Overview
overview
7Static
static
7jaffacakes...fk.exe
windows10-2004-x64
7jaffacakes...fk.exe
windows11-ltsc_2024-x64
7$LOCALAPPD...ly.exe
windows10-2004-x64
7$LOCALAPPD...ly.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...om.dll
windows10-2004-x64
5$PLUGINSDI...om.dll
windows11-ltsc_2024-x64
5$PLUGINSDI...dt.dll
windows10-2004-x64
3$PLUGINSDI...dt.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
5$PLUGINSDI...on.dll
windows11-ltsc_2024-x64
5$_0_/exten...lts.js
windows10-2004-x64
3$_0_/exten...lts.js
windows11-ltsc_2024-x64
3background.html
windows10-2004-x64
3background.html
windows11-ltsc_2024-x64
3DealPlyIE.dll
windows10-2004-x64
6DealPlyIE.dll
windows11-ltsc_2024-x64
6vn-zugo.exe
windows10-2004-x64
7vn-zugo.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 16:08
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/dealply.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
$LOCALAPPDATA/dealply.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsisdt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsisdt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/registry.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/version.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/version.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
background.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral22
Sample
background.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral23
Sample
DealPlyIE.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
DealPlyIE.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
vn-zugo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
vn-zugo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/Math.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe
- Size 2.2MB
- Sample261018-tlj4eags7x
- SHA256 42027f43c985a233cd17fa11800e4510d4399bcf6d19ddd43ec07656cec8fff0
- MD5 6fbbe07144086075c53b04c8d505b907
- SHA1 d4aca0a42db343d3c1e14ecdfddd84c8d35936d2
- SHA512 ef4551f0b10e057af49b0c4386505b3d889221c9cbc5dfb24c4816411b0e4418414de5d77e3844a2dc4640b499e6f41f2e06e42b80913e75a6b0695dd759ea01
- SSDEEP 49152:FCnGlLFDOpX0F9aPm6sOyQr8qHg6Gbul/V71b1dzYfjA:FOGzDOuGP9sOypugTO7F1dzf
- TLSH T11CB5336295C8C9B3C59202B9D652C6BFB736D9CD11012606ABE33F7E236F911E75A330
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000e00000001c54d-15.dat acprotect behavioral2/files/0x000f00000001c562-78.dat acprotect - Executes dropped EXE 3 IoCs
pid Process 5916 facemoods.exe 4392 facemoodssrv.exe 976 facemoodssrv.exe - Loads dropped DLL 60 IoCs
pid Process 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe 5916 facemoods.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\facemoods = "\"C:\\Program Files (x86)\\facemoods.com\\facemoods\\1.4.17.11\\facemoodssrv.exe\" /md I" facemoods.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}\ = "facemoods Helper" facemoods.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}\NoExplorer = "1" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC} facemoods.exe -
resource yara_rule behavioral2/files/0x000e00000001c54d-15.dat upx behavioral2/memory/1084-21-0x0000000003C60000-0x0000000003C72000-memory.dmp upx behavioral2/memory/1084-20-0x0000000003C60000-0x0000000003C72000-memory.dmp upx behavioral2/files/0x000f00000001c562-78.dat upx - Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.crx facemoods.exe File created C:\Program Files (x86)\facemoods.com\sqlite3.dll facemoods.exe File created C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrch.xml facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.png facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe facemoods.exe File created C:\Program Files (x86)\facemoods.com\sql3.xip facemoods.exe File opened for modification C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrch.xml facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll facemoods.exe File created C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll facemoods.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname facemoods.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain facemoods.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname facemoodssrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain facemoodssrv.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language facemoodssrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language facemoods.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language facemoodssrv.exe - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x001000000001b311-65.dat nsis_installer_1 behavioral2/files/0x001000000001b311-65.dat nsis_installer_2 behavioral2/files/0x000d00000001c58b-149.dat nsis_installer_1 behavioral2/files/0x000d00000001c58b-149.dat nsis_installer_2 -
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar\ facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567}\AppPath = "C:\\Program Files (x86)\\facemoods.com\\facemoods\\1.4.17.11" facemoods.exe Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\SOFTWARE\Microsoft\Internet Explorer\Main facemoods.exe Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A} facemoods.exe Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}\URL = "http://start.facemoods.com/?a=down&s={searchTerms}&f=4" facemoods.exe Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}\DisplayName = "Facemoods Search" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://start.facemoods.com/?a=down&f=2" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} = "facemoods Toolbar" facemoods.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567}\Policy = "3" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "http://start.facemoods.com/?a=down&s={searchTerms}&f=4" facemoods.exe Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\SearchScopes facemoods.exe Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes facemoods.exe Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0D7562AE-8EF6-416d-A838-AB665251703A}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AboutUrls facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567} facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4f05-9A6E-5D3B778EC567}\AppName = "facemoodssrv.exe" facemoods.exe Set value (int) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\Use Custom Search URL = "0" facemoods.exe Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A} facemoods.exe - Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://start.facemoods.com/?a=down" facemoods.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}\TypeLib\Version = "1.0" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}\TypeLib\ = "{12A5F606-B1EC-474C-83ED-95E99FD8058E}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\facemoods.facemoodsHlpr.1 facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}\ = "IescrtHlpr" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}\ProxyStubClsid32 facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDE2C74F-58CC-4d71-8CE1-09DEBB8CFB78}\InprocServer32\ = "C:\\Program Files (x86)\\facemoods.com\\facemoods\\1.4.17.11\\bh\\facemoods.dll" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9} facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}\ = "IEvntCntr" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\escort.escortIEPane facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\escort.escortIEPane\CLSID\ = "{929801A8-4AEF-4d12-BE31-D85BF666452B}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}\TypeLib facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46df-B041-1E593282C7D0} facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\facemoods.xtrnl\CLSID\ = "{A5B99E41-E157-4209-8AAC-DB003A816079}" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\esrv.escrtSrvc.1\CLSID\ = "{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}\TypeLib facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}\ProgID facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F}\TypeLib facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}\ = "IIEWndFct" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\facemoodsApp.appCore.1\ = "appCore Object" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F} facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883} facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}\ProxyStubClsid32 facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\AppID facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}\TypeLib facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\esrv.escrtSrvc\CurVer facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\escort.escortIEPane.1\ = "escortIEPane Object" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}\Instance\InitPropertyBag facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}\TypeLib facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}\ = "IEvntCntr" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64182481-4F71-486b-A045-B233BD0DA8FC}\Programmable facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46df-B041-1E593282C7D0}\Instl\Data\prtnrId = "facemoods.com" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}\TypeLib\ = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}\ProxyStubClsid32 facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{542FA950-C57A-4E17-B3E1-D935DFE15DEE}\ProxyStubClsid32 facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459} facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}\ = "IesrvXtrnl" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\escort.escrtBtn.1\CLSID facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46df-B041-1E593282C7D0}\Instl facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B12E99ED-69BD-437C-86BE-C862B9E5444D}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\facemoods.com\\facemoods\\1.4.17.11\\" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8} facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}\TypeLib\Version = "1.0" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\facemoodsApp.appCore.1\CLSID facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}\TypeLib\ = "{12A5F606-B1EC-474C-83ED-95E99FD8058E}" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}\TypeLib\ = "{12A5F606-B1EC-474C-83ED-95E99FD8058E}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}\Implemented Categories facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\ProgID facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE} facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}\TypeLib facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\esrv.escrtSrvc\CLSID facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\escort.DLL\AppID = "{5B1881D1-D9C7-46df-B041-1E593282C7D0}" facemoods.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}\TypeLib\ = "{12A5F606-B1EC-474C-83ED-95E99FD8058E}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{929801A8-4AEF-4d12-BE31-D85BF666452B}\TypeLib facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\1.0\FLAGS\ = "0" facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}\TypeLib\ = "{12A5F606-B1EC-474C-83ED-95E99FD8058E}" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8}\TypeLib\Version = "1.0" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}\ProxyStubClsid32 facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8}\ = "IXmlCnfg" facemoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\esrv.escrtSrvc\CLSID\ = "{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}" facemoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}\1.0\FLAGS facemoods.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD20D01C-C939-4dd2-8C55-56935A48987E}\ = "appCore Object" facemoods.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 5c0000000100000004000000000800000b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f57f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa467e00000001000000080000000080826f22e7dc01030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5916 facemoods.exe 5916 facemoods.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 976 facemoodssrv.exe 976 facemoodssrv.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1084 wrote to memory of 5916 1084 jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe 89 PID 5916 wrote to memory of 4392 5916 facemoods.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\facemoods.exe"C:\Users\Admin\AppData\Local\facemoods.exe" /S /mhp /mds /mnt2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe"C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4392
-
-
-
C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe"C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:976
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
- Size 259KB
- SHA256 b52d250a3cc40ffd3da353fc02a2b8f5c93ce7341b071228c8401a780c56313b
- MD5 d0813204b590d8e8b98627fd75610e9d
- SHA1 8d465e41bd3a156d6c3b12a562473193b9878a7d
- SHA512 698698aacdf240812c5ab76cff7d5b4313c552b7df276cb3a63f56e13ac8400477bb01c6b93bfd7ef191bdf834db62afc34d42db239c4108b2eb9f36a18297a6
- SSDEEP 3072:XPDSnuDyl0Gk5SMir25KeUpSDeVWwUz+JS4v5r95paU5paJu8cr2:fDzg0GRkKkwE4Vw7JuD2
- TLSH T1AD447D2277E5C579C24E12754C7B5F2E2279EF445F604AC3A6187F4E6E323D2483A2CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll
- Size 359KB
- SHA256 baf97779f0d58566e68e114a1fff1d926d25067c555d6c5ecc6708a452df7648
- MD5 582b370e077dd9412daa10e8b7ac9015
- SHA1 538a2aa698b3f41a1f0d0bcd195021946b4786a5
- SHA512 f7d5b884300ca9f6de5df799e823a6bf630c83f75e4ed031dd3082b712c9f771e9378702ddc4a7ef9621141f1787c5db53768f2ba04b1f340fc59d6dfbdf0e30
- SSDEEP 6144:jZTa9MWQh27pYg7Gg1uLJk352ADl81q3uF7EVfc:NTaqvh27pugwLJ2llU6u
- TLSH T19C745D12B7E6C1B4DB8E02745C7A9F0E1179AE845F91CAC3A3583F5E6F331D26436289
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll
- Size 451KB
- SHA256 7de1b95a08372d216e24078ad54f27783a6d04b88cac51f35deb8373cfe19c1b
- MD5 45300e499ccca60e2a6869170eca9966
- SHA1 fd9e5c83ff7337560e3f7f4ad9573934023b351b
- SHA512 5733c6648f7ec897c8ca6f311b03d6b244ecd5865bdc4d1b79ba7edadefb38d88bc51297ee05973586dbec64b9c8a6f4817e17d84f2108443a991b6dc87bbc73
- SSDEEP 6144:7LAZ7H7AcAV7PdAZckYFZboqfYCKNpPrnvxJYr7KU10:gZ7H7AcAVwcproqwCKNpjnXUK
- TLSH T122A45B11F7A6C1B1C64D01746C7BAF5F2679DE885B144BC3E3183F9E6E322D2583628A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
- Size 215KB
- SHA256 9e935e603e75690b3d56c748b2a435fa41fc3bb52508692c847b07acaeef45b1
- MD5 0fb336ccb1fe21397098026df36fd914
- SHA1 3fa3c67b6f4721a7d77cd478bd9b10a0377520fc
- SHA512 28ccfcb2326812ff06ac097fe94fb117c3487c4aff8e5fd8b9e1eb8e51a57097eaab353239d6279b052abe7751e96e3aeccfb15ba1bca4305cd91ee7c6bd9b22
- SSDEEP 3072:QJSxWnSCeKgNAO3HFubEz9Ev6U04Ws55h5paU5paEMlJ:QSxgaUbb674WE07N
- TLSH T15E246B127BA5C5B0C18E117C48769F6D237BEE569FE40AC76B143F5B6E312D10C3A28A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
- Size 353KB
- SHA256 856b3b38f679af08a54656a9e820702602e832ffae2e66c8c903891140a7ba23
- MD5 e83686c5f2273f8a7561897dd5f4e570
- SHA1 b46c493e729674c1f02ae94d32c476e5b5077625
- SHA512 f6147079dd8ef60b5c9a470df2cdd435c0813b9eb28999a660c54a74fa63ef05f4c665016363cc3489240235c36a8af9c0472306b0fd18cfcb49c3059513909e
- SSDEEP 6144:OuugnYauQVYW6jPF0bVNjkKKAoY9Si5MGUIKT:OuFYauQVxVNjlJf5Ux
- TLSH T1E2742943B7B285B3CB8582320C7A9B5F1B25EE441F514EC3629C7B2EED312D19B36265
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe
- Size 141KB
- SHA256 93fd6292a5057e98cc11e1db59fa42fcb618d1f490604e9eb65f0e343f29e356
- MD5 26e59759772f43227e2dbaf33f030adb
- SHA1 f6ae582f0a76bf765e36090630d6d07a3776700a
- SHA512 298db4c8187abe4aa8b8c590661c5ce86e852afea64b475c412d48a1a197573276d7799b380b74ae834912f4a5a167f984aa5669d44e7e6f9cbe6d7cafa72c26
- SSDEEP 3072:+gXdZt9P6D3XJg1kch+cIYAPgtsiO1Yrtfm4VOP:+e34W1EcaoOi+Yrt3VOP
- TLSH T195E37A8762B285A3CBD5C3704C7A96AFAF36CD9405800EE747DCFA7A2E71042DB21576
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 16KB
- SHA256 1297fb0c0ba8a32d94383a61c1681757465ad90be9486863a5f487763b2a0f6d
- MD5 7367dd2ca32852cb951f41376d614052
- SHA1 7a7e4b65d0b8402ab5dbfa4365847c660e718b6e
- SHA512 8a4f90639542aa4f85755d3d8de4b95c19d19fec6936efbc41739d332a84542f330f9082c85fe423e76ba4d6def65de8821bcf668c03c450bc3fe25c148b9d69
- SSDEEP 192:WxAJHzuS/i/YvPv7/PaLPapoHZVkxxfgamq1Iek/B4zRq5IVqoMRvgbS:WxaCkZvj+moXUVWr2V2
- TLSH T193723397B7EC20AE04FA9A1D7C39D6C0899FCF15D19B1CB5BB862E3890A6571007BB05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb1FC4.tmp\LangDLL.dll
- Size 5KB
- SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- MD5 9384f4007c492d4fa040924f31c00166
- SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
- TLSH T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb1FC4.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb1FC4.tmp\inetc.dll
- Size 24KB
- SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
- MD5 1efbbf5a54eb145a1a422046fd8dfb2c
- SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
- SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
- SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
- TLSH T1E0B2A59AD600B977E3E6253072910F4247BDBF723060744BEA63277D58B52E6FA38243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb1FC4.tmp\md5dll.dll
- Size 6KB
- SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
- MD5 0745ff646f5af1f1cdd784c06f40fce9
- SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
- SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
- SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
- TLSH T1D3D13941ABEC226AF7BB09306BB143365076B8A0EFBAD7BE04A4014E29611400C71F39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb1FC4.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb1FC4.tmp\nsRandom.dll
- Size 21KB
- SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
- MD5 ab467b8dfaa660a0f0e5b26e28af5735
- SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
- SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
- SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
- TLSH T1A3A2E1AFFA7A8B72C21162394365DDF861D08DDD01EE1E479A2EC226ACBD0400D7221B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsk766F.tmp\ExtractDLLEx.dll
- Size 7KB
- SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
- MD5 ba4063f437abb349aa9120e9c320c467
- SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
- SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
- SSDEEP 96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ
- TLSH T1F7F1B63699C08D75E1510CF067E6B31EDBBAC0F8AB160637A79D08C56C453EABF11257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsk766F.tmp\InetLoad.dll
- Size 18KB
- SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
- MD5 994669c5737b25c26642c94180e92fa2
- SHA1 d8a1836914a446b0e06881ce1be8631554adafde
- SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
- SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
- TLSH T1AD824C92AF8065F3E336993DB09923635FA9BB716480AC4757730F8CA522705EE38347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsk766F.tmp\NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsk766F.tmp\Processes.dll
- Size 56KB
- SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
- MD5 cc0bd4f5a79107633084471dbd4af796
- SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
- SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
- SSDEEP 768:WmswCIbuzwEmd7Fp4KpDAKngV9tV3rJy63JgaVwoz7si4uYqUYWu1gYwmj552RFB:WmswCIbuzwEy7n3YD3Jgw7shKrp55io
- TLSH T1F3438D147650C073D10A6534506AC3B15E7E7D3226F9C58BBF9A0B7D8F612E2F23A39A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsk766F.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- TLSH T1E181857B92E50DF3D0A447BB00D71CE70226DC701769411E89472A8924E572BFE2EB06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsk766F.tmp\chrmPref.dll
- Size 160KB
- SHA256 a87ec5894c667c5eb22201172792027a525a375a9e6468aa4612ccf6875b1112
- MD5 e02590b95a6be07cea5c5f3daf66e775
- SHA1 28b6350c43d3804f69faa5f48cab70e229dd182a
- SHA512 30e3abdeb2fa3c2e1bdc94e1e2b9f7fa9c85ff3d10198166e99e66a92a0ae4d62871a621eab069b1dfe2a99a7a4d457a494d91c811f1bd93c51f120f5ff692b5
- SSDEEP 3072:0DNlF2bX2rBTxNwIjCRMOwt+kG2Dkq150yurKNN535xzFHcu:0DNlF24BmXH2f50L4ji
- TLSH T1E2F39E12B2A2C172DB8F11BD0CB92B096BBAE5944FF04ED7AB241E4D9A353D15C37247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\facemoods.exe
- Size 1.2MB
- SHA256 065812a7db221fdbda974d2c9e9d3a26507d17fcb433cae77d78a21c843a8bf8
- MD5 5f856a489cc99dff30713f9fdab715df
- SHA1 7037878b2db6d2a611613c21c693458d3cfc4fc9
- SHA512 6e01128d4ff6a0aab186ddd6beaefc6756ec8b4c84ef13a0acb786166b9de6711cc7e622135dcb1fb62b2bd8cbd56a2e0bd31e14c5a94b9805908cd3a13d8226
- SSDEEP 24576:R30p4dk4yO1bzppgJLo01dvXjyoLTkyXN3VOBj7mEsLS:up4tNCLbdzLTpXDOR7ELS
- TLSH T1BB4522869876D463CBD1C3BA88B2C66FDB31CD4452825EC61ADEF9761E72E02DB31170
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\lateral2.bmp
- Size 189KB
- SHA256 ca2a72e55aa5249a9c47983f7a03dcad7509b68adcf109b7913d26c9cf2fd353
- MD5 d0d2b5814833b7412a66c89e8b75021d
- SHA1 9b6c821d9078aa1054f522d3669686a1f7792b37
- SHA512 04e1ae6a68ac73ef37bbe799e95ee6f218b846f129ee29fb7c6f24ea2134074dc88fc038fe67b47e49d7ce0675abb61c697eb54c6d67ac4b88984fefbefef141
- SSDEEP 192:tLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLT:CcAiUHnoQkU6KCrdD
- TLSH T1121409922A46FF43F3D5D822E876F56986A13C4F5BE39475A078BD98B2BC770500A343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
- Size 7KB
- SHA256 88af82147eaec3c19fa2862296896894cf82c04ab5af9c866a336bad9b6e028d
- MD5 5d07e1863eaa59e5b1ca275eb0703832
- SHA1 f4f0bd96b2a8ba1e3c54168b5dea9d63fe6d53c5
- SHA512 ed0133544d2bd019a64ebe795d1220785177d54918cba4e24150a56883e0e4d82b8a50210accbf39fd65f96b69d33466796309a0340de079443842611a363831
- SSDEEP 96:xHNUTUrqGqbf6hk1zSTwSSlpdv9jbnJHDuFY1Bw88u8L4cnqDx2svrlH:LWRbf6hk6wSSNR1Bw88YhH
- TLSH T1EFF11E7C55288F6F64B5B7ACAC6448709AB2013B7BBFA8C740F65485450CF3841FA6E7
- MD5 SHA1 SHA512 SSDEEP TLSH