1f5360046f3dde18dc43e60d412ff84ee664fce0e16c2fbaa4cd88c338825f37

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
Size 313KB
Sample261014-elfzesed46
SHA256 1f5360046f3dde18dc43e60d412ff84ee664fce0e16c2fbaa4cd88c338825f37
MD5 fc44bbaa5f3270ea16f56f6afa31077c
SHA1 79bc4a8031169ef30d378d76b81def0ec2c6cf9f
SHA512 09f567610b951a2e562309b5dbd30320d3569b18889bdaa8951d04ca5de49f0e285a3c94622c707553a4ad6499966066af40171d3113838d58d2cc5df3d1b3ce
SSDEEP 6144:91OgDPdkBAFZWjadD4seFcqE8CnvSOJMvrVzjHZ+Em:91OgLdazCnvS9DVf3m
TLSH
T10464F1213AE1C8FAD2521533CDB83FE9E1F6D6280F31887323994A1C7E3D585D526B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery installer spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3952	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
3952	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\ = "TheBflix"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\NoExplorer = "1"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c550-31.dat	nsis_installer_1
behavioral2/files/0x000d00000001c550-31.dat	nsis_installer_2

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\InprocServer32\ = "C:\\ProgramData\\TheBflix\\bhoclass.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.5.2"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\ProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\ = "TheBflix Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "TheBflix"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.5.2\CLSID\ = "{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\VersionIndependentProgID\ = "bhoclass.bho"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\TheBflix\\bhoclass.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\ProgID\ = "bhoclass.bho.5.2"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.5.2\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\VersionIndependentProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.5.2	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\TheBflix"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.5.2\ = "TheBflix"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3952	3268	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe	89

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{84BCA267-F19A-AFB8-8114-8DD65B1B8EB9} = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\setup.exe
  .\setup.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:3952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\[email protected]\chrome.manifest
Size 114B
SHA256 ae2cda6f320b864b60f65f838ed17e4c739ee4f66c6de1ba3503028018c986b8
MD5 10739b96364a2aa5658586fb3e34c661
SHA1 e173e19c2f754f7f045e30dfa8cffa0d8b4bdaec
SHA512 e14f1f81e37c248ca4a8725f64119059d5c32c5c0daacbaad305f226907f48f1697f55f25e58c1f7504ab7440ead38367c7ae4c1e6cef294fbf917f7f95f3464
TLSH
T101B09272430F408A67BACA82004233D03A708C028484A131769A028D82D0340CADC796
MD5 SHA1 SHA512 TLSH

Submit Download

indexeddb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\[email protected]\content\indexeddb.js
Size 1KB
SHA256 d00976df1462d11733b9c9a5e996238e63843497a16c5c6a8ddbf5e65cbafdf7
MD5 d5659f183a7e5c708ef69c1aed1f6ae5
SHA1 a7943101859b5fcc6a5d7b3d38a7552587b1e09b
SHA512 22735a3b0f29047e39c11af9cdaf349254b2a05450504d24fdf4f973b819192bde1c2a2bfce8950a570c93cec5cdef2ad316a1e7063f8657dcd979ebbc453eb8
TLSH
T146219059B78EB43A943A712B146F7684302BD0108D1C9831EDF4D6E60E7441F9B0E57C
MD5 SHA1 SHA512 TLSH

Submit Download

jquery.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\[email protected]\content\jquery.js
Size 91KB
SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
MD5 4bab8348a52d17428f684ad1ec3a427e
SHA1 56c912a8c8561070aee7b9808c5f3b2abec40063
SHA512 a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480
SSDEEP 1536:k5RKUpVgklsdruLP/l+0fGzA8gmtasgx/c9Rzzi4yff8qeLvHHEjam7rSnmBn9gn:Ee8bbGzA81+xRRi1Z3
TLSH
T18193E7D9B2D6716387B731BC50AF510BB13698AA784C8C50F068D8E4BE74A48907BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsext.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\[email protected]\content\jsext.js
Size 6KB
SHA256 639eadfc03caf7ae44d6e65269f208ffaa7fb240d1724ebfa21adb6ace536775
MD5 bc97db7dd978fbad1b2c72e4ed710c2d
SHA1 7bb69ce1f435018484c1bc74865fca848e664a35
SHA512 479fc51c799c07d4d02561a20cf8c2491e39a2f56e1cccf4911870e381d41cd133fbc83c92912094e672cdcf3ec613410b5866827dcabcecb4d7f33e8d92fbf9
SSDEEP 96:lGwOrDvuvUBqK31WEv9/WYM4iwHFxg/g0Sdnv133zPCoal4c0dm6:lGwvUNzZ7vbh93g4c4X
TLSH
T16AE1755DFF8E94894172AB10542E0385E07DB2B34CCE8C77ACB85B7D885064B984DEBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\[email protected]\content\lsdb.js
Size 1KB
SHA256 167ad786c5239309781f21fcf702ac8e5935925d3d46dcc32be5b7c7f860a053
MD5 04906e3bad4b5272dba64e87928689c7
SHA1 8481c4295d5bcb2b49bd45c6a463e3871c69e60f
SHA512 f46f69c079bac0a8eab32b3bb425c031fc0592c62e611975a416dcd3f795a1e9e7fbfae3e6f04f8bac6aa0980082b3d6f7f812eccf73a0a31e72d0343802d78d
TLSH
T1DF41041EE60F90210473EB3B097E21E6349FD4538E8E8D968DF69352419063B5B91EFD
MD5 SHA1 SHA512 TLSH

Submit Download

prfdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\[email protected]\content\prfdb.js
Size 1KB
SHA256 096befa239b268b79ea2bcb9d588ee576a24c4164ce5cde20b898cee72bcdc34
MD5 95dfd2fef19b00e1584fbe8b5c8d732a
SHA1 01a564415a607e539077a636775e27b3af9a543d
SHA512 baf9a1f446595493242f9250a2e3b1db40b4700aa668ab105ba7d00d1e300167f4f88f61a358f69aeda6706a65208c0ff523f4b0569276bb91c70a0452bc3d4b
TLSH
T1C131BA28E90B94211436E377886F22C9E53ED0B3AD5EED565EF99352006833B84D2DBC
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\[email protected]\content\sqlite.js
Size 1KB
SHA256 e3ecee344e61df4f38957a3d162e2a95524b2df580a29134ea8e70f34afff61c
MD5 cd95f6b00c6fa896b2984d3fe3372a89
SHA1 29d74e72738be2e8905a81a4ed14b5d46bebb98e
SHA512 001fff8bd753ebc343e4e407a3002f685c43f901161a65493a1fb8519cb99768f777c69f777c211075ccfc568ae7f7f0163e4d09b9d0a3f230b8a6903cf9138c
TLSH
T1F6318A12A70F5531623B633B4D3D1281B89EED93CD4A99863DF953624829E399049DBC
MD5 SHA1 SHA512 TLSH

Submit Download

wx.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\[email protected]\content\wx.xul
Size 228B
SHA256 21707c32d400dd330e2ec442ad5342c99c9a75f3d0760de00d834fecbd44f0fb
MD5 b09537e02da6fa91a0b9d0103e08e1ee
SHA1 2209b1ee72fd4849628998889dcc10e044b55092
SHA512 e9bafcec1780c3e3391e21db7a23518167dfe412e3760616fd0d122bb33e72b60918e08445d981ba6b0a95abb3341962e4edbe2ba66aebe4bbd8ac4f70dd487c
TLSH
T176D097852A0BC4A20E639DB410B7C080B322A2064650B001B2CC02872380B8C80787A4
MD5 SHA1 SHA512 TLSH

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\[email protected]\install.rdf
Size 694B
SHA256 3cd33ac7f5b39d7f067d489018798093a167712dc30b7e7d0bc51ee4c8cd14dd
MD5 a0108c8843435ab13d029cb68ad9d619
SHA1 d4d4cd95659169de813617178c249253b64f539b
SHA512 bb27fab6ff3142c70c84df519c0ac5e94130356419c0be6caf2dbab1d90c66fd7bda904a328a92da281b9e78aa7aaa576bf73229813e0721054936e954466857
TLSH
T10E017B558A46FF18E2B7CB222D709148F674177E8142A144FD8F5E034BAC1DD42E7383
MD5 SHA1 SHA512 TLSH

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\background.html
Size 5KB
SHA256 3aac89e7cef5aa3ef5c594e217405ea8a2e218e4f2ad6c06cb4b1bdc3d2237cb
MD5 7314c5f270ee28cd92f2b1c7b4bba6e6
SHA1 8b9de238415d866ac461d901517a6da5394ded0b
SHA512 9d8f2f90be4b305f43c4c1a4c874ae1199969407a4a451c4c459ad38503e1f76d0eb4df970150d8bde6fadba7bee446d39c361286a43ada3e9c91a51cb0bb45a
SSDEEP 96:1qJi31WXKrwlEM+tAAQXcqiwwZxxeH6DJAT6ov133zGCoel4g:ygEKrJqHi66DJAT6+3z4g
TLSH
T135B1734DFF8FD45980B19B08942E4382E03CB2634CCA9C77A890AD7D6950E4F1C4EEAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhoclass.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\bhoclass.dll
Size 137KB
SHA256 7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562
MD5 ac13c733379328f86568f6e514c2f7f8
SHA1 338901240fedcef4e3892fd4c723c89154f4de05
SHA512 35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4
SSDEEP 3072:7GcXFR07Alejy/1zn9hpgYmliR+x1edhBobHV59eDMt:6cVRkjYnOYmliMLedhBqwD
TLSH
T122D36C1232D0C032D2AA103E8926D2A25BBF7D71DCB59A4B7F8837AD5F71791DE25306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\content.js
Size 396B
SHA256 a26854f15c5fdcc199af86955d1c539e683f990d4d4a11f95f1ba9bc04e7bc53
MD5 5b2e51d3dac419ffb75e0d91e2b0d1c3
SHA1 ac5e29a9b114e5290e06b5c756e7aa9aa196a98a
SHA512 5b8187c0c7d6bf90bf23c2925a983ea3192cd421206b96c4b8de9030c2a5528db6a7ce7896375b85a1b8d52f1d0706338c6acd1cd0d4562d587e3556d061c03a
TLSH
T101E061DB3ED1C47503E949CDF5BAF714E1A200189805F025C4C0DC1C6514FDD4466A8D
MD5 SHA1 SHA512 TLSH

Submit Download

dkkofcfoeecbepddjnggccloiaknbfgg.crx

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\dkkofcfoeecbepddjnggccloiaknbfgg.crx
Size 37KB
SHA256 d7cfa8aa69a6f96cf9aa847d89a029a232e110bc4fe36cdb3cb8ff0750d51241
MD5 4f7439e31774e9119921ca5ddb88fea3
SHA1 0fcd610b9577499ed9c5e86d31783a88ff77ea0a
SHA512 44ebbb88775e1572b4a535e171d53cec6e732b7f1a019874fe3440d6eec2383f196ae1ef9dd5316ee41f092e6e7903bcda5fa668cc48406943dc0b8599f0482e
SSDEEP 768:JYw6oIjdrXZ+CAXsoNZoQ9cOJ5S27nGZ1mTbZfpeB:aw6oC9oXsokQ9cOJ5MZ1AZ2
TLSH
T1F403E1E99F3A009CEDC2E13944C2A2E3A47F16A9ED04B75B44C68CBC8D673909756D87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\settings.ini
Size 599B
SHA256 0b28cd2f4a944592d717c92b1f64221a6565948a59771142b4c8398110fa0ea9
MD5 7a7a273fde764bf54d4f9bc5e2e720d0
SHA1 6a52bbc0f4d38ccd6edf1195397840c5b503a6b1
SHA512 81ff250fae63ace46c7db686de027baf97f7419bfd1932f60b5c99d2038b883ace65adfe8fd2636b45ed19487e3c9888ebe52430e57e9d1276016d16d9a6cb38
TLSH
T189F0E15909E12BACA4F8DC83B67416C7BE63126DCE0A90D688FF748C4470E0DD2D67A5
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS7E9C.tmp\setup.exe
Size 61KB
SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
MD5 201d2311011ffdf6c762fd46cdeb52ab
SHA1 65c474ca42a337745e288be0e21f43ceaafd5efe
SHA512 235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b
SSDEEP 1536:ELXB65939tY6HBg4sXJ94Romu/l46+mrCj/LnV8G+:ELk395hYXJ945w46+LnOl
TLSH
T11053D02A32C0D8BBDAA7063099B7A779E3BBDB001320536717645F6F1E35093CD266D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads