d210c95ff88b9d13fc648ad903e9b3ae7a96ffaa056294e4d560ae223c622411

Analysis

max time kernel
101s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
04/07/2025, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_1c2b2ab485fcb23826f68b3f53d67c4d.exe
Size 255KB
Sample250704-pgqceaswhy
SHA256 d210c95ff88b9d13fc648ad903e9b3ae7a96ffaa056294e4d560ae223c622411
MD5 1c2b2ab485fcb23826f68b3f53d67c4d
SHA1 004ca9896a55b1faf85a07395dbfbc70e85984da
SHA512 e08887f702478ab2e45490f56d132d901ad603e9bee14965cdb7a2033826245d000850ed17e4c650f38424a7bef6bf922f07204cd778071c373d51285db4dd62
SSDEEP 6144:h1OgDPdkBAFZWjadD4s53fRNVF98ESbWRI5lGIB7CuivCc:h1OgLdaO3fRNVF9LRIf7JACc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware defense_evasion discovery installer spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x001900000002b137-69.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2696	5209b00c8f3a9.exe

Loads dropped DLL 3 IoCs

pid	Process
2696	5209b00c8f3a9.exe
2696	5209b00c8f3a9.exe
2696	5209b00c8f3a9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\acppnechalmgaklhelhjopnemgnomlke\1\manifest.json	5209b00c8f3a9.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}\ = "ssafEy ssavye"	5209b00c8f3a9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}\NoExplorer = "1"	5209b00c8f3a9.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b137-69.dat	upx
behavioral2/memory/2696-73-0x0000000073E60000-0x0000000073E6A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5209b00c8f3a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1c2b2ab485fcb23826f68b3f53d67c4d.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x001900000002b112-29.dat	nsis_installer_1
behavioral2/files/0x001900000002b112-29.dat	nsis_installer_2
behavioral2/files/0x001c00000002b13e-98.dat	nsis_installer_1
behavioral2/files/0x001c00000002b13e-98.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}\InProcServer32\ThreadingModel = "Apartment"	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}\ProgID\ = "ssafEy ssavye.1"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\ssafEy ssavye\\5209b00c8f3e2.tlb"	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\ssafEy ssavye"	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}\InProcServer32	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}\ProgID	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}\ = "ssafEy ssavye"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	5209b00c8f3a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00E3111D-9E46-6634-1D2D-9FD115A7AB15}\InProcServer32\ = "C:\\ProgramData\\ssafEy ssavye\\5209b00c8f3e2.dll"	5209b00c8f3a9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2696	3920	JaffaCakes118_1c2b2ab485fcb23826f68b3f53d67c4d.exe	78
PID 3920 wrote to memory of 2696	3920	JaffaCakes118_1c2b2ab485fcb23826f68b3f53d67c4d.exe	78
PID 3920 wrote to memory of 2696	3920	JaffaCakes118_1c2b2ab485fcb23826f68b3f53d67c4d.exe	78

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	5209b00c8f3a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{00E3111D-9E46-6634-1D2D-9FD115A7AB15} = "1"	5209b00c8f3a9.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c2b2ab485fcb23826f68b3f53d67c4d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c2b2ab485fcb23826f68b3f53d67c4d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\5209b00c8f3a9.exe
  .\5209b00c8f3a9.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:2696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\ProgramData\ssafEy ssavye\uninstall.exe
Size 48KB
SHA256 a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
MD5 f3c79bda3fdf7c5dd24d60400a57cadb
SHA1 1adb606aaeedb246a371c8877c737f0f8c798625
SHA512 c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935
SSDEEP 1536:zLXB65939tY6HBg4sXJH74RoKu/DvrCyY:zLk395hYXJb45uveyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

5209b00c8f3a9.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\5209b00c8f3a9.exe
Size 71KB
SHA256 d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
MD5 b78633fae8aaf5f7e99e9c736f44f9c5
SHA1 26fc60e29c459891ac0909470ac6c61a1eca1544
SHA512 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43
SSDEEP 1536:zLXB65939tY6HBg4sXJHN4Romu/FvIqrCj/LnVL93MnYCyG:zLk395hYXJt45QvIXnda9yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

5209b00c8f3e2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\5209b00c8f3e2.dll
Size 116KB
SHA256 a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a
MD5 05234975b085632d70d89c2f420c5107
SHA1 078fb2a3e5de54c3737a4541242a4725c02c6b9c
SHA512 f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e
SSDEEP 3072:qX5UN7y6FLMpc577/k2CA+D5AjN5mWuTx:qpMy6xMpc5f/vtVjXuTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

5209b00c8f3e2.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\5209b00c8f3e2.tlb
Size 18KB
SHA256 a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492
MD5 c1e296ff01d3cf37f91c7473bdd9de52
SHA1 832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6
SHA512 aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c
SSDEEP 384:ix+/oLzbS7H48fU+rdHBI0qA9T1dLtFn19hXKwYw:i5bSDls6HBI0qG1dLjvf
MD5 SHA1 SHA512 SSDEEP

Submit Download

5209b00c8f1aa0.16612281.js

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\acppnechalmgaklhelhjopnemgnomlke\5209b00c8f1aa0.16612281.js
Size 4KB
SHA256 9009a6622fb132552a36e2c64093d53a82c963989f2759f7e15181fe040d12e9
MD5 892338e9d17fa5bc4c5e42817e34c758
SHA1 16deab49a3ba4414e1baba8d5437a2f02fa9204c
SHA512 4584a797fb756065d85b8faae9842f475ff2de4bd4756e36bf12413cf3f35910ac3ed0df4e475afe3f9674e98d8ed9bce12ff6599adeeda75b359b11f0d4cbf6
SSDEEP 96:Zh5LJxjTWgUn5FWN0wvpjeXY7/aU7HJJ0vOaE:/NKgUn5F7qpIY7/aU73
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\acppnechalmgaklhelhjopnemgnomlke\background.html
Size 161B
SHA256 e756e6ecb22c50267b5f6feda36e0ba7b34b83c93b6daee5d333c3f35c447260
MD5 5319bacf27ac1a6eae48f0dd0cdf94d7
SHA1 f9928a09aca5f2b89fab43074993016c371e7d9b
SHA512 ed5ef6af29e9c70fad19ec1d6e94e60dc9f527b917a1bc8684c4ca3be6c8593ddc3f20d7a52a50c1fb1e9322361e45bb934d03f77a589c4fc75275b17ada4c9d
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\acppnechalmgaklhelhjopnemgnomlke\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\acppnechalmgaklhelhjopnemgnomlke\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\acppnechalmgaklhelhjopnemgnomlke\manifest.json
Size 505B
SHA256 4a18c14a8aa9d68ef7d1a66ceeede61ed8212f7f4cbf3406c9930290d42be008
MD5 38ba829140ab2152baaea5ad447ebe9e
SHA1 860e538524b404f57fd30a27a25d571c8a3c2ab1
SHA512 2286bfa4f5cd9c8f2e77020463c280fb1ae3101cb6e2202b71f10890716c6758bf988267ed201a37fe048ff8b395314c4f5ec3fc4191108db6763b1a4dc4dba1
MD5 SHA1 SHA512

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\acppnechalmgaklhelhjopnemgnomlke\sqlite.js
Size 1KB
SHA256 ac6234d68f615c5ea55f022df7f27af9f553bbe84a9be7db3884ed3d776af300
MD5 98066c41e26301a8245e7738fb8e1730
SHA1 666c6137a479d4d9ab95f3834edd790d25aba713
SHA512 6af9c2148b4f041b519d3e1dc245f132597720f9830d0b7bb2b49dc279db6c0816aeebcbc803a276bd18b8d5740f0efe48a3e6f25f0814f74e1460ee318b134e
MD5 SHA1 SHA512

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\settings.ini
Size 6KB
SHA256 6c7ce2e7b47807d029a479049595e737433294075861cd6684fe3efdc2e1d515
MD5 687fa91f5de5deccba98497cf5b0d3fa
SHA1 dca52e0b3c963e12d95aae95d7ec8422cf4f9ef8
SHA512 445554a8060bfe631e183d05c5ce18df6989358fa8aa08ba72f1368df5a637a01f18221b0ddcf89ee22cd6982e22d50a1c85efc29a66b8a97402cf5dab249b61
SSDEEP 96:vioyJLQ5iPHQ3lpobx1EgkEovugEoKEoDuYEoAEo2EobK7j9s4k6rB4AWkTos/sx:X33o0vx+D9wKGVMMBssoWNnG8Gw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 6e153c1bb365b32e8c495271f486d5b59f6de898f1831f362a8f0f7d082ddea2
MD5 88e9b56672109bf3584208fae8555583
SHA1 0ef99092d80c461db8c103c82af7ad5b8c38f1c3
SHA512 e5a41ee88dadf26ae81efebdfb6dccc3b2572c1a5cb5b43ce61c6911494661f6caaaecfee704e5f1365014ea29129ba1289f9a6524f51829541cda4a89b4b1e8
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\[email protected]\chrome.manifest
Size 116B
SHA256 f67e7b44db71b1aeb29fd8f538df3915392bad8a160bc02bbeee43e99d881ac3
MD5 8e1b28166a4c1ddb1b01a757132cfa04
SHA1 5fb75f1dadd50cd03d776d1af19ede96b217a6cc
SHA512 2cb55a612501b08058448238ac1b49b81abb8860ff80e007e96b38c5b5966a75611d49f1eed8b7605df9a03434d1da4dd8057e554dd420e68389713be44a19d9
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 60a4e1acc6dcd801c31b40e80d1505e7a9eb63ad3c576ee512fb96bc23c3ee6c
MD5 5a43570e948b738d804874d1d9517067
SHA1 2c40cb03bfbadaf5a3979e47aa9754dc154c82ee
SHA512 592289415a5fd36cd8579a271ec15155fc8f21dfe2db2bb30d7bdbe8e6063b1de4cf29a8e79ee68c8a28d4d58f49d037a8d2b0b28c924440e7da23a1ea762482
SSDEEP 192:lo3v4kC5gXgGgz6gUg8gj5235UsZkJn7ERhzv59VqkYTyac76:uvLUlu1ZkJ4Pzv59TyyB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zSB65F.tmp\[email protected]\install.rdf
Size 608B
SHA256 c9d6c7c062c09a52e28ed21fe543c581537dd948d616fd62e83afab6474dba9e
MD5 d580b3b3f671c1851caf223829e3f953
SHA1 1f45196c7d68e457cf130072dfccca7a96e83f26
SHA512 37a87be2814ddedbba5cb95f5bf946336ce0393cade6033a51507fdf131673d23721a2e6ee1b841c37b26adcde231f4769c1fc3168bd63a75e43d6df264e555f
MD5 SHA1 SHA512

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nspB77A.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nspB77A.tmp\nsJSON.dll
Size 7KB
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2696-73-0x0000000073E60000-0x0000000073E6A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads