30e248df598327c72d4f293fe8e69dd11e91494476e9ae56557bce939833bb7b

Analysis

max time kernel
151s
max time network
154s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
08/02/2023, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JJSploit Installer.exe
Size

50.0MB
MD5

662d26b4e627e44a0da5e5e99fa41942
SHA1

93ea678ba8449bfdfd7a26e82fae39f00185e8d8
SHA256

30e248df598327c72d4f293fe8e69dd11e91494476e9ae56557bce939833bb7b
SHA512

284078b1afaf2ff213aecf30fb298a6cf026cbf884227bc6864fedc60a40770a264a3b1a601b9fc1094e9bf1d8a0213359841631e5c83f1232c7db08a6b72cda
SSDEEP

1572864:G78WsLBU07HgOYzXNfeZtTJt0mwS8LlMUzD2:G78WGBU0036T7mLlMUzK

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation	JJS-UI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation	JJS-UI.exe

Executes dropped EXE 4 IoCs

pid	Process
420	JJS-UI.exe
3332	JJS-UI.exe
3632	JJS-UI.exe
5012	JJS-UI.exe

Loads dropped DLL 15 IoCs

pid	Process
4240	JJSploit Installer.exe
4240	JJSploit Installer.exe
4240	JJSploit Installer.exe
4240	JJSploit Installer.exe
4240	JJSploit Installer.exe
4240	JJSploit Installer.exe
4240	JJSploit Installer.exe
420	JJS-UI.exe
420	JJS-UI.exe
3632	JJS-UI.exe
5012	JJS-UI.exe
3332	JJS-UI.exe
3332	JJS-UI.exe
3332	JJS-UI.exe
3332	JJS-UI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5676	1892	WerFault.exe	95
5704	3896	WerFault.exe	96

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1448	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = d581f14b6daed801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{12076AA4-F2D7-4D8A-8DC1-E4707BEE3B94}"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000234af6465b0c5e75316062c0a48d1206d3857a843c29c98f089b793be631036cb0a9752a548de3ffaefe2d0ea9565db4cc49f98e827c799546c0878f5d61b6c9443ae3690c7bbf05c454454a72f58e480a8fcc667f4d3104e86ebf447af6be00599c92ba37f63f4e2c03b16a7c88f0fa4ff50715d6ba31ae4146b4170010633bc36e1f797a1e793a55abdc15c430058b771c5bda5ee56552c0e6db52afce440d6a529d8bcc13741e46ec4eb43a0e125eaca4e7d7a3ecec9a22f06ec9d452658024e7fb54a7f562681266cac03240e3ea862dfec928f17ff05402a16769bbb9608acc7eb6d0e4e6994fb9c414d9e7a375ae57b0d3f612e317e1bd5852202922e563a30a239a001f10f5843a7490232b1d67c34e594471aba566c24f929fbb85a3250b92c1cb69089eba69c6954f154c38520fcee8752d283bd0af3455d39378d68ca34ea0973f87f1b6077cea15db48ff04dc7437da65f59a6b2674bc0bd039ec7d0d66f4fda231cfe0fe75f1c7968a8beaca1c28733b4384f3c5e3383292b17370e8736fcfb20b18f6ee052279672224b57928ec90cd2669a35a18397f81a77afcbffc85f1eb	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000003bb9c847131fb1a5b5098a781cf6b85d6b2cafea7795334d6036a18ca4bfd7cfe2df651e184b16546da524d105c26839f8e7a1778a03cbdcba0a297a09e23568ff97aa8620c40883535a8b17ca20cd8e8ed37aa8edbf3ad102ac	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4240	JJSploit Installer.exe
4240	JJSploit Installer.exe
1448	tasklist.exe
1448	tasklist.exe
3632	JJS-UI.exe
3632	JJS-UI.exe
5012	JJS-UI.exe
5012	JJS-UI.exe
3416	chrome.exe
3416	chrome.exe
4972	chrome.exe
4972	chrome.exe
2976	chrome.exe
2976	chrome.exe
5988	chrome.exe
5988	chrome.exe
5432	chrome.exe
5432	chrome.exe
5496	chrome.exe
5496	chrome.exe
5708	chrome.exe
5708	chrome.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3360	MicrosoftEdgeCP.exe
3360	MicrosoftEdgeCP.exe
3360	MicrosoftEdgeCP.exe
3360	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	tasklist.exe
Token: SeSecurityPrivilege	4240	JJSploit Installer.exe
Token: SeDebugPrivilege	4464	MicrosoftEdge.exe
Token: SeDebugPrivilege	4464	MicrosoftEdge.exe
Token: SeDebugPrivilege	4464	MicrosoftEdge.exe
Token: SeDebugPrivilege	4464	MicrosoftEdge.exe
Token: SeDebugPrivilege	3896	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3896	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3896	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3896	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4464	MicrosoftEdge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4464	MicrosoftEdge.exe
3360	MicrosoftEdgeCP.exe
3360	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 3580	4240	JJSploit Installer.exe	66
PID 4240 wrote to memory of 3580	4240	JJSploit Installer.exe	66
PID 4240 wrote to memory of 3580	4240	JJSploit Installer.exe	66
PID 3580 wrote to memory of 1448	3580	cmd.exe	68
PID 3580 wrote to memory of 1448	3580	cmd.exe	68
PID 3580 wrote to memory of 1448	3580	cmd.exe	68
PID 3580 wrote to memory of 2724	3580	cmd.exe	69
PID 3580 wrote to memory of 2724	3580	cmd.exe	69
PID 3580 wrote to memory of 2724	3580	cmd.exe	69
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3332	420	JJS-UI.exe	76
PID 420 wrote to memory of 3632	420	JJS-UI.exe	77
PID 420 wrote to memory of 3632	420	JJS-UI.exe	77
PID 420 wrote to memory of 3632	420	JJS-UI.exe	77
PID 420 wrote to memory of 5012	420	JJS-UI.exe	78
PID 420 wrote to memory of 5012	420	JJS-UI.exe	78
PID 420 wrote to memory of 5012	420	JJS-UI.exe	78
PID 4972 wrote to memory of 2884	4972	chrome.exe	80
PID 4972 wrote to memory of 2884	4972	chrome.exe	80
PID 4972 wrote to memory of 3584	4972	chrome.exe	81
PID 4972 wrote to memory of 3584	4972	chrome.exe	81
PID 4972 wrote to memory of 3584	4972	chrome.exe	81
PID 4972 wrote to memory of 3584	4972	chrome.exe	81
PID 4972 wrote to memory of 3584	4972	chrome.exe	81
PID 4972 wrote to memory of 3584	4972	chrome.exe	81

C:\Users\Admin\AppData\Local\Temp\JJSploit Installer.exe
"C:\Users\Admin\AppData\Local\Temp\JJSploit Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq JJS-UI.exe" | %SYSTEMROOT%\System32\find.exe "JJS-UI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq JJS-UI.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\System32\find.exe "JJS-UI.exe"
    3⤵
    PID:2724

C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe
"C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:420
- C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe
  "C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=gpu-process --field-trial-handle=1608,13248171221138399431,4850798616509006651,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1628 --ignored=" --type=renderer " /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3332
- C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe
  "C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=utility --field-trial-handle=1608,13248171221138399431,4850798616509006651,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe
  "C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=renderer --field-trial-handle=1608,13248171221138399431,4850798616509006651,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\JJS-UI\resources\app.asar" --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Programs\JJS-UI\resources\app.asar\build\preload.js" --enable-remote-module --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0x64,0xd8,0x7ffb23874f50,0x7ffb23874f60,0x7ffb23874f70
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1548 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1452,4046270089143947408,14660738328554942538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3240

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4464

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3360

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1892
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1892 -s 3752
  2⤵
  - Program crash
  PID:5676

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3896
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3896 -s 3664
  2⤵
  - Program crash
  PID:5704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5Z1D2Q1P\intersection-observer.min[1].js

Filesize
5KB

MD5
936a7c8159737df8dce532f9ea4d38b4

SHA1
8834ea22eff1bdfd35d2ef3f76d0e552e75e83c5

SHA256
3ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9

SHA512
54471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5Z1D2Q1P\scheduler[1].js

Filesize
6KB

MD5
053aba5b08c61a912d3b7cf8044bb6f0

SHA1
59729e00835ebb1c9abdaffeb19590470ee798b9

SHA256
b647e216c6cdcefb653b61550aa513149d44d08528d58203634ddba833ddf148

SHA512
ce3c9c89bab8f9105854b12126464d5b31ecc34d5faddb4c8712dbcce2b32c698ea36d39ad5651234cf7bb4de553bbc56ca2e5d0adab77f2d1858dbfc240c8ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5Z1D2Q1P\webcomponents-ce-sd[1].js

Filesize
95KB

MD5
7398059a27e5dbab14b01dc15ea207f5

SHA1
4724ae8457f9ac2c5b4d66f81292158f453beec3

SHA256
8b6a6979b9ecfdab93543315ec37ca68bc68bdf46e268ebd10feba587150ab4e

SHA512
01a57998f80f6d8560047cf5f5789bb24d7fffa807b31a9c583716f9efd4ea408af2844314c6fb0f97ff133e69104d9ce2791b696199a5748a1b47847514d9b7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AXVR8J4K\network[1].js

Filesize
13KB

MD5
72bc842c312e3a6eaa73602389e2dbc5

SHA1
a5bb1c84e5d422eaeb9f902d0a419da585cb1b5f

SHA256
5a39263cc7a4ba42309ac2691354d40dc76be1ed2a82450eebc6303efc7aaed1

SHA512
2fd03ff16aa0e1bef57e9c582af931873a692d081c116f1b070685f3fae8ac3c38202269bf7f1613177b5835152693941d6ec4d55517d7df6502c7fad46a05e5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AXVR8J4K\spf[1].js

Filesize
38KB

MD5
568e84d665a2e928f88ea73692edffba

SHA1
f0de07cac30ef21c2711f21d2402ae7026a9e4a3

SHA256
d3699efe826dcc7f466173c6a3c57ba26b199a6a761559ded793bbb32dd21330

SHA512
594c2a151fe83a930965bd5f309b1f344425a05e10fd08f1bb0e11690c2745ad07731a6f5cc4dbf3370fdcf0c673cfb53809aa30ef7c1e50b91149ff1e9b44e7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AXVR8J4K\www-i18n-constants[1].js

Filesize
4KB

MD5
4fb6f67e921d90edf10bffa692afa8d3

SHA1
20409b47043939b50c8db586a348119b0ee846a8

SHA256
35368b524463f0eb4b8e1264227c4341730a761f9b41df8cb9e4190488138f6e

SHA512
08753adcbe5f31b527440e953db564211a0292336dbe41da7f4a7907f9e7f3382af0aee1ab2c9522542bbf1348eb8bfa68a83347f71d5be215d3c99a231d316a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\AXVR8J4K\www-tampering[1].js

Filesize
9KB

MD5
338bed5b304e89fa7c33097b74f91225

SHA1
cfc9f80a49475611af3db054d3e0a2e358684f6c

SHA256
263b93aacc390e680f2c5e09cdf10b209be9f0e9a80c05a34dcf6ceeb0ae92d1

SHA512
91f682da01aad703df73407846b54f53c02bbe97ef38a525dfa8cf39bafb86e34ca637936b469da35cc9430d625a84231eaaa824eb21c6dda5a060ce120601aa

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FKS5IB0W\rs=AGKMywHehyBthAkKDyrgX1euBS9-fxiOMA[1].css

Filesize
75KB

MD5
0bf9f8170c32e1d4b47b86302977acb0

SHA1
a26b00cc23f4edc438f7b1bc34f757dc9d450afd

SHA256
9ffc9adb2731ee0c960d5e298e3c1df846a560ef0d5020cde0655379e48d4834

SHA512
e599d4fe6fe4bfe419106bc2ac3816c5d2828534d689bf3ecc3fa6654c5983ac5f8226fc3836245edfeff0fc09ccd7913cc6348b676727af780e5f12ffbae47b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G2PBNGES\www-onepick[1].css

Filesize
841B

MD5
b182f64ebc958940b940085ec72bfd32

SHA1
5d11fd1d9609c99480a4cf231e35973abafee58b

SHA256
f013fb8bcc8b163655a877ca39afa7f96d49356ac8b78642a94c2deb86396fc9

SHA512
89b9e917f6920a4976f243e869e9a2c53f569eb1519cf3d84b50a7033f51ad505c7a11e99f70bf7536bb44d793bad2af77f93b38b84f8211cafef45c665ede94

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\R6LZ7WYF.cookie

Filesize
222B

MD5
cfd3f08ffabf716226bc7f30305c937c

SHA1
4351068469aebcf61b9b0f474e03dc42852a731d

SHA256
9e03573100c39ec3382bc0975622aabfed874962897469083f00c2cd41ad643d

SHA512
918890cd36ea328cd0dd6dcf103b11fdd229a67436f354495039fe4b5ab82f2884b21ef7de7b0ec0b976428cd79cb633ec0225156d9337133fb5e67b1e4c4170

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
31bb29ef8bcf505960bdec7314663145

SHA1
608aa8d9439315e92c2a56e6720c799442514645

SHA256
026d90ace2c7cec36339a526aeeb701217b838bcee0b1d4c052dfd9c27b19972

SHA512
8396dea1ec61468a758956c281b9ec21f7e4a2706ea4d5209a3f0df46eecb94ea4a6d3168e0cd0cd2514be8ea32aa6721feb72d6d36eea864a9165b0852d3c0c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6

Filesize
472B

MD5
ed3f32fef9b843f5511bb882c0a38358

SHA1
a1a60921f7cb6ab14b645c77bb7d77c20b8201ef

SHA256
9a4b9e269aa66258c1d9b10fb1af899a3e669de3e244dcfd843a0bce87646f8e

SHA512
c14336e5ee87435ebeb3ecdfe5ef4434288659feaaae2731995b425d18c9041a1ba0af449706cf87dabd439e9d010acd6dcda4d17df0fac24b5093fce1760336

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
25fccbc60c143954bf24048c2bd7ee51

SHA1
0a58132616246eb85f9deaf0570f98ae883aa9fe

SHA256
657651283ef36e1c0340297e3b8db7981e33469cfa6277a47371ea80c08cf138

SHA512
b25c889591ede53a22e90812f360a81b8ff16c137a0eb0566126193aad1a6ef1f82fb1b01bc76b5634a900c78218935166be2229b29d34d3735013a0dce69fc7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_FC0E27DF3B28ECAD6E793F5FBB75AC7F

Filesize
402B

MD5
44230df00907595308b1164c77d26a7f

SHA1
4fc09670b75a6e8784188d91d68981e674674c9f

SHA256
4ca6238809ce13068049da0b77f82b6a876585eba78e6b659aa5ee11ed460725

SHA512
37cd2a296835b4c481b738d7d3656e62cfc7daa5ae4e8ec6930766a048b142ddc8a44e80e24374aa7db97ca9f6a581a228f7d50646def307a7bd8e90df13ae20

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
340B

MD5
c2bc7a0699ec753580847c386a1e99f6

SHA1
da19989f02426ac2b9f0078c2821fffb3c7870eb

SHA256
b7cb882623e9da56faa67107d9c76b5b495a2e3f7e8c1920916f72b562b0c69d

SHA512
6324b0f78da271b3750729bce44d5237e80fcd7fd53b1ab09c6e847cc0deea69b15e5b6137ff1b9aff3b30a725023cb74155cfee287fd4899e9abaf723fcd8f3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
340B

MD5
c2bc7a0699ec753580847c386a1e99f6

SHA1
da19989f02426ac2b9f0078c2821fffb3c7870eb

SHA256
b7cb882623e9da56faa67107d9c76b5b495a2e3f7e8c1920916f72b562b0c69d

SHA512
6324b0f78da271b3750729bce44d5237e80fcd7fd53b1ab09c6e847cc0deea69b15e5b6137ff1b9aff3b30a725023cb74155cfee287fd4899e9abaf723fcd8f3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
340B

MD5
c2bc7a0699ec753580847c386a1e99f6

SHA1
da19989f02426ac2b9f0078c2821fffb3c7870eb

SHA256
b7cb882623e9da56faa67107d9c76b5b495a2e3f7e8c1920916f72b562b0c69d

SHA512
6324b0f78da271b3750729bce44d5237e80fcd7fd53b1ab09c6e847cc0deea69b15e5b6137ff1b9aff3b30a725023cb74155cfee287fd4899e9abaf723fcd8f3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6

Filesize
402B

MD5
4b9f5ba4d15b0fafaf3d89dced151274

SHA1
01b838db66a356986bfc5192b1a12da41c96d83f

SHA256
c6a87796dd512e3171e45e9841e6f7d0aa6eddc515415014c62676d74b88c5c1

SHA512
d2c0a0c92c8ba859d1f4754f1c30eada0ed76509e2f088e7a92a674f06e9975687ccdc3a2f6bb86587227537149b65c2404f71251c4332521c274baaec0f21f0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
f6e68e3626028db814951a66864ea4d8

SHA1
2243378eaa77a475f42a215d96c0fd5ab85c39f7

SHA256
a9cfb16cfcc2673359600f7340dbe820498f02d80617076b3c15dbd02dd4d6f5

SHA512
6c8853578879591d125084cc56a2cd734525c8cbc03d32b7f265d6d24c9a635957accc58dfa1d0a59a51a27627f6054b43a3f363186fb442ee994b8f0e39d192

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
f6e68e3626028db814951a66864ea4d8

SHA1
2243378eaa77a475f42a215d96c0fd5ab85c39f7

SHA256
a9cfb16cfcc2673359600f7340dbe820498f02d80617076b3c15dbd02dd4d6f5

SHA512
6c8853578879591d125084cc56a2cd734525c8cbc03d32b7f265d6d24c9a635957accc58dfa1d0a59a51a27627f6054b43a3f363186fb442ee994b8f0e39d192

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\D3DCompiler_47.dll

Filesize
3.5MB

MD5
6bc4ada9a7cab72f49c564e6c86b4c3e

SHA1
f0fba01542a0fbe585106f7efd884df65e8c89dc

SHA256
7d0d1290382ea0e44a3178446a0c202696237e27dbb5f8f0827691092b8f2228

SHA512
d7ec39514c104b40a42cd3ca956ba84f5a78f237a39f40d85ba54983145bce2dfbc7ec5e0cbc1bf8ab64d1d370371a7cba5e30202d2c1f37782db32486ed7f6e

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe

Filesize
86.3MB

MD5
f5785ecacd2d277155d5508c2da9691a

SHA1
9493e996f43ab114ca81c6e7471b09aaacf9cac6

SHA256
9726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657

SHA512
080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe

Filesize
86.3MB

MD5
f5785ecacd2d277155d5508c2da9691a

SHA1
9493e996f43ab114ca81c6e7471b09aaacf9cac6

SHA256
9726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657

SHA512
080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe

Filesize
86.3MB

MD5
f5785ecacd2d277155d5508c2da9691a

SHA1
9493e996f43ab114ca81c6e7471b09aaacf9cac6

SHA256
9726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657

SHA512
080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe

Filesize
86.3MB

MD5
f5785ecacd2d277155d5508c2da9691a

SHA1
9493e996f43ab114ca81c6e7471b09aaacf9cac6

SHA256
9726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657

SHA512
080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe

Filesize
86.3MB

MD5
f5785ecacd2d277155d5508c2da9691a

SHA1
9493e996f43ab114ca81c6e7471b09aaacf9cac6

SHA256
9726f363853807338f7affc14689320ac9aefef3a08f030d2d9f6f1770f1f657

SHA512
080f30724a0dabf1a8d6b843c47ea073448e012680213592563180281dd13fbccf5634aba51f618cbcb9737de1088abaf39319be6a8606a4f10d822ee0caa97c

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\chrome_100_percent.pak

Filesize
175KB

MD5
3ff806f44723cee528a1aaee4d3a289e

SHA1
56830e7ff31f803077aed774fafebd4e6c5e6c90

SHA256
65cb11d090b32e0fb3c740a736c13c0a47cb1bcb265c084e3de5bb7474fb662f

SHA512
03dafb839308d644a9943ba66838536fbd1f606cafe392f90925ce51766b5e3a9064d60ca8463bacf7238258beded570d5a0007f3ce11c14f87b10faa2da2977

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\chrome_200_percent.pak

Filesize
312KB

MD5
bd66e8de6979dfe12cbaa29390d11a64

SHA1
967916eb7587f0163fbce50c7b4822d06e939d5a

SHA256
cd584f20aeed80fe5852d5d5656a12d25d9116d6b805ddbec3874d310925df2a

SHA512
f77bd5004d8da54e8588ffcf6962b3244b8e4a9f6310d31f0c7c44d913504577c9e3fb858078705c384649fbcf26223d8f98dd02778e259a8924028f2be3bc1c

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\ffmpeg.dll

Filesize
2.1MB

MD5
f193d766add1c6386ff6dbbccf7e176a

SHA1
c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1

SHA256
cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893

SHA512
8ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\icudtl.dat

Filesize
10.0MB

MD5
3f019441588332ac8b79a3a3901a5449

SHA1
c8930e95b78deef5b7730102acd39f03965d479a

SHA256
594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57

SHA512
ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\locales\en-US.pak

Filesize
75KB

MD5
a2201115723fd61d1e68ab001e6cdca0

SHA1
a97073e22adf7b300e702e717743cd249e64b4fb

SHA256
3333cf1fb2b0c15ea819787ba672d2274f3136e6a8729f2e5d2796b740688183

SHA512
e68c451602a0c2cd47ee3652daf1d74d87e6e61ebda9166cbb182301f03118b72288968695f85a1bcdefb45e4753ba7187dd5159b6694952f33238af39d89479

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\resources.pak

Filesize
8.9MB

MD5
5118ebd39acde0236a71fad2880add8c

SHA1
1daa8e701f17a793c0e70f4b0aa36fbb376962ae

SHA256
e3386c5fd98dc711a70eae7a9f6bf3139de3e9a15e3a022d343a459b747c6471

SHA512
925ae1d8c643e4f3c20221ae850a171e6032d9e391cf07e5efab4a4a29e8f6640973a8f0dc97704df5263ed93dfd4c32650c656fbc9874c98ab87c6131fdcaa8

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\resources\app.asar

Filesize
25.5MB

MD5
66c0a1c656ab24aecb609cd8a19ba260

SHA1
a86f3c6b9a6d109a08122a331f58f056f269bfce

SHA256
55fa1a547472dacc5b91e29ff3693ca62e155a7c1dd3dcca5e52bad5c16ba2b5

SHA512
d6036159be4088b2e0a703056072254a9a00ef58921a036858e9c7c9830d397c7222fb159ff3faad3a258ae69bfbbdb3ae4f3d6f332edb350e0654cf688b4216

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\swiftshader\libegl.dll

Filesize
326KB

MD5
cb5e28007c9d61871ceb5dcb2b657985

SHA1
f2fcd64cbcfd8657a6326c152b14f6114eb74606

SHA256
c3dc1eaaf67f0a8c7bf80dcdd2830d79c5d980fca19aa854512cd69c79df8b1c

SHA512
18635d1120cb983601c234bf662d85939f0046a84bfc652f680c078e52a0cfc41b2e2b3098f3a365663f14a9ea1ad51c93527370f58d57788e9ceea46b507dee

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\swiftshader\libglesv2.dll

Filesize
2.9MB

MD5
34c323f53fcc4021f446fb1e4c14ff09

SHA1
d4160430c8fb300d7d5505fc08d671e53f1e1b6b

SHA256
6202bf896139be5e8d7f38ffa1e68c65828ccfe02c33e7912c67883031f4647a

SHA512
e591366d71edf938ea5b921b2efd1647c73a97442c2fbe038f1f35e2fec0323848c20e6858189f655ff222672a40b3d8d31e1cb7bcb22cb00597e71d5172f655

Download Submit
C:\Users\Admin\AppData\Local\Programs\JJS-UI\v8_context_snapshot.bin

Filesize
541KB

MD5
bd06321191c06413bb9c15c3987859ef

SHA1
eb6a73a3429f3151632a05d5ca5e3590b782ed85

SHA256
cfbc1a5e921074913a87b1ce7d6d99cb4accf6d7926d242bd264846142dc635d

SHA512
48ddbd1d8c77857b2a2bee65f4b903441bd675fc7bf53e96be2a78557f85c00f27344e7cdd29352ec9977417b991316365d66f5e40b4b9884415693aba283ded

Download Submit
\Users\Admin\AppData\Local\Programs\JJS-UI\d3dcompiler_47.dll

Filesize
3.5MB

MD5
6bc4ada9a7cab72f49c564e6c86b4c3e

SHA1
f0fba01542a0fbe585106f7efd884df65e8c89dc

SHA256
7d0d1290382ea0e44a3178446a0c202696237e27dbb5f8f0827691092b8f2228

SHA512
d7ec39514c104b40a42cd3ca956ba84f5a78f237a39f40d85ba54983145bce2dfbc7ec5e0cbc1bf8ab64d1d370371a7cba5e30202d2c1f37782db32486ed7f6e

Download Submit
\Users\Admin\AppData\Local\Programs\JJS-UI\ffmpeg.dll

Filesize
2.1MB

MD5
f193d766add1c6386ff6dbbccf7e176a

SHA1
c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1

SHA256
cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893

SHA512
8ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984

Download Submit
\Users\Admin\AppData\Local\Programs\JJS-UI\ffmpeg.dll

Filesize
2.1MB

MD5
f193d766add1c6386ff6dbbccf7e176a

SHA1
c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1

SHA256
cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893

SHA512
8ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984

Download Submit
\Users\Admin\AppData\Local\Programs\JJS-UI\ffmpeg.dll

Filesize
2.1MB

MD5
f193d766add1c6386ff6dbbccf7e176a

SHA1
c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1

SHA256
cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893

SHA512
8ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984

Download Submit
\Users\Admin\AppData\Local\Programs\JJS-UI\ffmpeg.dll

Filesize
2.1MB

MD5
f193d766add1c6386ff6dbbccf7e176a

SHA1
c467242b06dd9ad3b81f47f3fd4cb2faf320f0f1

SHA256
cb7e3974970f4e306e444a4b605e4ed9a83fe62383cfa4897755c77eecec7893

SHA512
8ea7dcd2a417d3cb49ff8523a250ee804158101b355f61377f967d7ff309ec743e9c3c055022179c37dc736314ed73097b601c9376d11cf34d750049ab6e1984

Download Submit
\Users\Admin\AppData\Local\Programs\JJS-UI\swiftshader\libEGL.dll

Filesize
326KB

MD5
cb5e28007c9d61871ceb5dcb2b657985

SHA1
f2fcd64cbcfd8657a6326c152b14f6114eb74606

SHA256
c3dc1eaaf67f0a8c7bf80dcdd2830d79c5d980fca19aa854512cd69c79df8b1c

SHA512
18635d1120cb983601c234bf662d85939f0046a84bfc652f680c078e52a0cfc41b2e2b3098f3a365663f14a9ea1ad51c93527370f58d57788e9ceea46b507dee

Download Submit
\Users\Admin\AppData\Local\Programs\JJS-UI\swiftshader\libGLESv2.dll

Filesize
2.9MB

MD5
34c323f53fcc4021f446fb1e4c14ff09

SHA1
d4160430c8fb300d7d5505fc08d671e53f1e1b6b

SHA256
6202bf896139be5e8d7f38ffa1e68c65828ccfe02c33e7912c67883031f4647a

SHA512
e591366d71edf938ea5b921b2efd1647c73a97442c2fbe038f1f35e2fec0323848c20e6858189f655ff222672a40b3d8d31e1cb7bcb22cb00597e71d5172f655

Download Submit
\Users\Admin\AppData\Local\Temp\99b6be4b-ac18-468a-be70-a2b94201d7fc.tmp.node

Filesize
117KB

MD5
80b6d5f12dfe42f21dc5ec5ee793ad08

SHA1
53aca73b99b75191bdce2a025151848b370dfeae

SHA256
0d7f23c4e4b1a3dd6e2e77465b4bbe1487a82e9681c327e48090abf3c726ec0f

SHA512
236fa76c080f915f221d0584445261b87c77425400f260555395f0f5a29ca3cffb6ee8c9e477d1d4895c10406e651c8d87771f1b1de889fca5bd6bc4f818bc9d

Download Submit
\Users\Admin\AppData\Local\Temp\nss75F1.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nss75F1.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nss75F1.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nss75F1.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nss75F1.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nss75F1.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
\Users\Admin\AppData\Local\Temp\nss75F1.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/1448-188-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/1448-187-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/1448-186-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3580-181-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3580-184-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3580-182-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3580-183-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/3580-180-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-152-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-139-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-175-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-173-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-171-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-172-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-170-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-169-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-168-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-167-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-165-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-163-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-162-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-161-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-160-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-159-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-158-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-178-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-157-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-156-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-120-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-155-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-154-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-153-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-119-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-151-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-150-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-149-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-176-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-146-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-148-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-145-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-144-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-143-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-142-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-141-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-140-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-147-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-138-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-137-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-136-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-135-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-134-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-133-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-132-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-131-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-130-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-129-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-128-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-127-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-126-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-125-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-124-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-123-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-122-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4240-121-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download