4c40ca78004147e440cef16efd77d23c16c39df224cc303b653600802f3e4cad

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
Size 313KB
Sample261014-eld5tsed45
SHA256 4c40ca78004147e440cef16efd77d23c16c39df224cc303b653600802f3e4cad
MD5 f9ba27794aa7d6a46514722c7dec3390
SHA1 978e3c75e718d864b658a3b9071a5150c4c640de
SHA512 124214bd06128c2f3de33caf96cdfd06b5ecbd33968497ff3846b23963f3354516dc4c62033848854fe90c0105cafda26d865ac985b26f4b9b273d1dd2e64648
SSDEEP 6144:91OgDPdkBAFZWjadD4sQhGTBHB6ylbs2W6XJXblvlsciIIHHiLf4iN3W7Vw7cC:91OgLdaHGdHBj6UWMWHywisVAX
TLSH
T17264F1223AE1C9FAE5821532CDA82FD5F1FAD6240F31897327D54E1D2E7D588C13A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery installer spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3192	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
3192	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\ = "Bcool"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\NoExplorer = "1"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c4a3-31.dat	nsis_installer_1
behavioral2/files/0x000d00000001c4a3-31.dat	nsis_installer_2

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\VersionIndependentProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\Bcool"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID\ = "{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\ = "Bcool Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\InprocServer32\ = "C:\\ProgramData\\Bcool\\bhoclass.dll"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\Bcool\\bhoclass.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "Bcool"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\VersionIndependentProgID\ = "bhoclass.bho"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\ = "Bcool"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\ProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\Programmable	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA}\ProgID\ = "bhoclass.bho.1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3192	3212	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe	89

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{CCEB7F65-6B61-25E7-8154-BA7C756BE7AA} = "1"	setup.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\setup.exe
  .\setup.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\[email protected]\chrome.manifest
Size 114B
SHA256 75e9453d62bf0c36a19f863d445669f1c0d349db048a9214845d131f80f35ccd
MD5 6a1a515af07a0d53a4a57c252ff1f3a5
SHA1 d6b09c59fab237ca389c798ea4ee0051d4fc743a
SHA512 1c492868d4cab7ff98f1dd4fd56487dea65eb1a1ff8a809a070f66a14286fc5c4dfaf6ee453b55a83487f47c95e0951fdec371734ac68bc2d43bb06f04939b58
TLSH
T1FCB092B2431F848AAFA9CC821AD730547F60D6008184109270A6088D53C83848ACFF55
MD5 SHA1 SHA512 TLSH

Submit Download

indexeddb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\[email protected]\content\indexeddb.js
Size 1KB
SHA256 11abaa70a3757e93c912b7aa59e01204dabbc884df1bea17a7a34217ed29d9d3
MD5 546c6ee46d68f4bad59aaf5d1201485d
SHA1 b03c8ce83622dc1dd93bf1b679fa8f100fb3fde2
SHA512 236d0d77e0a5fdadd3106786836834641a4be33796469c44a087e5d98e591e5cc59ad39c5868d231612ab71906c31a3c9b48e53e7ebb9378b195226bee205b0f
TLSH
T146217059B68AB43A943A712B546F7644302BE0508D1C8831EDF4D6E64E7841F9B0E57C
MD5 SHA1 SHA512 TLSH

Submit Download

jquery.js

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\[email protected]\content\jquery.js
Size 91KB
SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
MD5 4bab8348a52d17428f684ad1ec3a427e
SHA1 56c912a8c8561070aee7b9808c5f3b2abec40063
SHA512 a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480
SSDEEP 1536:k5RKUpVgklsdruLP/l+0fGzA8gmtasgx/c9Rzzi4yff8qeLvHHEjam7rSnmBn9gn:Ee8bbGzA81+xRRi1Z3
TLSH
T18193E7D9B2D6716387B731BC50AF510BB13698AA784C8C50F068D8E4BE74A48907BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsext.js

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\[email protected]\content\jsext.js
Size 6KB
SHA256 af1f5e7e9f9fe870965e3dc355c6a4d9b9d5d0bc99e8733a2487bcc0fa743083
MD5 5d4bce0666a7dcc02bd58008169ed9d7
SHA1 86f9afb326954423509bc71db837cd6415618327
SHA512 299792ed97e58f1e385d81047898182e29e0f6319e28d7f86f42f3643f9ea076bad0a907d84a34c6c3d70c05d03955a15f60edc2b396809ee330be9f9812d66e
SSDEEP 96:dGhzrDvuvUfjHjl1jXj+jRjij7jU9jjjcJQjWEv9/WYM4iwHFxg/g0Sd3v133zPL:dGkvUgzZ7vbhN3g4c4X
TLSH
T191D19389FBDE90858672AB15546F0346B4BE72B34CC98C579CB84B3D4860997488EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\[email protected]\content\lsdb.js
Size 1KB
SHA256 7023a0729dfe1a46a71268b0ebb46dae3dccfd8283253fa02283f47a1a457153
MD5 283765f0f5cf244c285f8bcf22d33c99
SHA1 88b1ebc09a3e0cbee75213d533ccb429ff4e18ba
SHA512 3f433419d87d587b858bf1d1879d247130c5ad96f7fa7da0177028b31fe8f6ffa682fb11a3e36f2eaf043bb01ba1ffe5df54ac907a667f15a0fa696b15edb16e
TLSH
T17841241FE60F90210873EB37097E21E6349FC4438E8E8D968DF29352415063B5B91EBD
MD5 SHA1 SHA512 TLSH

Submit Download

prfdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\[email protected]\content\prfdb.js
Size 1KB
SHA256 0c7ae750c774b15fdf89c374ebec37a7248a040badb08de0558b26f3eca21c8b
MD5 0f5060d5e850d413ca49d8f3ef3f2a83
SHA1 c48f1187c9d7e3b2523e3a70d03ab4416e850056
SHA512 3891b4549b28ef4b1dc7118aa8e64cd795291abea66f5691cda46848110e27dc10dbbf1ad4d8373df5783ed87057ae3dc7eb9324bc703739b1703e11cdee04f7
TLSH
T119315515D50B98611836E3378CAF12C9E66EE0A29E9EADC74DF59B62012872F04C2D7D
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\[email protected]\content\sqlite.js
Size 1KB
SHA256 e57819f4edf573ec7a93a601876fdbeb27d1e388c1048627cb25db603fc3c7d1
MD5 6ce3cf1e459fc42fccf193429b09a376
SHA1 f95bc957fbb8baf1370c4b2eb3c15fe85411d02c
SHA512 6d91d6701ac53fe212699e63d47ded5af2c4bef36bf9e368f94d04317f4c0654cb248751a141ae170154c79658fb1d340ff20c854406441da848554b2bc4198b
TLSH
T10B31CC11E70F1530223B633B4D3D0281B85EED93CD0B5D863DF913624829E39904ADBC
MD5 SHA1 SHA512 TLSH

Submit Download

wx.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\[email protected]\content\wx.xul
Size 228B
SHA256 762fa8599e188c72493545422d1ae6a04941867d277d6570c69fd1d33e4b0f32
MD5 a4172362dfbc2a5dbcec4fa336e3bed5
SHA1 8505443c806f5b530120dd1613ac340a587e22de
SHA512 30ada9a68b05e6fd553d32fbbdd9b3865622f3f04c0111cf2d1450e6f032f25385ac5c7f88c8a8e72291456f38a56beac9b57f4de7ab5c9721a729447e66aae5
TLSH
T1AFD097C52A1BC8A24F429CB521FBC004F302B30543506042B1CC0A8723407CC003AB64
MD5 SHA1 SHA512 TLSH

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\[email protected]\install.rdf
Size 668B
SHA256 e9bf9b57f73348e2ff44c784477624e5d4937e9200ca755b9f9f4d28f0b1838f
MD5 8e2f4d2852eb9349aa362654d47577e7
SHA1 6955eace63336f3ba93781a2c8b42af32440da87
SHA512 e6d2276c5a8b5758ff2926cd56aa27c4481c20258bbe5f13776a26be710599a0b4b862d46c6c5fb375f6d47028fb8eafb28f8a66fc3e1edf5aff76d56aafffc2
TLSH
T1060199068952BF18E1A7CB233DB09008F6B41BBD81428088FC8F5E034F6C1EE41A7743
MD5 SHA1 SHA512 TLSH

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\background.html
Size 4KB
SHA256 a6ba971afe2b8476199f79d6573fc7c7fafda356ce0c09e0b736558048a07915
MD5 5731812c2994892faedbe76dd18298c4
SHA1 d69b0d4d4d7a6ecc6e5f5290716fdd94251d4fac
SHA512 84883f0d07812b4739990094a4a19b7fc0039bac7699d75c2365897ae34eac53dfed5b15cba001c761ecd4f57e30d0881569a705412fa948749f5a9281a44f0e
SSDEEP 96:TjHjl1jXj+jRjij7jU9jjjckiQjWXKrwlEM+tAAQXcqiwwZxxeH6DJAT6Mv133z9:0BEKrJqHi66DJAT6C3z4g
TLSH
T128A1514AFFCED44581B89A0C586E8352F47D75639CC8CC2698A06E7D2CA0D971D8EEDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhoclass.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\bhoclass.dll
Size 137KB
SHA256 7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562
MD5 ac13c733379328f86568f6e514c2f7f8
SHA1 338901240fedcef4e3892fd4c723c89154f4de05
SHA512 35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4
SSDEEP 3072:7GcXFR07Alejy/1zn9hpgYmliR+x1edhBobHV59eDMt:6cVRkjYnOYmliMLedhBqwD
TLSH
T122D36C1232D0C032D2AA103E8926D2A25BBF7D71DCB59A4B7F8837AD5F71791DE25306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\content.js
Size 387B
SHA256 74c47cab087df902c973c551234c5b799c72241c1b75cc6882ae41a59767a987
MD5 9b54a9189543a98797f82db845b518f2
SHA1 c92ed769f5aca4eb8e12edefac3008f2f31883a4
SHA512 ff27eadb4cd37626ea6e407755841fd9ee7145614f9fb97d3d0fe7a9f10e1f9dc741cf4d262e580d49ab432ee6ac10296ee7ef7fe2fb6ad6bdb4a467babef5fb
TLSH
T179E022DB3ED1847903EA098EA9BAFB24E5A200199800F015C4C0DC1C6924FED44AAA8D
MD5 SHA1 SHA512 TLSH

Submit Download

egolghloopnmbjmnbopgdfngiejgdcno.crx

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\egolghloopnmbjmnbopgdfngiejgdcno.crx
Size 37KB
SHA256 4f8294da4c2dcacf764062a61d621c542e63b433b1f462b9f37d6af60172a3b2
MD5 53085bfd656ffaf6b1d6c5fb0f3b7ecc
SHA1 4a7b1d8dc2f179d768a43ec081dc41f3644ff977
SHA512 d9e438f2d8f8b22cd77f8780ab997bec42656a6473a5e6d7896be84f322438195838d7b02359b7fadb03496115939c02304426e60b441fb732fbd67123dd0363
SSDEEP 768:dYw6oIjdrXZ+CAXsoNZoQ9cOJ5S27nGZ1mTbDP:uw6oC9oXsokQ9cOJ5MZ1ADP
TLSH
T11103E1D8873E40ADDED2F43984C792E3A43E1665EC04F9229CD78C798DB32A46342987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\settings.ini
Size 593B
SHA256 367019115d64463cf1aac22c58108189e00d20a631de681548a07306cc7e0ae8
MD5 ff9a037c40918d1bec6cc8702d36d84b
SHA1 3204f320e60a5b4e9c9fe40c3fc907cf240826d1
SHA512 609c51824308e6315fe991afc83e2ecbbd70cea9e4de07d1a44125ffd2c3cdbe86ac80ef6eea397f90bb19bcf2b02275907ed328a8de9cfd2bf9f9d62a74a99d
TLSH
T146F0E1AD9CF26478D4CEC85AE3F515C7BE8682354B290482D0E726AD04B4A4D525FB18
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS74C9.tmp\setup.exe
Size 61KB
SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
MD5 201d2311011ffdf6c762fd46cdeb52ab
SHA1 65c474ca42a337745e288be0e21f43ceaafd5efe
SHA512 235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b
SSDEEP 1536:ELXB65939tY6HBg4sXJ94Romu/l46+mrCj/LnV8G+:ELk395hYXJ945w46+LnOl
TLSH
T11053D02A32C0D8BBDAA7063099B7A779E3BBDB001320536717645F6F1E35093CD266D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads