50d74acbfbce8f365e4b6edf584fdf0abb08d1388372893307656ace66f57520

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
Size 313KB
Sample261014-ekzp5sysat
SHA256 50d74acbfbce8f365e4b6edf584fdf0abb08d1388372893307656ace66f57520
MD5 6eba38839801172e1906b27416a4f11d
SHA1 dfe54573c91a5cd6dc2a0080044124faf683ec58
SHA512 b6b738956245adb0f6fd97b3e9dc134813a0350deec2af721fe73759ee7e86c55d9c253ef56a1856f923bac8a22a0f0ab1d5e411cb182966e735e425a0ca83f4
SSDEEP 6144:91OgDPdkBAFZWjadD4sllVYO0veS+CYYSe2me6/5H4YVd/g91Lr:91OgLdakrw2N6g/P
TLSH
T12B64E12139E0C8BAD5931432CAA46FD5F2F9D6240F318CB723DD0A2D2E7D595C63672A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery installer spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2544	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
2544	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E621226-3806-2AEF-BCB6-7F533B554A65}\NoExplorer = "1"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E621226-3806-2AEF-BCB6-7F533B554A65}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E621226-3806-2AEF-BCB6-7F533B554A65}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E621226-3806-2AEF-BCB6-7F533B554A65}\ = "wxDfast"	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c4a7-31.dat	nsis_installer_1
behavioral2/files/0x000d00000001c4a7-31.dat	nsis_installer_2

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\wxDfast\\bhoclass.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{0E621226-3806-2AEF-BCB6-7F533B554A65}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\ = "wxDfast"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "wxDfast"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\ProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID\ = "{0E621226-3806-2AEF-BCB6-7F533B554A65}"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\ProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\Programmable	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\InprocServer32\ = "C:\\ProgramData\\wxDfast\\bhoclass.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\wxDfast"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\Programmable	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\VersionIndependentProgID\ = "bhoclass.bho"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\ = "wxDfast Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}\ProgID\ = "bhoclass.bho.1.0"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2544	1296	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe	89

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{0E621226-3806-2AEF-BCB6-7F533B554A65} = "1"	setup.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\setup.exe
  .\setup.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\[email protected]\chrome.manifest
Size 114B
SHA256 d0b502fbc1427585953dd5b09ba769214c7811c6cbd01203688033cf38913f4d
MD5 b0a532baac6a0489d2dfef88386e2a10
SHA1 1fab72cbd60573615715609b7b1082cc9c0147c5
SHA512 a4a067ad9234b9b28beb189632f0cb2a3356f0c3d94a608daefe6a5b1b69c31f086051095255df252d91dddb7e76f6da28193babdefac08b6d0d8782e411d3ea
TLSH
T16EB09233470F40E927AAF8915042B0103A70880481C9181272A604DC42C0350CACCB55
MD5 SHA1 SHA512 TLSH

Submit Download

indexeddb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\[email protected]\content\indexeddb.js
Size 1KB
SHA256 d6d5681de0430637a18738b9b8f7c1eb469d758c0076a4f7bc457ff49367525b
MD5 c1cb4f07798a4ca3f5a508c76de349ac
SHA1 3df966863e2073bd4f62e04a864d5808975d1896
SHA512 54422e72050ce38deee6733bc49a9f1bf3e5dacfdc32125f6bcba273c987335763b29f3daa5a18efec6ef70ffff0f56429827bd0c879215a219c59440485712b
TLSH
T137217059BA8EB43A943A712B546F7648302BD0508D1C8831EDF4D6E64E7451F9B0E57C
MD5 SHA1 SHA512 TLSH

Submit Download

jquery.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\[email protected]\content\jquery.js
Size 91KB
SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
MD5 4bab8348a52d17428f684ad1ec3a427e
SHA1 56c912a8c8561070aee7b9808c5f3b2abec40063
SHA512 a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480
SSDEEP 1536:k5RKUpVgklsdruLP/l+0fGzA8gmtasgx/c9Rzzi4yff8qeLvHHEjam7rSnmBn9gn:Ee8bbGzA81+xRRi1Z3
TLSH
T18193E7D9B2D6716387B731BC50AF510BB13698AA784C8C50F068D8E4BE74A48907BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsext.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\[email protected]\content\jsext.js
Size 6KB
SHA256 c3948e79e457f40417a58edae550a98747282092da70a045cc6f0352830b680b
MD5 d00d10f2e4bfdb74fb0c47d0663d5961
SHA1 572f3231b47f5e4321676983670b84e067b16468
SHA512 a6f2ba68641d9facf64c930765de57e7d7397b554a46634d21197801c05885f813b7bdce80ac239ea7bec1073be8cc97921074ae061ace2fab78b46e23af20ed
SSDEEP 96:5GQKrDvuvUPnFN3OZC70FTysWEv9/WYM4iwHFxg/g0SdBv133zPCoal4c0dm6:5GkvUOzZ7vbhn3g4c4X
TLSH
T1EDD1B759EF8E908542B2FA25986F4386E47D62B35CCA8C27ADB84B7D48106434C4DFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\[email protected]\content\lsdb.js
Size 1KB
SHA256 39ccab90aa93ed3709b8bde65039ce42d580a0f38bd31043c55880f91060f1e9
MD5 145b9559ab7bcb09c8a47749ba61bf50
SHA1 06344bd52f5f74dc952b92e4797541960a99e2ed
SHA512 35aa230857cdd683e41bc9c3ca2d993e28ce8411f7f54d1458c8c7f3d803247d5743579252213e3fb8da662c10531b07f0bafbb3236766309f2c071a8026117d
TLSH
T12B41F21EE60F90610473AB37097E11E6349FD4538E8E8D968DF29352415063B5B91EBD
MD5 SHA1 SHA512 TLSH

Submit Download

prfdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\[email protected]\content\prfdb.js
Size 1KB
SHA256 745e8f60e4f335a67840841c8b216598439ed91b2f3c73e9a7f5db7dd3237ad9
MD5 f24d6caf7e164a414dd75351b40eaa31
SHA1 cb8cd94990d36a809515b8a8aa117f3890fef86e
SHA512 e15064fd6d80723818ffd77010f888d2435c0f358b70724b08e0c9c0e91a159f2c23bd703df2911c62eb3630e88b4da49dcc2f66d3f9551d5cd7bb80b1da5d70
TLSH
T17231AB15E90F94B21436F337886E5189F53ED0B29E9EAC475EF69752002873B84C6D3C
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\[email protected]\content\sqlite.js
Size 1KB
SHA256 9cdeefa5219b5f79748243a095abfd2cec9638b38000ba300979d9477a21313e
MD5 54d7cb88648eb3072a0d4aedaed5a45b
SHA1 d41a6e3e65220ac6684ce0d0da9be1f115474726
SHA512 810e33406176b28c0118065b4297b27c7e337300521abbc8c4a28a93f8daee19e33d7b5c01d9638b88add7a089bd31409886cdd576ef79c65e3df8a46b704549
TLSH
T15F31AC12E70F5531623B633B4D3D1281B85EED93CD4B9D863DF963624829E399049DBC
MD5 SHA1 SHA512 TLSH

Submit Download

wx.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\[email protected]\content\wx.xul
Size 228B
SHA256 6c4ee6279abb1be5acf0bb469043ae9f49e91b13cc04925954307bfaf2c2b0a0
MD5 dbefeb103a90657caa41d915a6095ca1
SHA1 ddc05ed90f7360b7374fd35a7e541f8bbdf08335
SHA512 0ced4c51dcc0d39c609e03f6e2930ecdb80169f819c7e376ce02bec7e9847ee335d7f3ba62fc36ba49737aca52e7733872706e525919e505065a7b7cfe56686f
TLSH
T1CAD0A7862B1FC4E54D53ADB561B7D454B332620547916406B2CC56972341B8C417DB64
MD5 SHA1 SHA512 TLSH

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\[email protected]\install.rdf
Size 677B
SHA256 b95f0492b5e5f47005369e18b90d60a42f77f17eb1d0cb446e65d1fe5cd4bc21
MD5 814e823172bba5c634fa331d5cba5e05
SHA1 c8cef21d9c5f2549ff103ba520888b5a1a51908b
SHA512 1a9f232617f5492b9fc5f5e3eea5a6abb4738c3ef57f482646018835fe7f6fd8ce3202f086c1bb982f4e6291a0f0647015ef8188ecef62bdc32353fe3f0931af
TLSH
T1C4012B0A8945BE59E167CB223D709104B67417AD81429049FD9F1E174B5C2ED41A7653
MD5 SHA1 SHA512 TLSH

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\background.html
Size 5KB
SHA256 8066235c5aca05ec7ba4ab98b46b25655e16a48991f64011a9336ec798d8beac
MD5 6d0875c284d334e728380ccf8117f577
SHA1 fadb621ac02dea25d9c0d14c2258e29e7b874f4f
SHA512 51a91310e7f56f537a829e9ec60ad2ef685ceab7c22b4e82239368952e3c980d0acc2282b9c8560622cf19fb6c210a0e6587919da7979e6c54005a19fc6b716b
SSDEEP 96:jnFN3OZC70FTMIisWXKrwlEM+tAAQXcqiwwZxxeH6DJAT6Ov133zGCoel4g:Y3EKrJqHi66DJAT6E3z4g
TLSH
T1C2B1731AFE4FD50081B8AA1898AE8787E43D72735CC98C3799A16DBD1C10E471C4AEEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhoclass.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\bhoclass.dll
Size 137KB
SHA256 7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562
MD5 ac13c733379328f86568f6e514c2f7f8
SHA1 338901240fedcef4e3892fd4c723c89154f4de05
SHA512 35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4
SSDEEP 3072:7GcXFR07Alejy/1zn9hpgYmliR+x1edhBobHV59eDMt:6cVRkjYnOYmliMLedhBqwD
TLSH
T122D36C1232D0C032D2AA103E8926D2A25BBF7D71DCB59A4B7F8837AD5F71791DE25306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\content.js
Size 387B
SHA256 766051513c891b06809067d20ec3699db14eb0102c6cefd0274feccbd650f623
MD5 0417b72d256f5225a51cf60da8aca3ca
SHA1 0a60b569145910b9df4b45c68e0e5e3b1fc9a063
SHA512 39c4d8e1f2645e03d1277eca13e0c6c3becae134b2202d97decd53b25b139971aec591f850b8d52439d7d259638217565d3e9148b5ccc00295312e454fd9b13e
TLSH
T149E068DB3EE1D47507EA15CEB8BAFB25E5A310189800F016C4C4CC2C3514FDD48AAB8C
MD5 SHA1 SHA512 TLSH

Submit Download

fpeejgcnollhkmhbfkjpmlpciiiadjdh.crx

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\fpeejgcnollhkmhbfkjpmlpciiiadjdh.crx
Size 37KB
SHA256 a735c6458fc2413a407959d50a1d4ecc3a72581bcb2913cc0545d16e759c90db
MD5 7549f4a451a57018cffecae6ea9054d3
SHA1 543908153ee0048d11d570d02780591089637484
SHA512 0fa1a0a7e7ca53722c2b860591744962122802608675ac04e2fcea901b64aba6b25ebee552b3e719f83b80377373bb96b6a1aa6355547d5c54d22a47bb9c68c5
SSDEEP 768:TYw6oIjdrXZ+CAXsoNZoQ9cOJ5S27nGZ1mTbZdSkf:Ew6oC9oXsokQ9cOJ5MZ1AZ1
TLSH
T17503F1E8973E205DFDD2D57945C7E2E3607F077AE808B62794DA88BC9D772A05302983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\settings.ini
Size 599B
SHA256 7d0f7d28a452d9b425d6f3b73ab00e2510028aba3389ac7a6ec7a65da9349e51
MD5 5471d063d2008fa27a2bf09a6b04a324
SHA1 1f2f6ff58a502cde8df8792bc5149ad50059057d
SHA512 86e50eb434c605af958b2d8c48aaea7d452e028b33161543eea39a814cb7bd971d5ee67cf79fd50d4f8d9cb814bc6cfac77dc0e77fc0a779e990dae6164fafe2
TLSH
T183F0E16A86F4543C60DEDFD1B59041DB3FB6C3745E98A04780A738CC4551B5C539B614
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS5FE9.tmp\setup.exe
Size 61KB
SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
MD5 201d2311011ffdf6c762fd46cdeb52ab
SHA1 65c474ca42a337745e288be0e21f43ceaafd5efe
SHA512 235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b
SSDEEP 1536:ELXB65939tY6HBg4sXJ94Romu/l46+mrCj/LnV8G+:ELk395hYXJ945w46+LnOl
TLSH
T11053D02A32C0D8BBDAA7063099B7A779E3BBDB001320536717645F6F1E35093CD266D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads