Overview
overview
7Static
static
7jaffacakes...fk.exe
windows10-2004-x64
7jaffacakes...fk.exe
windows11-ltsc_2024-x64
7$LOCALAPPD...ly.exe
windows10-2004-x64
7$LOCALAPPD...ly.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...om.dll
windows10-2004-x64
5$PLUGINSDI...om.dll
windows11-ltsc_2024-x64
5$PLUGINSDI...dt.dll
windows10-2004-x64
3$PLUGINSDI...dt.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
5$PLUGINSDI...on.dll
windows11-ltsc_2024-x64
5$_0_/exten...lts.js
windows10-2004-x64
3$_0_/exten...lts.js
windows11-ltsc_2024-x64
3background.html
windows10-2004-x64
3background.html
windows11-ltsc_2024-x64
3DealPlyIE.dll
windows10-2004-x64
6DealPlyIE.dll
windows11-ltsc_2024-x64
6vn-zugo.exe
windows10-2004-x64
7vn-zugo.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/10/2026, 16:08
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/dealply.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
$LOCALAPPDATA/dealply.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsisdt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsisdt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/registry.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/version.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/version.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
background.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral22
Sample
background.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral23
Sample
DealPlyIE.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
DealPlyIE.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
vn-zugo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
vn-zugo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/Math.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe
- Size 2.2MB
- Sample261018-tlj4eags7x
- SHA256 42027f43c985a233cd17fa11800e4510d4399bcf6d19ddd43ec07656cec8fff0
- MD5 6fbbe07144086075c53b04c8d505b907
- SHA1 d4aca0a42db343d3c1e14ecdfddd84c8d35936d2
- SHA512 ef4551f0b10e057af49b0c4386505b3d889221c9cbc5dfb24c4816411b0e4418414de5d77e3844a2dc4640b499e6f41f2e06e42b80913e75a6b0695dd759ea01
- SSDEEP 49152:FCnGlLFDOpX0F9aPm6sOyQr8qHg6Gbul/V71b1dzYfjA:FOGzDOuGP9sOypugTO7F1dzf
- TLSH T11CB5336295C8C9B3C59202B9D652C6BFB736D9CD11012606ABE33F7E236F911E75A330
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000700000002437d-15.dat acprotect behavioral1/files/0x0009000000024394-105.dat acprotect - Executes dropped EXE 3 IoCs
pid Process 2736 facemoods.exe 3336 facemoodssrv.exe 2184 facemoodssrv.exe - Loads dropped DLL 60 IoCs
pid Process 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe 2736 facemoods.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\facemoods = "\"C:\\Program Files (x86)\\facemoods.com\\facemoods\\1.4.17.11\\facemoodssrv.exe\" /md I" facemoods.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC} facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}\ = "facemoods Helper" facemoods.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}\NoExplorer = "1" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects facemoods.exe -
resource yara_rule behavioral1/files/0x000700000002437d-15.dat upx behavioral1/memory/3088-21-0x0000000002250000-0x0000000002262000-memory.dmp upx behavioral1/memory/3088-20-0x0000000002250000-0x0000000002262000-memory.dmp upx behavioral1/memory/3088-59-0x0000000002250000-0x0000000002262000-memory.dmp upx behavioral1/memory/3088-60-0x0000000002250000-0x0000000002262000-memory.dmp upx behavioral1/files/0x0009000000024394-105.dat upx - Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.png facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.crx facemoods.exe File created C:\Program Files (x86)\facemoods.com\sql3.xip facemoods.exe File created C:\Program Files (x86)\facemoods.com\sqlite3.dll facemoods.exe File created C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrch.xml facemoods.exe File opened for modification C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrch.xml facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe facemoods.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname facemoods.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain facemoods.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname facemoodssrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain facemoodssrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language facemoodssrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language facemoodssrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language facemoods.exe - NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x00080000000004e8-62.dat nsis_installer_1 behavioral1/files/0x00080000000004e8-62.dat nsis_installer_2 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A} facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://start.facemoods.com/?a=down&f=2" facemoods.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567}\Policy = "3" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567}\AppPath = "C:\\Program Files (x86)\\facemoods.com\\facemoods\\1.4.17.11" facemoods.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}\URL = "http://start.facemoods.com/?a=down&s={searchTerms}&f=4" facemoods.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}\DisplayName = "Facemoods Search" facemoods.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0D7562AE-8EF6-416d-A838-AB665251703A}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AboutUrls facemoods.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\GPU facemoodssrv.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.19041.546\"hypervisor=\"No Hypervisor (Microsoft Hypervisor with SLAT support detected)\"" facemoodssrv.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar\ facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} = "facemoods Toolbar" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567} facemoods.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "http://start.facemoods.com/?a=down&s={searchTerms}&f=4" facemoods.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567}\AppName = "facemoodssrv.exe" facemoods.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Custom Search URL = "0" facemoods.exe - Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://start.facemoods.com/?a=down" facemoods.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}\TypeLib\ = "{12A5F606-B1EC-474C-83ED-95E99FD8058E}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\facemoods.facemoodsHlpr\CurVer facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64182481-4F71-486b-A045-B233BD0DA8FC}\InprocServer32\ThreadingModel = "apartment" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2} facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\HELPDIR facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\facemoods.xtrnl.1\CLSID\ = "{A5B99E41-E157-4209-8AAC-DB003A816079}" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\facemoods.facemoodsHlpr.1\CLSID\ = "{64182481-4F71-486b-A045-B233BD0DA8FC}" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}\TypeLib\ = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\TypeLib facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}\TypeLib facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}\1.0\FLAGS facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}\1.0\0\win32 facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}\ProxyStubClsid32 facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883} facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}\VersionIndependentProgID facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}\ProgID facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\facemoods.dskBnd facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}\VersionIndependentProgID\ = "facemoods.dskBnd" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\esrv.escrtSrvc\CurVer facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}\TypeLib\Version = "1.0" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}\TypeLib\ = "{12A5F606-B1EC-474C-83ED-95E99FD8058E}" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}\TypeLib\ = "{12A5F606-B1EC-474C-83ED-95E99FD8058E}" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}\InprocServer32\ThreadingModel = "apartment" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}\1.0 facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\ProgID facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\facemoods.dskBnd.1\CLSID\ = "{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}\ProxyStubClsid32 facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459} facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\InprocServer32\ThreadingModel = "apartment" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\esrv.escrtSrvc\CLSID\ = "{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883} facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0 facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B12E99ED-69BD-437C-86BE-C862B9E5444D}\1.0\FLAGS\ = "0" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}\TypeLib facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}\ = "IesrvXtrnl" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}\LocalServer32\ = "\"C:\\Program Files (x86)\\facemoods.com\\facemoods\\1.4.17.11\\facemoodssrv.exe\"" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AD25754E-D76C-42B3-A335-2F81478B722F}\1.0\0\win32 facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}\TypeLib facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}\1.0\HELPDIR facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{74C012C4-00FB-4F04-9AFB-4AD5449D2018}\ = "IescrtSrvc" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDE2C74F-58CC-4d71-8CE1-09DEBB8CFB78}\InprocServer32\ThreadingModel = "apartment" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}\TypeLib facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\facemoods.dskBnd.1\ = "CDskBnd Object" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}\ProxyStubClsid32 facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{74C012C4-00FB-4F04-9AFB-4AD5449D2018}\TypeLib\Version = "1.0" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\VersionIndependentProgID\ = "facemoods.xtrnl" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F}\ = "Ixtrnlmain" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B035F86-41B5-40F1-AAAD-3D219F30244E}\TypeLib\ = "{12A5F606-B1EC-474C-83ED-95E99FD8058E}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDE2C74F-58CC-4d71-8CE1-09DEBB8CFB78}\TypeLib facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\ProgID facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46df-B041-1E593282C7D0}\Instl\Data\afltId = "down" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0 facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}\TypeLib\ = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDE2C74F-58CC-4d71-8CE1-09DEBB8CFB78}\VersionIndependentProgID facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}\Instance\CLSID = "{929801A8-4AEF-4d12-BE31-D85BF666452B}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AD25754E-D76C-42B3-A335-2F81478B722F} facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AD25754E-D76C-42B3-A335-2F81478B722F}\ = "esrv" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}\AppID = "{AD25754E-D76C-42B3-A335-2F81478B722F}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}\Instance\InitPropertyBag facemoods.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 5c0000000100000004000000000800000b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f57f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa467e00000001000000080000000080826f22e7dc01030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2736 facemoods.exe 2736 facemoods.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2184 facemoodssrv.exe 2184 facemoodssrv.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3088 wrote to memory of 2736 3088 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 92 PID 2736 wrote to memory of 3336 2736 facemoods.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\facemoods.exe"C:\Users\Admin\AppData\Local\facemoods.exe" /S /mhp /mds /mnt2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe"C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3336
-
-
-
C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe"C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2184
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
- Size 259KB
- SHA256 b52d250a3cc40ffd3da353fc02a2b8f5c93ce7341b071228c8401a780c56313b
- MD5 d0813204b590d8e8b98627fd75610e9d
- SHA1 8d465e41bd3a156d6c3b12a562473193b9878a7d
- SHA512 698698aacdf240812c5ab76cff7d5b4313c552b7df276cb3a63f56e13ac8400477bb01c6b93bfd7ef191bdf834db62afc34d42db239c4108b2eb9f36a18297a6
- SSDEEP 3072:XPDSnuDyl0Gk5SMir25KeUpSDeVWwUz+JS4v5r95paU5paJu8cr2:fDzg0GRkKkwE4Vw7JuD2
- TLSH T1AD447D2277E5C579C24E12754C7B5F2E2279EF445F604AC3A6187F4E6E323D2483A2CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll
- Size 359KB
- SHA256 baf97779f0d58566e68e114a1fff1d926d25067c555d6c5ecc6708a452df7648
- MD5 582b370e077dd9412daa10e8b7ac9015
- SHA1 538a2aa698b3f41a1f0d0bcd195021946b4786a5
- SHA512 f7d5b884300ca9f6de5df799e823a6bf630c83f75e4ed031dd3082b712c9f771e9378702ddc4a7ef9621141f1787c5db53768f2ba04b1f340fc59d6dfbdf0e30
- SSDEEP 6144:jZTa9MWQh27pYg7Gg1uLJk352ADl81q3uF7EVfc:NTaqvh27pugwLJ2llU6u
- TLSH T19C745D12B7E6C1B4DB8E02745C7A9F0E1179AE845F91CAC3A3583F5E6F331D26436289
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll
- Size 451KB
- SHA256 7de1b95a08372d216e24078ad54f27783a6d04b88cac51f35deb8373cfe19c1b
- MD5 45300e499ccca60e2a6869170eca9966
- SHA1 fd9e5c83ff7337560e3f7f4ad9573934023b351b
- SHA512 5733c6648f7ec897c8ca6f311b03d6b244ecd5865bdc4d1b79ba7edadefb38d88bc51297ee05973586dbec64b9c8a6f4817e17d84f2108443a991b6dc87bbc73
- SSDEEP 6144:7LAZ7H7AcAV7PdAZckYFZboqfYCKNpPrnvxJYr7KU10:gZ7H7AcAVwcproqwCKNpjnXUK
- TLSH T122A45B11F7A6C1B1C64D01746C7BAF5F2679DE885B144BC3E3183F9E6E322D2583628A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
- Size 215KB
- SHA256 9e935e603e75690b3d56c748b2a435fa41fc3bb52508692c847b07acaeef45b1
- MD5 0fb336ccb1fe21397098026df36fd914
- SHA1 3fa3c67b6f4721a7d77cd478bd9b10a0377520fc
- SHA512 28ccfcb2326812ff06ac097fe94fb117c3487c4aff8e5fd8b9e1eb8e51a57097eaab353239d6279b052abe7751e96e3aeccfb15ba1bca4305cd91ee7c6bd9b22
- SSDEEP 3072:QJSxWnSCeKgNAO3HFubEz9Ev6U04Ws55h5paU5paEMlJ:QSxgaUbb674WE07N
- TLSH T15E246B127BA5C5B0C18E117C48769F6D237BEE569FE40AC76B143F5B6E312D10C3A28A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
- Size 353KB
- SHA256 856b3b38f679af08a54656a9e820702602e832ffae2e66c8c903891140a7ba23
- MD5 e83686c5f2273f8a7561897dd5f4e570
- SHA1 b46c493e729674c1f02ae94d32c476e5b5077625
- SHA512 f6147079dd8ef60b5c9a470df2cdd435c0813b9eb28999a660c54a74fa63ef05f4c665016363cc3489240235c36a8af9c0472306b0fd18cfcb49c3059513909e
- SSDEEP 6144:OuugnYauQVYW6jPF0bVNjkKKAoY9Si5MGUIKT:OuFYauQVxVNjlJf5Ux
- TLSH T1E2742943B7B285B3CB8582320C7A9B5F1B25EE441F514EC3629C7B2EED312D19B36265
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 e59275b4be7387758cd8a5a34ca524f2e8a004df186b4710fc61aa384f1eb555
- MD5 7e4154575b702f08676d4e9fb944fda4
- SHA1 3de339939306b93c297635110870ad8fcb5bb0f0
- SHA512 4d6098b783a22b0be34e5d90fb340dcf06ddaae99e365d6bd21304caaef864e33de44971543f9f3dcd2689cdcb2eb076d8be2eb9994169dace844d831a52ab09
- SSDEEP 192:mxV+fYu0iyzjTzv7/HaLPapoHoVkvxfV62KcZCqwwGTCsEIVqoMRvgbS:mxM30x3D+moCGVV5XCqKV2
- TLSH T12B722387B7EC20AE04FADB1D7C39D2C0899FCF15D15E28B5BB566E3890AA570107BB05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshEEA2.tmp\ExtractDLLEx.dll
- Size 7KB
- SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
- MD5 ba4063f437abb349aa9120e9c320c467
- SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
- SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
- SSDEEP 96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ
- TLSH T1F7F1B63699C08D75E1510CF067E6B31EDBBAC0F8AB160637A79D08C56C453EABF11257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshEEA2.tmp\InetLoad.dll
- Size 18KB
- SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
- MD5 994669c5737b25c26642c94180e92fa2
- SHA1 d8a1836914a446b0e06881ce1be8631554adafde
- SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
- SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
- TLSH T1AD824C92AF8065F3E336993DB09923635FA9BB716480AC4757730F8CA522705EE38347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshEEA2.tmp\NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshEEA2.tmp\Processes.dll
- Size 56KB
- SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
- MD5 cc0bd4f5a79107633084471dbd4af796
- SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
- SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
- SSDEEP 768:WmswCIbuzwEmd7Fp4KpDAKngV9tV3rJy63JgaVwoz7si4uYqUYWu1gYwmj552RFB:WmswCIbuzwEy7n3YD3Jgw7shKrp55io
- TLSH T1F3438D147650C073D10A6534506AC3B15E7E7D3226F9C58BBF9A0B7D8F612E2F23A39A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshEEA2.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- TLSH T1E181857B92E50DF3D0A447BB00D71CE70226DC701769411E89472A8924E572BFE2EB06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshEEA2.tmp\chrmPref.dll
- Size 160KB
- SHA256 a87ec5894c667c5eb22201172792027a525a375a9e6468aa4612ccf6875b1112
- MD5 e02590b95a6be07cea5c5f3daf66e775
- SHA1 28b6350c43d3804f69faa5f48cab70e229dd182a
- SHA512 30e3abdeb2fa3c2e1bdc94e1e2b9f7fa9c85ff3d10198166e99e66a92a0ae4d62871a621eab069b1dfe2a99a7a4d457a494d91c811f1bd93c51f120f5ff692b5
- SSDEEP 3072:0DNlF2bX2rBTxNwIjCRMOwt+kG2Dkq150yurKNN535xzFHcu:0DNlF24BmXH2f50L4ji
- TLSH T1E2F39E12B2A2C172DB8F11BD0CB92B096BBAE5944FF04ED7AB241E4D9A353D15C37247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsx97A8.tmp\LangDLL.dll
- Size 5KB
- SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- MD5 9384f4007c492d4fa040924f31c00166
- SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
- TLSH T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsx97A8.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsx97A8.tmp\inetc.dll
- Size 24KB
- SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
- MD5 1efbbf5a54eb145a1a422046fd8dfb2c
- SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
- SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
- SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
- TLSH T1E0B2A59AD600B977E3E6253072910F4247BDBF723060744BEA63277D58B52E6FA38243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsx97A8.tmp\md5dll.dll
- Size 6KB
- SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
- MD5 0745ff646f5af1f1cdd784c06f40fce9
- SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
- SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
- SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
- TLSH T1D3D13941ABEC226AF7BB09306BB143365076B8A0EFBAD7BE04A4014E29611400C71F39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsx97A8.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsx97A8.tmp\nsRandom.dll
- Size 21KB
- SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
- MD5 ab467b8dfaa660a0f0e5b26e28af5735
- SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
- SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
- SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
- TLSH T1A3A2E1AFFA7A8B72C21162394365DDF861D08DDD01EE1E479A2EC226ACBD0400D7221B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\facemoods.exe
- Size 1.2MB
- SHA256 065812a7db221fdbda974d2c9e9d3a26507d17fcb433cae77d78a21c843a8bf8
- MD5 5f856a489cc99dff30713f9fdab715df
- SHA1 7037878b2db6d2a611613c21c693458d3cfc4fc9
- SHA512 6e01128d4ff6a0aab186ddd6beaefc6756ec8b4c84ef13a0acb786166b9de6711cc7e622135dcb1fb62b2bd8cbd56a2e0bd31e14c5a94b9805908cd3a13d8226
- SSDEEP 24576:R30p4dk4yO1bzppgJLo01dvXjyoLTkyXN3VOBj7mEsLS:up4tNCLbdzLTpXDOR7ELS
- TLSH T1BB4522869876D463CBD1C3BA88B2C66FDB31CD4452825EC61ADEF9761E72E02DB31170
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\lateral2.bmp
- Size 189KB
- SHA256 ca2a72e55aa5249a9c47983f7a03dcad7509b68adcf109b7913d26c9cf2fd353
- MD5 d0d2b5814833b7412a66c89e8b75021d
- SHA1 9b6c821d9078aa1054f522d3669686a1f7792b37
- SHA512 04e1ae6a68ac73ef37bbe799e95ee6f218b846f129ee29fb7c6f24ea2134074dc88fc038fe67b47e49d7ce0675abb61c697eb54c6d67ac4b88984fefbefef141
- SSDEEP 192:tLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLT:CcAiUHnoQkU6KCrdD
- TLSH T1121409922A46FF43F3D5D822E876F56986A13C4F5BE39475A078BD98B2BC770500A343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
- Size 8KB
- SHA256 98b65d92d6f0785d3f7f9df9674d54d003ea5d8def89de43901f56b30b909c68
- MD5 85cbf472dd7b2968be05a273e942d126
- SHA1 38c386036b45af391550136bc95dbd281c9baf55
- SHA512 c02d1aaee8866cc0caf7e5ed0070ff96240b2208ceaae21898571db54468598b6508434c403954dcc0b4c82af27fe0e409a83af6cb2557b75c924c028067e99c
- SSDEEP 96:xH5UTUGqGqFfQ0n1zSQSSlSdv9j5n2RHKpBw88D8L4cnEVoBlIprlH:XBRFfQ0nNSSh9KpBw88FQITH
- TLSH T141021C7C95288F6F64B5B3ACAC6488709AB201377BBFA8C740F65485550CF3841FA6E7
- MD5 SHA1 SHA512 SSDEEP TLSH