110dba4bcef9fa1ef041c01ca079c3e02d31dd48fed0dba67af3537f1235975b

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
Size 313KB
Sample261014-elkbvaed49
SHA256 110dba4bcef9fa1ef041c01ca079c3e02d31dd48fed0dba67af3537f1235975b
MD5 ff76f5da338ad98789fa444a657620c9
SHA1 a0a772003fc520a7abad1a0e9d34890bea285577
SHA512 6c23eaf941b165978e1d48c26b504636e82901781abc97acc98c55ce4ad8835da49d239f6f143ff83d1e3c236fab18cea5a1b65be68223c3de61ad951b73ab90
SSDEEP 6144:91OgDPdkBAFZWjadD4sYwAomGvFdcoiQpxqZuwLFK8:91OgLda5wTm6FdqgwLFK8
TLSH
T1ED64F1213AE1C8F6D65200328E642FD6F2FAE6680F31487733994A1D6F3D649C537B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery installer spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5372	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
5372	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\ = "TheBflix"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\NoExplorer = "1"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c55f-31.dat	nsis_installer_1
behavioral2/files/0x000d00000001c55f-31.dat	nsis_installer_2

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\InprocServer32\ = "C:\\ProgramData\\TheBflix\\bhoclass.dll"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.5.2\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\VersionIndependentProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\Programmable	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\TheBflix\\bhoclass.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "TheBflix"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.5.2\ = "TheBflix"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\ = "TheBflix Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.5.2	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\VersionIndependentProgID\ = "bhoclass.bho"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\TheBflix"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{96736AD2-3287-07BA-4CF2-2FB51A96A27D}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\Programmable	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\ProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\VersionIndependentProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\ProgID\ = "bhoclass.bho.5.2"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.5.2\CLSID\ = "{96736AD2-3287-07BA-4CF2-2FB51A96A27D}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.5.2"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D}\InprocServer32	setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 5372	1928	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe	89

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{96736AD2-3287-07BA-4CF2-2FB51A96A27D} = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\setup.exe
  .\setup.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\[email protected]\chrome.manifest
Size 114B
SHA256 e5f0da135d8b74f01b9582acc15af559609c0ec0ef7a95514988deec342f5969
MD5 4113f29bfb277cca2e790b6f18f28ca9
SHA1 cc99c018f31b201af074747a21672e685af9584e
SHA512 36ef9d292e8b6426b3698d469c53bfdb2b0cc4321b31fe72d70682f2d4e9423256ce076ec95b6993ef53f672cf3db191e56d25b5d93cc3d046dcd828d4065610
TLSH
T147B09232434F404F27A9CAA681C2B0603A608A0084D4301170A6008CB2CC344CFCEB6A
MD5 SHA1 SHA512 TLSH

Submit Download

indexeddb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\[email protected]\content\indexeddb.js
Size 1KB
SHA256 0f462fb19438351a1fb9995a7dd17850905ff38dacce1cd5840ade2b464be26f
MD5 b2c6286581ff270ba4af0028f69c9e18
SHA1 e04d231903998a6340a1c1da3b3eb83bf5b24ae1
SHA512 d4c0f59f35eda3a1c91cde2836bfa43418b83f7a5acbd1f26247a473b65f429dd30fee50611c56f4d4ac6eddc0ff58a428dc6e4b3ac4b8d92ba861fc505e1112
TLSH
T1D9218259B78EB43A943E712B546F7644302BE0508D1C8831EDF4D6E64E7841F9B0E57C
MD5 SHA1 SHA512 TLSH

Submit Download

jquery.js

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\[email protected]\content\jquery.js
Size 91KB
SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
MD5 4bab8348a52d17428f684ad1ec3a427e
SHA1 56c912a8c8561070aee7b9808c5f3b2abec40063
SHA512 a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480
SSDEEP 1536:k5RKUpVgklsdruLP/l+0fGzA8gmtasgx/c9Rzzi4yff8qeLvHHEjam7rSnmBn9gn:Ee8bbGzA81+xRRi1Z3
TLSH
T18193E7D9B2D6716387B731BC50AF510BB13698AA784C8C50F068D8E4BE74A48907BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsext.js

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\[email protected]\content\jsext.js
Size 6KB
SHA256 786fe739769c70fc8cb698843891250b11d9e528f9d45572e137e2b366b93698
MD5 98b92a9c4193d2a9b53d2d9d6bab3eb5
SHA1 4bb69b154126632723b12dbcdf814845c3a616ea
SHA512 133211608e2edd803584534adf467b2f758d443e69e2bf335456cdeed3d9acf8d94aa5ef8511a077ba1af90c6ec3cf8c3ff4b1bc1a9af4594453d1d6f95e9691
SSDEEP 96:hGYqrDvuvUN2ykWEv9/WYM4iwHFxg/g0SdAv133zPCoal4c0dm6:hGMvUazZ7vbhG3g4c4X
TLSH
T10BE1A559EF8DA4858271EB20946E0385E0BE73B35CCD8C6B9CB8576D8420647984EFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\[email protected]\content\lsdb.js
Size 1KB
SHA256 6133df49dcf1fd0c4da4013e93136b60dbabf128cb556fe49fe0fa908b017bd6
MD5 0134fe014d98674bb2c2e19c331e4ae3
SHA1 9b11e7069bd0c44c28b341bd956c42e5df49966a
SHA512 4ad9e1fcc13d7be82c92b981876bceb81f8e2daf4672e75a60aee9af5c8b4fe7dd6a893989190221095a4037d13816452631385893f3ce2542a7be2b6229d77a
TLSH
T13541121EE60F90220473AB3B097E21E6349FC4438E8E8D968DF29352415063B5B91EBD
MD5 SHA1 SHA512 TLSH

Submit Download

prfdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\[email protected]\content\prfdb.js
Size 1KB
SHA256 15f0cf314f9a6cca2571d062b3cea9f0f704f1c66d130b138f96de6e94a72001
MD5 05c03da398a4f1633999e79f47395e8c
SHA1 8ad8ddc2bb2b90120b916aa6ac743a7f40fc4938
SHA512 a8bf19a7aa0444c0b7e79c4cc93ed9dbd44c536ab533b1c5fd537581eba39393bb9aa0b4ba96618c330d12bb198d4495b39cb3c1fd3682a5b366678f07862d73
TLSH
T10731BC24D90B94231436E73B88AF61CAE52ED1B2DD6EAC464DF69352202C33B55C2D3D
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\[email protected]\content\sqlite.js
Size 1KB
SHA256 cb212bad6126a3038aaaf69ab4790795e5a2c8a311bb2a248c5dde60a23fb504
MD5 3e914570e858c6b1defbde3472b5bcca
SHA1 6701dc029d9aaee15fa2d515b45b488f6caa3ed1
SHA512 7a9ebf437a4091c1609a2f26dd6ff036b009376b43d920b118e1ae24876230a3ec91fb63776c5b75b1b7bd2ece3635fb5d88e7d7415e078521d47aafc4dac728
TLSH
T12A31AA12A70F1531223B633B4E3D12C1B85EE993CD0A59863DF963624829E399049DBC
MD5 SHA1 SHA512 TLSH

Submit Download

wx.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\[email protected]\content\wx.xul
Size 228B
SHA256 b93f6f1a87ca0377c424ff7ec6cdac8c0eaaf78f7d0a56e05a96bceb8c7bdc36
MD5 302b099d4a06f37758b05d591ce4494e
SHA1 20cc51d3df48474f92a99298216c5d982071c7f8
SHA512 4067f14e359685163b19c801b4cd356927ad4a199524b4aff65da02fdd02b77291a42661a64fda77b016c09ca1ceee7dde8e08e6c2311a7f9033f50f881cccea
TLSH
T1F3D0A7852A1BC4674D529DB951B7D454B312620546A07405B1CC56973345B8C417AB68
MD5 SHA1 SHA512 TLSH

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\[email protected]\install.rdf
Size 694B
SHA256 25b82bbdaa57100263c7e9aa41e3949ce8aa99d7b1b48dcddf5454efc3bf53c9
MD5 ecce41c216053c0b2b8580808b6877db
SHA1 da41db65dc3ba6bdac1df6d924d13dfbde97950e
SHA512 1f801fbd06e66fff4d51d53529f89b1a195136183aa03742ad07b630fd6b08bccc486dbcf207fb52ce5218aa1aa2050d989f0cfbdcb173885e547319f1cd6d1c
TLSH
T1CA017B468A46FE19E2B7DB262D70A048F674177D81439184FDCF5E134B5C1DD4297353
MD5 SHA1 SHA512 TLSH

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\background.html
Size 5KB
SHA256 29907faba0294d3c708c766b669317467bd6918c65e0a767d1e54fa4a8300587
MD5 0e6d50fe80be6cb7fe2cf93c3404fcbb
SHA1 7630c5b03b385cc09532f61eb360718f8b90b844
SHA512 6f282be513f3d8025fbd68cdb1535893176ce9cc5986f795cf4bb22faed9cd4a3d7f5ca6114ffbb953f6f8660a474e13ed393f84aaf8045c006fc796fe5694c0
SSDEEP 96:x2RikWXKrwlEM+tAAQXcqiwwZxxeH6DJAT6Hv133zGCoel4g:kPEKrJqHi66DJAT6d3z4g
TLSH
T1F1B1950AFE4EA845C1B4DA08986E4346E03D72735CC8CC7A9C9069BD6810F576C5AFDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhoclass.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\bhoclass.dll
Size 137KB
SHA256 7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562
MD5 ac13c733379328f86568f6e514c2f7f8
SHA1 338901240fedcef4e3892fd4c723c89154f4de05
SHA512 35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4
SSDEEP 3072:7GcXFR07Alejy/1zn9hpgYmliR+x1edhBobHV59eDMt:6cVRkjYnOYmliMLedhBqwD
TLSH
T122D36C1232D0C032D2AA103E8926D2A25BBF7D71DCB59A4B7F8837AD5F71791DE25306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\content.js
Size 395B
SHA256 59c162db874f059fca54d9b202a6e063e4459a5910e7f4768ec9834084fc983b
MD5 27289c66bf310af3ef89d7c5315af97e
SHA1 f6cd0f1878cad0efbe917020489ba4d1e0c20e94
SHA512 b80f2a8dd8e5b981ce832fbbf696958784002426c50ba20618753e30daa1af3a28df650ae2a998c2e636c85289a3d38bbd3b2ad494210155deae3540a305c326
TLSH
T169E092DB2ED1987943EA89CEA5BAF724E5A214299C04F02584C4DC1C6524FED44AAA8E
MD5 SHA1 SHA512 TLSH

Submit Download

epdgjnpcndgjpfoedfoamdiekfglinhk.crx

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\epdgjnpcndgjpfoedfoamdiekfglinhk.crx
Size 37KB
SHA256 0c7bb52884832457ff8b0ef0a4ef3e6fd2b7529a584d4cc1a0cac4755fefbbd9
MD5 6ee358f9499e428ad542034f8bea7772
SHA1 c4552a8a4a0c216645cc0a877eb997f48eb0fab5
SHA512 12c7397818d1909e0ffbe75835abc298a4f28ba4235f617e8c879e30bbad56c65654b2a80db4d1492df0b800bd2c1a26494402f981e7c60832db4ba68bcb4d10
SSDEEP 768:xYw6oIjdrXZ+CAXsoNZoQ9cOJ5S27nGZ1mTbZRGL:Cw6oC9oXsokQ9cOJ5MZ1AZW
TLSH
T16C03E1FD8B3910ACED92E47D4183A2E3947F2661ED05F21388CBD8B98D772E01352947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\settings.ini
Size 599B
SHA256 4bc0fb3e65e7d5f3b091d3613e3c7dc6799b44fa47b8fffbbbdab2bb9b2be5c3
MD5 8d8719e9f193af82bc2db7fd90bff157
SHA1 00bb2a05437dbac707817f29be94dea738e3fc7b
SHA512 51840204d1377fe9d62ab24c952839b01393c9e2a9dbd41f0a194c3e63758c8e64ecd446ee47ea3f63020c7583f079e84e54d840a77412df4df567ea070af8ff
TLSH
T11AF0AC5A04D26C3C91A8E59BF3A116C37E6A436D8D4994C9D897208C9978E48A347729
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS2030.tmp\setup.exe
Size 61KB
SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
MD5 201d2311011ffdf6c762fd46cdeb52ab
SHA1 65c474ca42a337745e288be0e21f43ceaafd5efe
SHA512 235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b
SSDEEP 1536:ELXB65939tY6HBg4sXJ94Romu/l46+mrCj/LnV8G+:ELk395hYXJ945w46+LnOl
TLSH
T11053D02A32C0D8BBDAA7063099B7A779E3BBDB001320536717645F6F1E35093CD266D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads