Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
- Size 313KB
- Sample261014-elca8sed44
- SHA256 8c6f0b0c89f7570adf1c91acf962fc0a2c4f4da2f9ef4b8c5cb29f3b896bb511
- MD5 f7ef0370e4ddcda4929a6cf4d7a0b0df
- SHA1 f9e76f94350aca84344773b6f97727a11415a03d
- SHA512 9a802647447eb4fd0ab5872ce3a6d3cfc8429a900c3aed89dd9d13b49012a1e4758d81f087151b39150d45dd4e3f7ce4d3c768a6ab965dfd7776bf9eba0ab03a
- SSDEEP 6144:91OgDPdkBAFZWjadD4swhXElzop5LgQsvqJ+bLpUpS:91OgLdarElzop5Lr6UyL9
- TLSH T17664E12139E1C9B6C6120533CDA82FE5F2FAE6640F31487333D94A1D2F7D596C22AB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4356 setup.exe - Loads dropped DLL 1 IoCs
pid Process 4356 setup.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D486D853-FEF7-E638-F6FE-39789D17D3AD} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D486D853-FEF7-E638-F6FE-39789D17D3AD} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\ = "wxDfast" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\NoExplorer = "1" setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe - NSIS installer 4 IoCs
resource yara_rule behavioral1/files/0x00070000000245c5-32.dat nsis_installer_1 behavioral1/files/0x00070000000245c5-32.dat nsis_installer_2 behavioral1/files/0x00070000000245df-94.dat nsis_installer_1 behavioral1/files/0x00070000000245df-94.dat nsis_installer_2 - Modifies registry class 63 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\ = "wxDfast Class" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\InprocServer32 setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\ProgID setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32 setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\Programmable setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID\ = "{D486D853-FEF7-E638-F6FE-39789D17D3AD}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\Programmable setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.1.0" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\ProgID\ = "bhoclass.bho.1.0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\VersionIndependentProgID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\InprocServer32\ThreadingModel = "Apartment" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\VersionIndependentProgID\ = "bhoclass.bho" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\InprocServer32\ = "C:\\ProgramData\\wxDfast\\bhoclass.dll" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\ProgID setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\VersionIndependentProgID setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\ = "wxDfast" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\wxDfast" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage" setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD}\InprocServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\wxDfast\\bhoclass.dll" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{D486D853-FEF7-E638-F6FE-39789D17D3AD}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "wxDfast" setup.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2304 wrote to memory of 4356 2304 jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe 85 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{D486D853-FEF7-E638-F6FE-39789D17D3AD} = "1" setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\7zS9F19.tmp\setup.exe.\setup.exe /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- System policy modification
PID:4356
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\wxDfast\bhoclass.dll
- Size 137KB
- SHA256 7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562
- MD5 ac13c733379328f86568f6e514c2f7f8
- SHA1 338901240fedcef4e3892fd4c723c89154f4de05
- SHA512 35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4
- SSDEEP 3072:7GcXFR07Alejy/1zn9hpgYmliR+x1edhBobHV59eDMt:6cVRkjYnOYmliMLedhBqwD
- TLSH T122D36C1232D0C032D2AA103E8926D2A25BBF7D71DCB59A4B7F8837AD5F71791DE25306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\wxDfast\lemidhelbfhdnigjnkcbkacgignfdnij.crx
- Size 37KB
- SHA256 d5394e04006fbbb7280f4df7aa7a37ef8575335e4225691793f6eeabe90e4c20
- MD5 7c7b06c914cfce08a0fa2b7f71afbdea
- SHA1 4ff0a2981d929642370e23325359583fda9fcf0d
- SHA512 cc2d765a8dd570a83bbad2bb6f9b15b4d551115b39ad7c68c9137b848966bf803d7410190756ab38cf010082e2254accce90a18acd0f5b3069b4d3c0ea039f94
- SSDEEP 768:cYw6oIjdrXZ+CAXsoNZoQ9cOJ5S27nGZ1mTbCxoqQ:Bw6oC9oXsokQ9cOJ5MZ1AH
- TLSH T1E703F1E9CB3E109CEDC2E8394087A1E3A43F1625ED08F66394DB4C785DB72949752D83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\wxDfast\uninstall.exe
- Size 46KB
- SHA256 03c965d0bd9827a978ef4080139533573aa800c9803599c0ce91da48506ad8f6
- MD5 2628f4240552cc3b2ba04ee51078ae0c
- SHA1 5b0cca662149240d1fd4354beac1338e97e334ea
- SHA512 6ecfcc97126373e82f1edab47020979d7706fc2be39ca792e8f30595133cd762cd4a65a246bee9180713e40e61efa373ecfb5eb72501ee18b38f13e32e61793b
- SSDEEP 768:L4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJfefg4RoeMZeUZB/PSF:ELXB65939tY6HBg4sXJr4RoKu/PSF
- TLSH T1F323AE1B32C0D8B7D66A0631497797BAEBB7DB00122052675BA4AF7F2D301C399262C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS9F19.tmp\[email protected]\chrome.manifest
- Size 114B
- SHA256 5325c695e5236aedb6b995fefde3512a42df15c087dda6de5e54b60a692c93a0
- MD5 4dd74ed162a6d431c59360121b37711e
- SHA1 16de7175968a8f0da4727f7da856266ebe0f2f43
- SHA512 fa718e6d8b933e149782dc34d568529936237e49dcd3d6cbbf23c2ca385be71d63e757e9422e564d77ff18cb275e0c42a5d70ce89f3ec84c15cdf316b36e5231
- TLSH T1A9B0923A434F804E7BFEC882004238713A60DB0B8084901170B7428C63C03C0AACC756
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS9F19.tmp\[email protected]\content\sqlite.js
- Size 1KB
- SHA256 96e0605ba7c55e90780aeb79e3b3f886aa598586852d0323e49ee8ab452bfbfa
- MD5 6e799ae0e94a65c6fe53a0bba2041167
- SHA1 dd1154910fc4a55a72ce0947fb035df5af3a6d67
- SHA512 6e8b46093f7a8740a8b55df797b6c64995720a881c6b13b5288ba96a29c0f15e6d0be9966ad090869eaeec4b5151b57bd5eb60456c67dfcb2e63cc472152aca6
- TLSH T1A031CC11E70F1530623B633B4D3D0281B85EED93CD0B9D863DF913624829E399049DBC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS9F19.tmp\background.html
- Size 4KB
- SHA256 d7926a058e1921305205414fb7f1deb5af3731ab5673ffe6c32c55eb690b8394
- MD5 44154a1a0fa4dac1dd60638b42f4613a
- SHA1 0687fe1e45f16ca6ddd6dd3ec0ac1f282adc5e42
- SHA512 c261a9040eb00d201d3b64cf70bb6c03199a7b0564f6521e4eb9ac9364e36c6bab4b3ecf5c3bd86b89682158e476a75eee27e8fd5dc6a6acc5a3e730ac6a5ae1
- SSDEEP 96:hlt71A3sxcDJJiDWXKrwlEM+tAAQXcqiwwZxxeH6DJAT6Ov133zGCoel4g:hll1A3sxeJJuEKrJqHi66DJAT6E3z4g
- TLSH T1EEA1315AFE8FE415C1B4AA4D586D8347F03DB5739CC88C2298E069BD2C50D971C9AEDC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS9F19.tmp\content.js
- Size 386B
- SHA256 f1580694f66579f9446413e69b5daf08302c19e5c5f400b0d84416fb787588d2
- MD5 e2dc1c592ab69fa6a15307872d92c3a8
- SHA1 7863388fb70cfe67d86a9ae20b83f98695ab4c53
- SHA512 b9c85b116d586eb81576543a6190d359a5bc40c2400a4f561a1de368cb25ab12b42af3022cf6d043f378f754ebe0ac6583125f680160b4b619f45f240055bb50
- TLSH T1DCE068D73EE1D8350BEA15CEB8BAF729E1A210259C00F001C0C4CC2C3514FED44A6B8D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS9F19.tmp\settings.ini
- Size 599B
- SHA256 cd0403b1bab64dda3bd78abbaad6b286218efbb94e6f98074140013732ef13c7
- MD5 d869768005033a65ff51a29a39d0a7d0
- SHA1 76a83250ff86f7297482bd6b46f0f10af0a1fe63
- SHA512 1ea94f049245d75803c09b588d1d1285b1d87d8d30e621c019ecf800e9a24124422f343db10711d885573b50e7aaa462f912f55e26fedfd44da491c2214243bd
- TLSH T13CF0E1BD51D8882CB0EDDF8171AAC4FB7FA34365CAA8D04584A510CC45E6F6C56CA319
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS9F19.tmp\setup.exe
- Size 61KB
- SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
- MD5 201d2311011ffdf6c762fd46cdeb52ab
- SHA1 65c474ca42a337745e288be0e21f43ceaafd5efe
- SHA512 235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b
- SSDEEP 1536:ELXB65939tY6HBg4sXJ94Romu/l46+mrCj/LnV8G+:ELk395hYXJ945w46+LnOl
- TLSH T11053D02A32C0D8BBDAA7063099B7A779E3BBDB001320536717645F6F1E35093CD266D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xlhu326a.Admin\extensions\[email protected]\content\indexeddb.js
- Size 1KB
- SHA256 d914c7cf83fea70ed72e001c04dfefacc19b07bd582199fcafc0f32f63e958e3
- MD5 ee9809fbb43689b83cb7c16481a82c83
- SHA1 27396fb3e0ccfd43eda8fdd15799ea91189587e9
- SHA512 e1790832db6ae29a9ccaad2384240e720e8a4396e1cd5d9e678a66ae5026dd3f4387c1d694521cabada9b1eb4aee2a1c7e9ab256ba0f4f250e5cff49172e3abf
- TLSH T189219059B68EB43A943B712B146F7644302BD0108D1C8831EDF4D6E60E7441F9B0E5BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xlhu326a.Admin\extensions\[email protected]\content\jquery.js
- Size 91KB
- SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
- MD5 4bab8348a52d17428f684ad1ec3a427e
- SHA1 56c912a8c8561070aee7b9808c5f3b2abec40063
- SHA512 a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480
- SSDEEP 1536:k5RKUpVgklsdruLP/l+0fGzA8gmtasgx/c9Rzzi4yff8qeLvHHEjam7rSnmBn9gn:Ee8bbGzA81+xRRi1Z3
- TLSH T18193E7D9B2D6716387B731BC50AF510BB13698AA784C8C50F068D8E4BE74A48907BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xlhu326a.Admin\extensions\[email protected]\content\jsext.js
- Size 6KB
- SHA256 e14c7384160c5e817f3920e466fbe991acfcd06e789795aed897547a00a5ce58
- MD5 8cd2b7dfd50baba2d97109c9658acea5
- SHA1 b3de38d5e21819a46fb43fd10872a8d17eafc61c
- SHA512 5e1c166223437dddfc22388227ea44791e6cb739b1493556feef1d3e314820a32857d20046d5513f99b263823d82c0a0e2042f3b5dc1ab31bd59ee5fe2673242
- SSDEEP 96:xGYyrDvuvUFlt71A3sxcDJKDWEv9/WYM4iwHFxg/g0SdBv133zPCoal4c0dm6:xG0vUFll1A3sxeJmzZ7vbhn3g4c4X
- TLSH T1D1D17359FB9EA44682B2EB16546E139AA07EB3B34CC98C039CB8477D1810597588DFFC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xlhu326a.Admin\extensions\[email protected]\content\lsdb.js
- Size 1KB
- SHA256 5251ae16fcd373177a2a9deac306c8845dc45964a650d97b21475a617450e2a6
- MD5 5240bc4239f53606844672bb6bbef8bf
- SHA1 46c9d148c32bfac52a9970f9381fd46f1554a868
- SHA512 fb5ae5d35bc101f8aaa2ac4db5a1763f1c57e4faf63af703d598f41d09dedd8c0fdd5dc5ebea2da850fb7ecf8ec8eba0326b15acf6a1ebc1b80cf830d3258e5c
- TLSH T18741F21EE60F90210873AB37097E21F6349FD4538E8E8D968DF29352415063B5B91EBD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xlhu326a.Admin\extensions\[email protected]\content\prfdb.js
- Size 1KB
- SHA256 c0d8c49403cd457ae576b80a5ae0a0957d439c34027ef1ff8fccabac93e3da58
- MD5 b87cbd06ad3b5d9b388b415331055d9e
- SHA1 ea1e6f9a69d9010653a83f388f55852b3b7b1066
- SHA512 475c8cb6d0a12a50ebaae8af491d1867e37492bde5a08951721d36592ba25fa9c531869b8222e7611bc845830201fbf8545bada25f93a59ab40039a5bb105b26
- TLSH T1EA31CB25D50F94653836E333882E11ABE52FD1B39D5EEC529CF59362012833B14C2DBC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xlhu326a.Admin\extensions\[email protected]\content\wx.xul
- Size 228B
- SHA256 2ad7e7a39105d829fc7393e704f63d6b4ac94bf45fc63d232c4e1c7463fe9da2
- MD5 dd5e26192556605a18e8d2097b95c4f8
- SHA1 a083b685aa8a468b2357796fe93ee4283bcff8a3
- SHA512 71ac29fe4e6889a05cc34328a60066afe179fcb8c59ce7627945a2ebdb4df6f46f1c2bece0ac3dfea0514e720ba23596d5f1deaab4530796153508d777035360
- TLSH T145D097892A0FC4660E929CB510B7C420B302B30A4250A001B1CC428723807CC0078764
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xlhu326a.Admin\extensions\[email protected]\install.rdf
- Size 677B
- SHA256 c8a0f4139b455a836d0c001bbf09f8e15542f202c06eac15ed840bd3255a2f5b
- MD5 4e4e275792c04044f637cf7b273eddb5
- SHA1 6c88b143559cf27ac4f0e55ea1fbb718c7de5b7d
- SHA512 4ffb3d1e279b63af00277de5c687c5b2922dd8887195e37af7d48aa75533a3f639a2c070467ed170eb48d8b43cb49390196ec7a19c8f633b9227053ce14ae32d
- TLSH T14E01261A8946BE18E2B7DB223DB09104A67417AE8142D089FC9F5E174BAC2ED52A3753
- MD5 SHA1 SHA512 TLSH