Matching class ID links DLL’s browser setting to COM registration
A sandboxed DLL wrote Browser Helper Object values using the same class identifier found in its COM registration keys, showing browser-registration activity. Separate installer records provide packaging context but do not prove the installer delivered the DLL or that a browser loaded it.
A process loading Deals Plugin Extension.dll wrote a value named CrossriderApp0021806 beneath Windows’ Browser Helper Objects registry branch. The same class identifier appeared in COM registration keys recorded during the DLL’s sandbox analysis. That combination raises a more useful question than whether the file’s name looks suspicious: what role was this component configuring itself to play in the browser? The records examined by CTX Threat Intelligence support a specific answer.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read