamed)

"C:\Users\<USER>\Desktop\ebonhold_1.0.5_x64-setup.exe"

$(unnamed)

C:\Windows\Explorer.EXE

$(unnamed)

C:\Windows\system32\services.exe

$(unnamed)

C:\Windows\System32\svchost.exe -k NetworkService -p

$(unnamed)

C:\Windows\system32\svchost.exe -k UnistackSvcGroup

$(unnamed)

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

$(unnamed)

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost

$(unnamed)

C:\Windows\system32\lsass.exe

+3 more processes captured.

Network activity

IP addresses1

162.159.36.2

Filesystem & mutexes

Files written15

C:\Users\<USER>\AppData\Local\Temp\nssC66D.tmp
C:\Users\<USER>\AppData\Local\Temp\nssC66E.tmp\System.dll
C:\Users\<USER>\AppData\Local\Temp\nssC66E.tmp\modern-wizard.bmp
C:\Users\<USER>\AppData\Local\Temp\nssC66E.tmp\nsDialogs.dll
C:\Users\<USER>\AppData\Local\Temp\nssC66E.tmp\nsis_tauri_utils.dll

+10 more

Files deleted6

C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update
C:\Users\<USER>\AppData\Local\Temp\nsqD284.tmp
C:\Users\<USER>\AppData\Local\Temp\nsvD2F3.tmp
C:\Users\user\AppData\Local\Temp\nsn4DDF.tmp

+1 more

Mutexes created2

cversions.3.m
Global\OneSettingQueryMutex+compat+encapsulation

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen

e153bf80f73051aae8f0…f78258Never scanned
never seen before
6a32397b51babc7673c3…bfe955Never scanned
never seen before
f942c40a34155aa4ead3…6bc2c5Never scanned
never seen before
aade2b63fc1e6cccdf2f…15cd88Never scanned
never seen before
b1350f487692057c8ffd…551fc0Never scanned
never seen before
3860bb6d19ed159f91e0…7ec35aNever scanned
never seen before
9baee42d66f715bba878…b40256Never scanned
never seen before
807590c24c354a943b8b…1eca52Never scanned
never seen before
8fc936ee48511dc4170d…1516e2Never scanned
never seen before
8b4c47c4cf5e76ec57dd…90d37cNever scanned
never seen before

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

RecordedObserved or authoritative facts

DerivedEvidence-backed analyst inferences

5rule hits recorded
1 / 75engines flagged
122sources in submission history

Evidence provenance

Why these facts are shown

Each statement identifies whether it was directly recorded or derived from saved scan facts.

01
3 high-confidence signature or behavior rules matched this file.
Verdict inputView chapter
ProvenanceDerived
SourceSignature and behavior rules
Observed atJun 25, 2026, 7:55 PM UTC
02
1 of 75 antivirus engines flagged the file, including Sophos.
Verdict inputView chapter
ProvenanceObserved
SourceAntivirus analysis
Observed atJun 25, 2026, 6:53 PM UTC
03
YARAify matched 2 researcher rules to this file.
View chapter
ProvenanceDerived
SourceSaved report facts
Observed atJun 25, 2026, 7:55 PM UTC
04
Scanned file: ebonhold_1.0.5_x64-setup.exe — 8680fac1ecd0b0ce58e99dcbe5c9764c8842bf69af75cfb9699399206f7a7e26
View chapter
ProvenanceObserved
SourceUploaded file
Observed atJun 25, 2026, 7:55 PM UTC
05
Observed process — "C:\Users\<USER>\Desktop\ebonhold_1.0.5_x64-setup.exe"
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atJun 25, 2026, 7:55 PM UTC
06
Observed process — C:\Windows\Explorer.EXE
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atJun 25, 2026, 7:55 PM UTC
07
File written: nssC66D.tmp — C:\Users\<USER>\AppData\Local\Temp\nssC66D.tmp
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atJun 25, 2026, 7:55 PM UTC
08
File written: System.dll — C:\Users\<USER>\AppData\Local\Temp\nssC66E.tmp\System.dll
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atJun 25, 2026, 7:55 PM UTC
09
Contacted host: 162.159.36.2 — Contact observed during runtime.
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atJun 25, 2026, 7:55 PM UTC

Evidence map

Detection sources at a glance

4 completed · 0 unavailable

Antivirus

Threat match

1/75 flagged

Malware samples

No match

no match

Researcher rules

Threat match

2 rules

Reference software

No match

no match

Threat attribution

No specific family attributed

The available sources did not agree on a named threat category.

External intelligence

Researcher-database matches found

One or more independent reference databases matched this hash.

Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

2 YARA3 heuristics

MITRE ATT&CK profile

Defense evasion× 1Cred access× 1C2× 1

Community YARA rules

Researcher-authored signatures reported by YARAify

Detect_NSIS_Nullsoft_Installer
PE_Digital_Certificate

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
high
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence
C:\Windows\Explorer.EXE
CredentialDumper
T1003 T1003.001
medium
Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
Evidence
C:\Windows\system32\lsass.exe
DirectIpC2
T1071
medium
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence
162.159.36.2

Antivirus consensus

1 of 75 engines flagged this file

1 malicious0 suspicious74 not flagged

Tier-117 engines

1flagged

Tier-241 engines

0flagged

Low-trust17 engines

0flagged

Sophosmalicious

Generic ML PUA (PUA)

View all 75 engine results

SophosDET

AcronisOK

AhnLab-V3OK

AlibabaOK

alibabacloudOK

ALYacOK

Antiy-AVLOK

APEXOK

ArcabitOK

AvastOK

Avast-Mobiletyp

AVGOK

AviraOK

BitDefenderOK

BitDefenderFalxtyp

BkavOK

CAT-QuickHealOK

ClamAVOK

CMCOK

CrowdStrikeOK

CTXOK

CylanceOK

CynetOK

DeepInstinctOK

DrWebOK

ElasticOK

EmsisoftOK

ESET-NOD32OK

F-SecureOK

FortinetOK

GDataOK

GoogleOK

GridinsoftOK

huorongOK

IkarusOK

JiangminOK

K7AntiVirusOK

K7GWOK

KasperskyOK

KingsoftOK

LionicOK

MalwarebytesOK

MaxSecureOK

McAfeeDOK

MicrosoftOK

MicroWorld-eScanOK

NANO-AntivirusOK

PaloaltoOK

PandaOK

RisingOK

SangforOK

SentinelOneOK

SkyhighOK

SUPERAntiSpywareOK

SymantecOK

SymantecMobileInsighttyp

TACHYONOK

tehtrisOK

TencentOK

TrapmineOK

TrellixENSOK

TrendMicroOK

TrendMicro-HouseCallOK

Trustlooktyp

VaristOK

VBA32OK

VIPREOK

VirITOK

ViRobotOK

WebrootOK

XcitiumOK

YandexOK

ZillyaOK

ZoneAlarmOK

ZonerOK

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 8.00Unpacked

Section entropy5 sections

.text

6.45

.rdata

5.10

.data

4.12

.ndata

0.00

.rsrc

5.88

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.

Common & new

Unique uploaders

122

Hundreds of people have uploaded this — common.

Total submissions

125

Includes repeat uploads by the same source.

First seen

6d ago

Jun 19, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

here

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: ebonhold_1.0.5_x64-setup.exe
Format: Win32 EXE
Code signing: Signature not verified: EbonholdLauncher
Size: 10.2 MB
Last analyzed: Jun 25, 2026, 7:55 PM UTC

SHA-256

8680fac1ecd0b0ce58e99dcbe5c9764c8842bf69af75cfb9699399206f7a7e26

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

We couldn't fully clear this file. Treat it with caution.

Recovery step 01
Don't install it unless you're certain it came from a source you trust.
Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
Recovery step 03
If its origin cannot be confirmed, delete this file and use a fresh copy from a trusted source. Download a fresh installer from the developer's official site or an official app store.
Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.

Safety FAQ

Direct answers grounded in the saved verdict and evidence in this report.

8 evidence-based answers

Is ebonhold_1.0.5_x64-setup.exe safe, or is it malware?

Evidence-based answer

ebonhold_1.0.5_x64-setup.exe is suspicious — treat it as unsafe until you're sure. 1 of 75 antivirus engines flag it; that detection signal contributes to the cautious verdict. Don't install it unless you fully trust where it came from. Download a fresh installer from the developer's official site or an official app store.

What is ebonhold_1.0.5_x64-setup.exe?

Evidence-based answer

ebonhold_1.0.5_x64-setup.exe is a software installer, about 10.2 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.

How many antivirus engines detected ebonhold_1.0.5_x64-setup.exe?

Evidence-based answer

1 of 75 antivirus engines flagged ebonhold_1.0.5_x64-setup.exe, 1 of them as outright malicious. The raw count alone does not establish safety or danger; we also weigh which engines flagged it and corroborating behavior, identity, reputation, and rule evidence.

I already downloaded and installed ebonhold_1.0.5_x64-setup.exe — what should I do?

Evidence-based answer

Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.

How do I remove ebonhold_1.0.5_x64-setup.exe?

Evidence-based answer

To remove ebonhold_1.0.5_x64-setup.exe: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete this file from the device, then empty the Recycle Bin or Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.

Is ebonhold_1.0.5_x64-setup.exe digitally signed?

Evidence-based answer

ebonhold_1.0.5_x64-setup.exe claims a signer of EbonholdLauncher, but the signature is not verified — an unverified or broken signature can be forged, so it should not be trusted as proof of who made the file.

What is the SHA-256 hash of ebonhold_1.0.5_x64-setup.exe?

Evidence-based answer

The SHA-256 hash of ebonhold_1.0.5_x64-setup.exe is 8680fac1ecd0b0ce58e99dcbe5c9764c8842bf69af75cfb9699399206f7a7e26, and its MD5 is 26687c80e4da79b8b83d596ebbe19a20. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

How up to date is this analysis of ebonhold_1.0.5_x64-setup.exe?

Evidence-based answer

This report reflects the scan run on June 25, 2026. Because a file's hash never changes, the identity of ebonhold_1.0.5_x64-setup.exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is ebonhold_1.0.5_x64-setup.exe safe?

Suspicious file assessment

Recommended next actions

Before installing

If you already installed it

No saved analyst narrative

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Runtime flight recorder

What this file does

Attack story

ebonhold_1.0.5_x64-setup.exe

Observed process

Observed process

nssC66D.tmp

System.dll

162.159.36.2

Why these facts are shown

Detection sources at a glance

Fingerprint and provenance

What to do now