extexport.exe

Internet Explorer ImpExp FF exporter file version info (xCyclopedia)

LOLBAS Execute 1 Sigma rule name it 1 ATT&CK technique 1 documented command 4 known copies with hashes

How extexport.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

foo bar

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for extexport.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Load a DLL located in the specified folder with one of the following names mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.

Extexport.exe {PATH_ABSOLUTE:folder} foo bar

Identify

Trips 1 Sigma rule: mediumPotential DLL Sideloading Activity Via ExtExport.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for extexport.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for extexport.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumPotential DLL Sideloading Activity Via ExtExport.EXEfrack113, Nasreddine Bencherchali (Nextron Systems)

T1218System Binary Proxy Execution

Is it the real extexport.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Internet Explorer\
C:\Program Files\internet explorer\

Signed byMicrosoft Windows

ProductInternet Explorer, Microsoft Corporation

DescriptionInternet Explorer ImpExp FF exporter

4 known copies

11.00.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Internet Explorer\ExtExport.exe · signed by Microsoft Windows

d8820e333be39b27712c42766d1f141cb45ffbe183c43286e55ecc1b9a82fa4b

11.00.19041.1 (WinBuild.160101.0800) · C:\Program Files\Internet Explorer\ExtExport.exe · signed by Microsoft Windows

edc454bca93a7d41d193a59953bde82766fc6874345a71bea2a8c52e71d06e29

11.00.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Internet Explorer\ExtExport.exe · signed by Microsoft Windows

25063b72fea5a86fe12073695f8a97e6bdc72a93417efcc0d4156ef39bc6b46b

11.00.17763.1 (WinBuild.160101.0800) · C:\Program Files\internet explorer\ExtExport.exe · signed by Microsoft Windows

d3156ee400dde48a9f7178cf5c8717a2553bf9acd3c2322717a53bf207842d8c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.