Analysis
- max time kernel
101s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
04/07/2025, 16:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_1c61971f78d2805088bb9b341e9a0616.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target JaffaCakes118_1c61971f78d2805088bb9b341e9a0616.exe
- Size 551KB
- Sample250704-va2prawvbt
- SHA256 ecb3101ffaba49987de6fd7bf8e020bdb93601d185adaab412caf6859effccda
- MD5 1c61971f78d2805088bb9b341e9a0616
- SHA1 a9f0d3c85332e42e7ddda07317ab0a0ca379227c
- SHA512 1670182f311427138c6efecec6e4e0cc76290a9e75a875d640a1ad88169ba31518d85a260ba21c5dfb6926eee30188bd46bc1bfd6c7b9371ec1d5e35487b59c1
- SSDEEP 12288:h1OgLdaOSgbJuMmFcouJqkXWctn+MEfOj:h1OYdaOSgJHJJqkXtMOj
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 2916 regsvr32.exe 2916 regsvr32.exe - Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lafnndgoedeggdbeepaghakeegnbhgki\1.5\manifest.json regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\ = "siafe, sAAve" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\NoExplorer = "1" regsvr32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1c61971f78d2805088bb9b341e9a0616.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\safe regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe\CurVer\ = "safe sAVe.1.5" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\ProgID\ = "safe sAVe.1.5" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\InprocServer32\ = "C:\\ProgramData\\siafe, sAAve\\w.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\siafe, sAAve" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe.1.5 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe.1.5\ = "siafe, sAAve" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\VersionIndependentProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\ = "siafe, sAAve" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe\CLSID\ = "{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe.1.5\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe\ = "siafe, sAAve" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\VersionIndependentProgID\ = "safe sAVe" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe.safe regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sAVe.1.5\CLSID\ = "{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A10F517A-A84E-FE46-B48B-1BF7E0DC7F2A}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\siafe, sAAve\\w.tlb" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2916 1852 JaffaCakes118_1c61971f78d2805088bb9b341e9a0616.exe 78 PID 1852 wrote to memory of 2916 1852 JaffaCakes118_1c61971f78d2805088bb9b341e9a0616.exe 78 PID 1852 wrote to memory of 2916 1852 JaffaCakes118_1c61971f78d2805088bb9b341e9a0616.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c61971f78d2805088bb9b341e9a0616.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c61971f78d2805088bb9b341e9a0616.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /n /s /i:"" 5.dll2⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:2916
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\5.dll
- Size 203KB
- SHA256 7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf
- MD5 41b13b132cb601ecc466654b90296353
- SHA1 245258ddccb48826f22d57444f49fa30be1b36fd
- SHA512 0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6
- SSDEEP 6144:o303tYie2m88OP1y2Kue5SOddLup3W6DWI193LHdBVZtebTXnvIuvuMLXiFcoijN:/gbJuMmFcouJqk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\[email protected]\bootstrap.js
- Size 2KB
- SHA256 e9f19ebac9b91129745c06f2d986120cd4fc6a03581d3d1bac735fdd8441357b
- MD5 ad6328140d31dd39085a9e1fece672e7
- SHA1 35d7a360d770e3740654d3ec413944f29f43c45d
- SHA512 7351d1272ac4a8eb28bea913c79794a8bca86cb3ee571134e4377f1c8a7f871648ace516e35c89929ff62505b5b679e0e656f1363b313d8188e4eaebb2366844
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\[email protected]\chrome.manifest
- Size 96B
- SHA256 51edd07612d1097002d1723caca6162b9d23c539b5b8f5775759b558873084c2
- MD5 4a9194cb792cdbd7c26fdbc49f72a48d
- SHA1 4e3fcd51f3f535831f49eefafc1d54b90913bb35
- SHA512 152149b6f658fb977dab40fb2343f5446e4e5863b2d4fc6110cc8436952be39a9a31e829627f48d3c8be6c26f7dacd266e34f1bb6b84071dffff542e28f4e0b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\[email protected]\content\bg.js
- Size 9KB
- SHA256 b56ea4b9c878667bf1adbe4c6854a7eaacfea2678ef6557a82fcac20f309a3be
- MD5 8ef0721db25ae1c7c62850acfffb2104
- SHA1 d46218e48897b3da57c8ecafd52a543f503321cb
- SHA512 a29e610879ff8f4e6b19ac4ba0c7b8330eeb0df74951250c044734f210b1e7ee25054a96a39d6dc7d4b1b9ccd0090c582b62092b2dd0d609e960682f2987ce3c
- SSDEEP 192:lo3v4mCnZf235UsZkJn7ERhzUBaxsG+VgaBJEVqkYTyac76:uvbmlu1ZkJ4PzGkVTyyB2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\[email protected]\install.rdf
- Size 604B
- SHA256 7bb3ee6e6c342ba419ff0dc60b407c863e0be5953a9c0e0d2fe4d89700a62407
- MD5 e18f84c9bcd24c275e43d0b177df3f35
- SHA1 ebbe23a1e3078d5906bbdff324948cf3065f6df0
- SHA512 352cc5fca9f4810e5fc1e587f93b4f0b9e9b075a562c94544145def25001360a15766637f08f5215a0de0a1dd8231760fc51f16ae6e4051e205aaf7c81b7c81f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences
- Size 10KB
- SHA256 01dec4e12e2f63df0413afb235dfe0513f9c600f20c43c0da2d14c4536da4234
- MD5 19968fb83e32f408dc3f299e9486f0ec
- SHA1 18dda855cfd38676082828b378c5a6c0c74350ff
- SHA512 8ec543214bc43b87c774a087d64799942492a5fa3a56d1857de8b94e707d1e9b2bc2b25c7ab78b3509936e1f6220c70b5775bf5c6dd49772fa60209f1fbdadd0
- SSDEEP 192:xYsXWKQenZ8PRpsXS+WN4Y+S75PZAtqGUKQyIsnA/g4:xYsXWq8XsXcL+SVPkZ4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\lafnndgoedeggdbeepaghakeegnbhgki\WQ.js
- Size 5KB
- SHA256 e264626f09c3912142b79652942b5cc3604abdb47d40bbcbbb6038fb7f6c017d
- MD5 bdbf4908acf7534817424385e107fd71
- SHA1 b6746c9bd43007e22b2481966f4578ba63985ae5
- SHA512 bbcb725a9c5df84d06e4aa1bfdc0d7b88140908ae77ac15b1a3b5b86b4b86a13fc053c077f74bcb2eb66501f76e7f039df1787a5ae3159870ca1d6d8ad0f0d5f
- SSDEEP 96:Zh5LJxjTWgUMBaxsG+VgaBJyWN0wvpjeXY7/aU7HJJ0vOa4:/NKgUMBaxsG+VgaBJy7qpIY7/aU7T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\lafnndgoedeggdbeepaghakeegnbhgki\background.html
- Size 139B
- SHA256 3dd15c13821e34672e0821ebc94b1c5b811be5955e3fa6821565978bd88e66f7
- MD5 f51bf353286d4d47245de75a4c999857
- SHA1 52fdf9942133ae7c3ebecf82fbfba038080dea8d
- SHA512 c268d24d3ec88fda963b9d7299f3c60945b1ebf89ccbd3ba13e7c10c5a686598330947adab64e29bd2400e4455324b37414008843bb79932df52c980a02e68dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\lafnndgoedeggdbeepaghakeegnbhgki\content.js
- Size 197B
- SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
- MD5 5f9891607f65f433b0690bae7088b2c1
- SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
- SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\lafnndgoedeggdbeepaghakeegnbhgki\lsdb.js
- Size 559B
- SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
- MD5 209b7ae0b6d8c3f9687c979d03b08089
- SHA1 6449f8bff917115eef4e7488fae61942a869200f
- SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\lafnndgoedeggdbeepaghakeegnbhgki\manifest.json
- Size 504B
- SHA256 b3a2c51e8fbe1a9f9ed12881167644678bc5b22b710c678fbd014515d92bd166
- MD5 5e13e6c4d5c51079c3ed254b43e262f7
- SHA1 c0376a7f36f71ef49306fcf311b47e6b78cc6667
- SHA512 e3cb3c6ffb7610bf5461b65ff9b0dad9992306f2130759aa99c822120f71cbf21277d5ecd96b1cb95035a2ee3b5520fd5b1d01f0b79da7779ea11cb87e644d30
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\lafnndgoedeggdbeepaghakeegnbhgki\sqlite.js
- Size 1KB
- SHA256 29b2ae0c53790bcf2fb8695f78e6e1db88089a4830e15a48edf92a590d61dced
- MD5 499106547510c4895f6817541e2de207
- SHA1 ddc10c2cd46daa3911a702ad38814b816857719c
- SHA512 90fa23706b34c4e991f44c442226943c8ae8ee72c3a043eb6b5e7f3155829923a1818722e631df158da04dd9bac291d224f20851e090577d59a5150bd7efb5af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\settings.ini
- Size 7KB
- SHA256 f1090001daf1126cfd7a0293a9dbfeb95c15a03941b3c48cd110707977ddf644
- MD5 06a70894e6970891532360bd81b7d285
- SHA1 a5c35d58e4a63b07eda7d9fddea23326af29f1aa
- SHA512 50be94a479498b74eee26e3ab65b2b53b907ca3cbe5cbb758a1dec6a035d433b8ba68f108687a79235040b8a422a612575d36ca56535ae49799bc11cbebb660f
- SSDEEP 192:HSAY133pxpx9xixJjzx5cxmxNVMMBssoWO:HQrzqJjd5EukMu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\w.dll
- Size 180KB
- SHA256 028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149
- MD5 0e093772550eb9541dd715c016b5584a
- SHA1 20338dc859a5652f5661280dc508f4e5b533e76d
- SHA512 0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5
- SSDEEP 3072:n0Qv+W4vtnbzPOM0jfGv8RRNTwS5okrxp2:Zv+W4vtnbzWMEfGSwg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zSA519.tmp\w.tlb
- Size 2KB
- SHA256 7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1
- MD5 48e9706fe9f76731f3576122fc3e9e33
- SHA1 387c8c4898ead8ace488a7df80fead429eaf167b
- SHA512 e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6
- MD5 SHA1 SHA512