hxxps://drive[.]google[.]com/drive/folders/12_8O2o_9tufEE5Dvup-uVXVdvSsp1JfE

Analysis

max time kernel
239s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 14:24

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/12_8O2o_9tufEE5Dvup-uVXVdvSsp1JfE

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	JJBotv3.exe

Executes dropped EXE 2 IoCs

pid	Process
2196	JJBotv3.exe
4364	JJBotv3.exe

Loads dropped DLL 64 IoCs

pid	Process
3200	MsiExec.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
4	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\JJBotv3\runtime\legal\java.base\LICENSE	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\java.desktop\LICENSE	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-interlocked-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\release	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\java.desktop\giflib.md	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\msvcp140.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\app\jnativehook-2.2.2-sources.jar	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\javafx.base\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\prism_sw.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\conf\net.properties	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\server\jvm.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\javafx.controls\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\app\JJBotv3.jar	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\lib\security\public_suffix_list.dat	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-core-datetime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-debug-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\javafx.graphics\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\lib\security\cacerts	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\java.desktop\lcms.md	msiexec.exe
File created	C:\Program Files\JJBotv3\JJBotv3.ico	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\lib\jvm.cfg	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\msvcp140_2.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\lib\psfont.properties.ja	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\java.desktop\freetype.md	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\javafx.graphics\mesa3d.md	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\lib\jrt-fs.jar	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\conf\logging.properties	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\prefs.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\lib\fontconfig.properties.src	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-synch-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\prism_d3d.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-core-file-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\java.desktop\libpng.md	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-processenvironment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\conf\sound.properties	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\conf\security\policy\unlimited\default_local.policy	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\include\win32\jawt_md.h	msiexec.exe
File created	C:\Program Files\JJBotv3\JJBotv3.exe	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\include\jvmti.h	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-crt-multibyte-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-profile-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\java.desktop\mesa3d.md	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-handle-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\java.logging\LICENSE	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\legal\java.desktop\jpeg.md	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\jsound.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\msvcp140.dll	msiexec.exe
File created	C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59236c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D1519E14-2AB0-389C-B7AD-51E57DC3C2DC}	msiexec.exe
File created	C:\Windows\Installer\{D1519E14-2AB0-389C-B7AD-51E57DC3C2DC}\JpARPPRODUCTICON	msiexec.exe
File created	C:\Windows\Installer\{D1519E14-2AB0-389C-B7AD-51E57DC3C2DC}\icon1735593305	msiexec.exe
File opened for modification	C:\Windows\Installer\{D1519E14-2AB0-389C-B7AD-51E57DC3C2DC}\icon1735593305	msiexec.exe
File created	C:\Windows\Installer\e59236c.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI269A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{D1519E14-2AB0-389C-B7AD-51E57DC3C2DC}\JpARPPRODUCTICON	msiexec.exe
File created	C:\Windows\Installer\e59236e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23CA.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000096fabf83e47a2dea0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000096fabf830000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090096fabf83000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d96fabf83000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000096fabf8300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JJBotv3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	JJBotv3.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "198"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\ProductName = "JJBotv3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\ProductIcon = "C:\\Windows\\Installer\\{D1519E14-2AB0-389C-B7AD-51E57DC3C2DC}\\JpARPPRODUCTICON"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\Version = "16908288"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B1423C193BBCC4D34B6F4D3AA87894B0\41E9151D0BA2C9837BDA155ED73C2CCD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{553AB484-4616-49EC-93E5-252536655E30}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\41E9151D0BA2C9837BDA155ED73C2CCD\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	taskmgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_Windows-20240807T144407Z-001.zip\\Windows\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\41E9151D0BA2C9837BDA155ED73C2CCD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B1423C193BBCC4D34B6F4D3AA87894B0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_Windows-20240807T144407Z-001.zip\\Windows\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\PackageCode = "DE93FC7454BF4194BB87A0F843899217"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\SourceList\PackageName = "JJBotv3-1.2.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{F2F8341E-5F5E-4D59-BCCD-18E826138718}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41E9151D0BA2C9837BDA155ED73C2CCD\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
2076	msedge.exe
2076	msedge.exe
3608	identity_helper.exe
3608	identity_helper.exe
3548	msedge.exe
3548	msedge.exe
3852	msedge.exe
3852	msedge.exe
3844	msiexec.exe
3844	msiexec.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
1900	msedge.exe
1900	msedge.exe
2184	msedge.exe
2184	msedge.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
4148	identity_helper.exe
4148	identity_helper.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3608	msedge.exe
3608	msedge.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5028	msiexec.exe
Token: SeSecurityPrivilege	3844	msiexec.exe
Token: SeCreateTokenPrivilege	5028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5028	msiexec.exe
Token: SeLockMemoryPrivilege	5028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5028	msiexec.exe
Token: SeMachineAccountPrivilege	5028	msiexec.exe
Token: SeTcbPrivilege	5028	msiexec.exe
Token: SeSecurityPrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeLoadDriverPrivilege	5028	msiexec.exe
Token: SeSystemProfilePrivilege	5028	msiexec.exe
Token: SeSystemtimePrivilege	5028	msiexec.exe
Token: SeProfSingleProcessPrivilege	5028	msiexec.exe
Token: SeIncBasePriorityPrivilege	5028	msiexec.exe
Token: SeCreatePagefilePrivilege	5028	msiexec.exe
Token: SeCreatePermanentPrivilege	5028	msiexec.exe
Token: SeBackupPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeShutdownPrivilege	5028	msiexec.exe
Token: SeDebugPrivilege	5028	msiexec.exe
Token: SeAuditPrivilege	5028	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5028	msiexec.exe
Token: SeChangeNotifyPrivilege	5028	msiexec.exe
Token: SeRemoteShutdownPrivilege	5028	msiexec.exe
Token: SeUndockPrivilege	5028	msiexec.exe
Token: SeSyncAgentPrivilege	5028	msiexec.exe
Token: SeEnableDelegationPrivilege	5028	msiexec.exe
Token: SeManageVolumePrivilege	5028	msiexec.exe
Token: SeImpersonatePrivilege	5028	msiexec.exe
Token: SeCreateGlobalPrivilege	5028	msiexec.exe
Token: SeBackupPrivilege	5084	vssvc.exe
Token: SeRestorePrivilege	5084	vssvc.exe
Token: SeAuditPrivilege	5084	vssvc.exe
Token: SeBackupPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe
Token: SeTakeOwnershipPrivilege	3844	msiexec.exe
Token: SeRestorePrivilege	3844	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
5028	msiexec.exe
5028	msiexec.exe
5028	msiexec.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe
4364	JJBotv3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4908	2076	msedge.exe	82
PID 2076 wrote to memory of 4908	2076	msedge.exe	82
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 4580	2076	msedge.exe	83
PID 2076 wrote to memory of 428	2076	msedge.exe	84
PID 2076 wrote to memory of 428	2076	msedge.exe	84
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85
PID 2076 wrote to memory of 4800	2076	msedge.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/12_8O2o_9tufEE5Dvup-uVXVdvSsp1JfE
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9de7646f8,0x7ff9de764708,0x7ff9de764718
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6413423730907013970,13201311720866889745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
  2⤵
  PID:468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2296

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Temp1_Windows-20240807T144407Z-001.zip\Windows\JJBotv3-1.2.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5028

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:60
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D1F63FD2D9BCAB52EF382FCC35F68FFE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Program Files\JJBotv3\JJBotv3.exe
"C:\Program Files\JJBotv3\JJBotv3.exe"
1⤵
- Executes dropped EXE
PID:2196
- C:\Program Files\JJBotv3\JJBotv3.exe
  "C:\Program Files\JJBotv3\JJBotv3.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:4364

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=enu-0q.exe enu-0q.exe"
1⤵
PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9de7646f8,0x7ff9de764708,0x7ff9de764718
  2⤵
  PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9de7646f8,0x7ff9de764708,0x7ff9de764718
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2368 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,67729301917020737,8195658962661608739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38d3055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
PID:1384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59236d.rbs

Filesize
54KB

MD5
2dbfcb49833732e4953156797d8ebc20

SHA1
495a41a1dfaf687ad8c87dbe299c998a2a7e1d16

SHA256
c1b3cbe4f418c7b50b61aee7e70f7b1f64faa50b38a86d703f9240cee02eef52

SHA512
ae0dea4cf719b10bbd51226bf343a1a062b742d32d88b75782caaf0f0b68f95bcd3af1aa227947502cc0d04d04c7655a730e81647d493ed8aa5a431d59dabcd8

Download Submit
C:\Program Files\JJBotv3\JJBotv3.exe

Filesize
566KB

MD5
ccfc78420b2af4397bc801d6984cb233

SHA1
634b548812570b28eaf01ddd7dc5e8b1c778332f

SHA256
cf890ee78014d4d0c072bc7a7ac84c90f9d25eb837b70b892ef1be4c876214fe

SHA512
47b84cd94df6c31b9e6024eb13550bd98a377d073bb30b31e3d11f1e6007560a47c83e6dadbc16897a3f87512503fe52fdf30c50e96a4aefc1672e46fabc592b

Download Submit
C:\Program Files\JJBotv3\app\JJBotv3.cfg

Filesize
297B

MD5
2c154a32a43b5bffe33e944a1fe19dc5

SHA1
4edda32f6dfa4a26030b8578f231fd55397ca2b9

SHA256
f2c88f7b06f35d29ef7d34edc89e48ec1ee4b703b1709c2498ce6e8196486761

SHA512
025a1838b2c2c92d5f7bcc76202db56f438699398dfb71015ccc6da826e2e0fd263dd629e79ad4ab75152b3462c972fef791e62a4521eb8eb32854b104af671f

Download Submit
C:\Program Files\JJBotv3\app\JJBotv3.jar

Filesize
16KB

MD5
c0990c2892f652efde27ef60bba52423

SHA1
bc3c2d0e02d7c441a274b0d09bf6340e39b43616

SHA256
80091d2b73493607eed2aa462b7da2f63e350ed9b49c5914d271ccc218f20d1b

SHA512
cf5cfd9459d26845fd03147c628132befb71d3588bad956aece874b296381aa6a2881b2b06b9f622990d4070a9079d65d0fa41e8ff450b883bfb7ad0da0e9c24

Download Submit
C:\Program Files\JJBotv3\app\jnativehook-2.2.2-javadoc.jar

Filesize
356KB

MD5
a31b4909de04bca3704bf761f02916e6

SHA1
cf5ae1e3b1b94d6a18d17398ad5791ac933ce29b

SHA256
158a3e503aab115bba4a60f35698fb71e136ca7882cda15c7666c2fad2c65a62

SHA512
48d4afadfbe8290f769c29a35e6f039ebf1999daf9ddb5651b7c45a2170c4c51f47e9cac5b7cf2675cb7e4d10289ad2b58ca9d2ecb56af8ccf5cbe6dd1541de9

Download Submit
C:\Program Files\JJBotv3\app\jnativehook-2.2.2-sources.jar

Filesize
564KB

MD5
5910c47d885a60905e5787ded53f6cb6

SHA1
88739bfe0ba179d5f37ab1b9a9202b44dace8616

SHA256
1e484b3f7a0a531b37360e70573b5f444c0534fddd7815ab9a7163d3378270d1

SHA512
72940da46537bac9a7e433c97ecda495bc38b1b6478dd6c88ce14c67f12298ca34212cb4b0cb70a02693e1c692617839f7de0a5cea4e199373ff2ee651920946

Download Submit
C:\Program Files\JJBotv3\app\jnativehook-2.2.2.jar

Filesize
657KB

MD5
673bc1fae6ad9f3938efead7986ddb02

SHA1
183dd1fb8927b008761802bb402629d5749b15d0

SHA256
2c7904423bc680af02d9ea9557ae233c35199e302d072773a9d0304b568acd41

SHA512
6b74f38352d5f1871e5c944f76d3a8e2fcdba8b7beb281ed0fa88b0979e8abde824b30f85e19c410c4f3797b6bc75f57b6b623112a6e186f6e4655343a2d5713

Download Submit
C:\Program Files\JJBotv3\runtime\bin\java.dll

Filesize
143KB

MD5
aa069d2675ed9415ed03ec50618613cf

SHA1
ecdd5d910052006c1a98f51d927fe048739776e9

SHA256
66c02525e5ec60e0d74b4225ed6f7d85c778d774f298b46577aea82b369689c1

SHA512
55d3f64576e6e4bbbe89082b347161a8f8d67d4c0fb0a5104286bfbb4a822d8a8e88c7c161ea3db703032065cf716328fcc3db4acd4637c6157cef712977f845

Download Submit
C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-console-l1-1-0.dll

Filesize
20KB

MD5
2c146bc8d73b8944f35506241b9953a9

SHA1
ac64abd745418cea35c0506b9cb0331b171b51ea

SHA256
89384f8f64a9b7f67c8deccaa721e2d76b8a17026d8083630859ed0cd1a9b58b

SHA512
02713948a156baccb2e7c38646193e82fef65400c086644866b698bc3e0a8c155a8eab829463e3868ce2b8a06608c5ea6de1e390bff976c5f92e2e42dd6c04f1

Download Submit
C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-console-l1-2-0.dll

Filesize
20KB

MD5
7a55e51d07e1f15221eb11479adbc53f

SHA1
8d8e2beff4dfa78372201b26a67b9dc4b116290f

SHA256
f901b0bc8c00b3afc80e151e6f54b18f7672f932602c304fbfeedd5aa3ad63c8

SHA512
e89c0e45014abdaf7548de0352949c4ad496d97cad2f9e2f6c83a90f853b7b71354b9abbb957eff89076df79bdc9cc1c431b6f35875550bfb4198c3a68124197

Download Submit
C:\Program Files\JJBotv3\runtime\bin\javafx\api-ms-win-core-datetime-l1-1-0.dll

Filesize
20KB

MD5
f0c9c56f56ffa3adc548173569dbd793

SHA1
220a56b84cdb8cd403483d3f6b4bb526fe198fd9

SHA256
12d801992bbb09d43bb90330bb96e77bf12e669c325dda4b5235942221c301c8

SHA512
28e24a2ccedfaf01aef615c1df7f8c76ff0eb06d992eb1b422f902d6d96357ba6a353e31ca9b1fd305e7de7a437ee6a7f2f01bfdf27c4a88c805693ae2b6352c

Download Submit
C:\Program Files\JJBotv3\runtime\bin\jimage.dll

Filesize
32KB

MD5
bd60efd008e48bb99caeac946ced792e

SHA1
855d278e7ca1c1e918bd5f32c2a3fd8772554f52

SHA256
fc2be5399a034c07beb51270471144eedecc5068139b7ae2a7dfff7719b19746

SHA512
d66a0095c57a521537dde53b4c3d730a719f91d41f51f1eb7efd666f5dbc00b9837e7ff28dd05cf3a8a2310a51083e3be044fd126840b0ddb885ff3e0edf5344

Download Submit
C:\Program Files\JJBotv3\runtime\bin\jli.dll

Filesize
88KB

MD5
3a315274152a0ff52027c0ba0a960a21

SHA1
e3ebb1bb6fbacbb12fd9f6231d950666f2e5a034

SHA256
4a40a3a94d69ae05a2d31143c3877ff4ab5bb497445324d1bd693998e0b9ef24

SHA512
9705a7cdc86ee88b64235f4d9362c7b4e610367598ac4f4617a9761675c229b3ad94ecbd321e48718f14fb09419545c01ac975d5e577217a1a2ba85723c6c5b9

Download Submit
C:\Program Files\JJBotv3\runtime\bin\msvcp140.dll

Filesize
558KB

MD5
bf78c15068d6671693dfcdfa5770d705

SHA1
4418c03c3161706a4349dfe3f97278e7a5d8962a

SHA256
a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

SHA512
5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

Download Submit
C:\Program Files\JJBotv3\runtime\bin\net.dll

Filesize
94KB

MD5
b4e840ed1c5dbca49f34028137fb3178

SHA1
98f24cac1b6f8b86ae24efe532720b5256e635fe

SHA256
e0e567586af9eab9f95b6d84b60fd2785e38e202908ca62579d0fa7261a65a83

SHA512
63610e17bf0a2b357e4bed5f78c2e6449ec4d498e70025ff37a8f80362d41e50cef6c4197b3b0eda6f842a8fa90e0e2f88dd59ff0eda1632f17137b5c852365e

Download Submit
C:\Program Files\JJBotv3\runtime\bin\nio.dll

Filesize
78KB

MD5
cf63016b7c60c45d7707b8aabb705ce3

SHA1
3d4067d14260cd816a52e3640774d1fcd8bd64b7

SHA256
b92a5e3024e1c05427cbdc593deaef2473a74d7baf4c5d98063ce6e98bd0a619

SHA512
d84a0d7ce7d5ebc59f17aced76b2aa12f924f9a823f776da49f7099b4f2c3828b737be0001e47486aca9eb70363d9cb9068a1d75524853d0792d71874ee3ca62

Download Submit
C:\Program Files\JJBotv3\runtime\bin\server\jvm.dll

Filesize
11.5MB

MD5
89ad37a2cce32eec711b1df655ce4b8c

SHA1
1fa554d4382696eae8c2523990f3787598a22a24

SHA256
13bcca0624bfb0e41d684a97e50ca07479cb12c6643f61fadf72985688c7a6d1

SHA512
e09a135b86ea9d4778c31ded4a27210114a9db26fdb3085568c70064fb0fa2e8e1903a7286ff7df5025fb8b6fb02af960689fdb6f60820a023b2ae64af5497e8

Download Submit
C:\Program Files\JJBotv3\runtime\bin\vcruntime140.dll

Filesize
95KB

MD5
7415c1cc63a0c46983e2a32581daefee

SHA1
5f8534d79c84ac45ad09b5a702c8c5c288eae240

SHA256
475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

SHA512
3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

Download Submit
C:\Program Files\JJBotv3\runtime\bin\vcruntime140_1.dll

Filesize
36KB

MD5
fcda37abd3d9e9d8170cd1cd15bf9d3f

SHA1
b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2

SHA256
0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6

SHA512
de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257

Download Submit
C:\Program Files\JJBotv3\runtime\bin\zip.dll

Filesize
85KB

MD5
ade1f943087e19c5085ce31125f585b1

SHA1
9f6021d049b09008be221cc1721ea5d12d3dc877

SHA256
090ac3d37609f9717861dfb4535466fb1ff48b2213b837ddc3777f9c8d960d1e

SHA512
f3ed6bfd4614574e300b46545c3e43a73d363c252539a0efbf2bd9e2e8921029b0233a7f67f689dbb967eb648c88c0b012944841a4c3e11aad8d4eb66822857f

Download Submit
C:\Program Files\JJBotv3\runtime\legal\java.desktop\COPYRIGHT

Filesize
35B

MD5
4586c3797f538d41b7b2e30e8afebbc9

SHA1
3419ebac878fa53a9f0ff1617045ddaafb43dce0

SHA256
7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018

SHA512
f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3

Download Submit
C:\Program Files\JJBotv3\runtime\legal\java.xml\LICENSE

Filesize
33B

MD5
16989bab922811e28b64ac30449a5d05

SHA1
51ab20e8c19ee570bf6c496ec7346b7cf17bd04a

SHA256
86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192

SHA512
86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608

Download Submit
C:\Program Files\JJBotv3\runtime\lib\jvm.cfg

Filesize
29B

MD5
7ce21bdcfa333c231d74a77394206302

SHA1
c5a940d2dee8e7bfc01a87d585ddca420d37e226

SHA256
aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0

SHA512
8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c7571cbcc1448aa5246016ad0feba7b4

SHA1
36490fa23f20b45bdd8cda5f72facf47583ebb10

SHA256
8dd3ff85971dffecaac0e59a8bbb61259e9df57ccaa51ea8c316cdaaa91eedb8

SHA512
c17b5de201915e4909e3207d3ded218310e714057ec6c98e0f93fb7b75de7366bab85081cb8d8827df0123509fac176e3d201ac36db7cf25edfa649dc95d766f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
83e6d0bf4f148f075eaedcccd4ce57e3

SHA1
2e0977f229e314490f5761c622f6cb04a3409e32

SHA256
81a1bf635bc913773e162e3367caeb6aa17ad91b211aee06ccc1aaeb6abb8d18

SHA512
21132a003b85fb4741ef3a9a03f4b0079c1c7761df32e680635ae63c1e3d6b8dd2ac7a75853299fa706c4fb0590d60b0fee50c3b17b3eba62df4a859f192da28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
41KB

MD5
dcf42fc7c8989829cd90daaf7653dc14

SHA1
6b2ebe2e31a9dfc8b7656c5e903a61fa743c96a7

SHA256
1663e89cb579b26a30271c29e9342bacd80783ce1239361a24f79d24de271969

SHA512
36c791d5f5e5af50e413d000d4caf8b6dd515bb6fba96c6c8c8c3eda54c08bacb940bdb9b9a6b1f205cf144cc894d71ca25b011af899a7244e645427af97f8de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
1.2MB

MD5
027a77a637cb439865b2008d68867e99

SHA1
ba448ff5be0d69dbe0889237693371f4f0a2425e

SHA256
6f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd

SHA512
66f8fbdd68de925148228fe1368d78aa8efa5695a2b4f70ab21a0a4eb2e6e9f0f54ed57708bd9200c2bbe431b9d09e5ca08c3f29a4347aeb65b090790652b5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
27KB

MD5
09ac9c9a95dde9d928585489b55a7a53

SHA1
a0930234469184cebbc08e399bc4d7ad9003b2a0

SHA256
a2b2e70072c91efc39fce757a94ccb51cb7de56c2e2accc7501947ef0509a612

SHA512
0b6d68f9b28439a56bd0fdbd391f8107023117e985a7087dee483e7dcb998897db2e7ec4cdbd551f6546ec648c2c1b8a4345562f9640bcad14fbedaf2730551a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
bfb210ba7e1e8d5253ec0f1d7a765c94

SHA1
e4717ebc359c49d7cced4a1d3bc9a5465153856a

SHA256
addbc8eb268b19774206c56544f336221ff34e243662502909e4b9811187149e

SHA512
d2ca9bd93e24684f99a6086fa2668121ad0be22ccd46fec406a5b78a3dfee209b6173cc40d4569874b0fbceabade5d851fb626ccbd92d77d0096e0cfd8559d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4e0b7814b15e32565085b8742e3a0aca

SHA1
e07397949823c7334ff189448dfb0b60d3126a0a

SHA256
b8aeae477b917cb854b9b7dd2278236c36ac65ae71788b0fc830ecd0a2e76fab

SHA512
5b69fca13c42c4ac51de2392622574a8d7b527f8d2577efafaec8912ddcafa38c2ea73d76f2dd6886be92c649c4eda95ae64d77475fde2fe1c664abce0ba32cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2201e6200d844d00eadc96af869a378d

SHA1
f7c3e1500e380ab4d23fe34867e7229810f4b290

SHA256
cdb946df371a4bcca794fb1f72ae7b1b77ee33a32446d96dd7b2cf4f0818f650

SHA512
94f56815d8401e997475a6bdc281335816f24b84afa12810d041668f256641bf6b3d4916e03bff1360b2460ded749a7a9b97a6dba842b9b7b41b3b8205fc9697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
fe3657fcde6bc315e3be8cfb9fc274b4

SHA1
f528ed69f04e79ca805f8d6d5bb74d88aaaeee7b

SHA256
7a9d67a118f2e5cd5aff1bf211b75c7db9efa50b82e7bb7fd77025eba0fc73bd

SHA512
f70a468acf4fd5cac38b61bcff2a135d4be26369ae4ab07448ae84abc13260f9c3fdd35d65feb84f564eeb2b2724e1c931e0d71b2ffbfdc7663f1c063f91f86b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
322aab9ac397b0c02fb5c09318fbee3f

SHA1
13bd7d5cab6c6f11054831c70a19512b33911c47

SHA256
8a0f88dd4d028e475c872dabcbf102daa474a4ef52fe4dd173a42a0f1e86281e

SHA512
7a6c2166caa353c1ec050d27b52153b3847b693cb6d55729803ba603d22352fbf9f7033b2b420f3ef5bba8a40d53597cf3c0c5cfa3a479e368b48e179951731e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
730ca28c9cf72cc505d69dcd6a83b101

SHA1
28b65b577fce90171e1551e568dae58bed20aa71

SHA256
d4d36f6029ec6f4c42f465af7e8f0475140c4695ac519a37fa1bf609a0af3590

SHA512
99c793891f86ad0024b7ca6e8582c75ce535aeed654a7c14c00628a80ca24b769a235d066b1f15efa7f7cbf91ee4ec4818dac17a05f815a225f8b6d7053a2662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2f5b32746aa4c98b04338d39353264da

SHA1
3a13a7a951ff9ae03d69758efc5c414b4e32a7a5

SHA256
fca162449137f2d24ee314df8fc64e6773cc968b20502f16543ca7966ae679c7

SHA512
48055157dcd539cd7a0835db3557fde54e13a36db05def5c155d9b27e8fd39884feb974cf66813ff98eb9d4bded6f26e927fa406ee18118980c1cbf66bd9641b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
08714d0f98e3e82211cd4ec737b131bc

SHA1
55e7249aa1538f7b9b5aed4f92016ff9be551598

SHA256
d78a5dcd8eb076ef3b93ddcb041cd3b34a966581fd590e92fc9fab6eedf5c33e

SHA512
bcb78027c254812dcc4e28c456a7b672af1ed8e034df949cdb2f18863bbc99ed66bcb0c0cfbe5553847e30eb867c5a3ca5843fa40148508329e2da637575a588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a7aa32aacda6fa64348c1cbc94a83043

SHA1
af18f2d7d8b1f99271746d5973bb599ada84e6ae

SHA256
ae1e5c6286626e358114721a4cf0d9eca38a13fd871b13a624d43540899094f2

SHA512
d2c8ff1dacf3be86decabff7b910300178df930e9dd838850dc364e24d45bc174a9d290e5a8ca28e5d24bd08b1f5927411838562c04ce6fe8e7256ff963838c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
154558c4119a676d3ec62b1c9b5daf44

SHA1
860d28f93c8889b74bd6acb6defacbec3f6ebf5f

SHA256
4802234018f512a82c33ea6c67b34fc57e3acb5f249e0d3c7c5e9ef0aed1b0da

SHA512
773d389c6d91a670ec0087d750f4455197485a041697107d21e3dfd3c1f93941f4e6dbc0dd01f52f832b65ced3e0b6e45dfea0a5846f96028a4a92e129300dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c77a30aed7b8e620b7b112788c5f5b21

SHA1
116c326e4b1bf1e610679601ad9b6beeb44c597c

SHA256
bda3db8edd3ce3da0b9a16d4833a66e3576693a20348a0c1800daff6796ff0d4

SHA512
dd16a5fc2381cc13c18bb3c07df372db5f7156640d1e8668789d3dc8604a8e74980cac6503d157018597c25530ffe2ed9616b16937cb55d1c806243de7c0d792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
02c7285f9632177c327ba8f94790867b

SHA1
62d0570f27087d0584fbaa4d741a01b6420053bb

SHA256
7712b111c8cc7a61bdd1e32ce3916ccdc4a05d532f202c41ed0140908bab86bf

SHA512
f123e03a7912b96c316a1d3f145c28e9967f8f9b65078a15cdc70431c139f27e8239c9ecee9c9c26f3a3b7a28a2fa0c22e728f3185e2d819159fa98030df5fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
478ebeaf0935b4fecd975d1498f8dc3a

SHA1
b2a97bd991dc8f5e0a31f19bf84c51321f58d793

SHA256
846d631bc457f49068fc42fe66af398761782084932c51d1838108cf9dd90988

SHA512
79e8dd81070e10bcfb35d3a5da6538adcba0f9899e10b4d823dd93e497b0aebf0f1b3d3b5a85495c0e0310e5b858926726f21a53e863005bb49f038768f84d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d3171c6c0bff76efc7834ef6c60e7243

SHA1
a05896887a6c16c7eb494b0cf30f48db7f03d465

SHA256
efc696cd57d9498e2cf62394cc162e3fb380908ac9269c833f361b7bcfd9206a

SHA512
61448ce64e90cbc01db12c42424445dcbafe006ff118c81ae196896a63d3d93cd7cd9fadc6a1f92b1ed61dd261aedd5da4481848d3919c3898b7bc8a6e85bda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4ff53edcfeecdbb743009a3c46958b51

SHA1
0fb4e4f9c1f2ee05f35484612013f4200bf90a76

SHA256
42c7d5bb7d79d85fce7b9a3b90b85bb7c55b63881a0146e4be1a632db8f97a02

SHA512
f905a8afa153cf91ea2402a906aa92acf8bc36bc3f14b21164ed85ca53d6935a9e9b664696d35eb72be7e5def1c4303aac25eae56cb434056fe4ddb8e3253d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d38d746d9459184acec14e9555f920a8

SHA1
637925efd1d79d7849e2b703e1899ed16504b5fa

SHA256
884ca1535cadc087c88588760085011001fe594685d3920d2daecf68b897ce54

SHA512
290c721d946f1002e663779495f9c448962c5b5ea042e9c13dbdf0bea17837f20030a79c1b18b479e7290c137979aa28defe4abe67535ace40a76a6fd6b203fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ae12d892795495a8f5da6aad54135f4a

SHA1
e080bb9ac317c980428509b2d1531cf95d5f9617

SHA256
5ddc1a5a0eb88f196d729316498994e25b401a2b58687a42b63133ded35b9ff8

SHA512
df2d5132e65aa1db3b1e9afde26c4837a272d4a2041e434413d16fb50e68652a8a259aa1993513cc06897012ad9588b2b6c1434ddd85fc6f8abe42f93073f708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
13a6915076330b23110a3cdd33544e5f

SHA1
12cb2653d49db10e6a5f6bec829d103fe8ece03d

SHA256
ca0300e001f2c5ad1f74251f88fda76db8ec4388439cd4039ffd0b812e5f319d

SHA512
c5532473b2846756192d96b1c9744485a2a004404b716a803b7b084d8e6b7d891924a39353c0e828e5fe681040da252a9f843ba1c7a497f210ac17e1f1694782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3b904f4d685cd01adbd219f1fbafe9e0

SHA1
cd12a1e85c3f0b41b7cb1e7bf6290d2fe711c346

SHA256
fcd804d1e074bfcd03f3f6169baa0b2ad854d191c15b19b6d9e5f37f8dde806d

SHA512
c12bd124666d174d2d558b785229d8c554d404e9c2a3315a8b003ccbde6cbeef17534b167909fd436260c269fc4eb74dbc7936162ec9bd1ca6e2302ed02e8b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
99252fd11c9a85681a7c266de64a428a

SHA1
269572beb161b94441b9fbe369e67986d19d5227

SHA256
d9df0e54d9768fb5e99b832c9c23d0746509aaf6ec30c2a5f28fa4813912bb0d

SHA512
af95a785c4ac0c68a599498bd0ebb9db7ea1196b78aa2e38b65b154dbe1c8c0c78da0251d8768ce3600ddd0e2877229313957c0015656f752a7973da37cefc75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aa867.TMP

Filesize
48B

MD5
5132f3776189db2fce137611db6df29c

SHA1
af97688bdcf36ba62cbef9141201b3c247597fb7

SHA256
4d21f7715dab810fac88a6ea5aa8553a5ada049f1ed0207bfcddf0f0ce54c76d

SHA512
de59c254c46375cf7887da7a5821aebf8186dab5b2b915f09a7d640f531430d2307e396966f9c56c373faa2be33374c1ba38672abb339e39bb02d38258f7e1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
86fe5c6c886d844e10d65c89e4905a0e

SHA1
bd78cd054eb8ac431caf2f46a9e5b3d2719b87b1

SHA256
f5efdbab615f5ae7120491fb05c0e368ce7d6cae448ed0825dab040ee0cac3ad

SHA512
61f371d1ffd4ccbd86e32b3853546ff040949c3e4f9d347c62314b3199c6911cdd9286d55c9be2b46100ed3ff3647c80949ed87fccc5d0c2fd4f1585233049aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
01698a616f7cada4f31226d7fd7a0dbf

SHA1
53bba3170729135ea812a803948898a3ceb8d37d

SHA256
4a06bcc1597339968772a27ae34e0a2c00af90df4df095180bdbb9b2dab4378c

SHA512
ec0ce48678c11ad359b35dd4fb052ffacba7dd83012c8cb17c606f7f8b9c2b75014e594fa683012d6c9c17a21b24e17f4af2e4902e9d7dbc15a3cba67c1eb1d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9862dcfe2bca6a0f646cdfe023d7e8a1

SHA1
18a2f4ca37ad135c4b3010f9c5e01287c16c5749

SHA256
06378cee8d37fe77bc2267aa258ab76329a3537fb8aace83ecacdae12c5fa670

SHA512
d99028f4f416c83a6ad50961c332ab36de1d89b37b685cede79958678c677dc755a2671ea68d71f53c90361a74ce7414abf525c6fdd4c7c597664d431ed72827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
859b5812ac5bf4ef9397af445ee105a2

SHA1
34db00ccefb0ecb37f5246d1f9be9f0124b2da95

SHA256
0d381385f6471e17d002ceadcebe65759e8ee36dc6cad78e03f1f335297f5f47

SHA512
760fbf52b9e6a7350ada6053b754d42e174c67a2238fc9c62ef667ab805aa1cf239e436f9f620d1706f33a34c83e9fe6a0435a0c1344b71a2b31a69f8e9f928f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
254cc8d4a3efa1ee41a841e7bc7d94b8

SHA1
12b60d622dddadbe6f850e416c80bccda411518a

SHA256
64f5e44532d2268d705e641a3548ac9688650dd1dda23d4382f10640daf5d4ba

SHA512
8eec6e1474bf370d0b39812a7a88af6a28445557bf5c7a75894b7bda3484d07adae4b9412dbfe9251bacb742dee2823b2cd4e8a6a80d7bc7de159412c0503bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e417107240ba8e951d143a231f3c5812

SHA1
33f6ecfd6df78c386ef4394a2f11e266ff746342

SHA256
db104150512177e995fd4e729004fd6f387c7c1489464e652c826278f8319293

SHA512
2f7af380625ad7fa76d1a36983d5da32e9b162119be75fcf1b884f9a6078c84df20eb2e76c8e56c8733110de2239b4aa23681980adaa77adc772e7ec49a4b3e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
476a3dfae112901d3aa10be401cdacc2

SHA1
46d620225890e7d5955df56429c6c546641e8cc3

SHA256
2fe0880abf418cf48f75413c5a14856dbf083c90469e2bbff7ada4e4a6b2f0ca

SHA512
00dfc42dce6e3acebdd1745b80eeea5dad4aa8c2ebe7554480d29245b91ecce824984c7fba92afa6eb7bb32805a8de03e5aba7f6c06a53c489ea9cf83201bf61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6496dc3d3d249cffbf0b9c02b532d197

SHA1
9164b683a78fb283411928d4f4bad33588ec629d

SHA256
897994c43b6b4b3ac363a6e8f88b0da50ee6e08f056da94905b8e48698305068

SHA512
f3d3edc7b9b6e8c908fdf4fa80994a04c734c0840251afcd4bd8555d9a5c90de2211e612f5088fd9fe5414e32fcde635523e29bc294b0bf072ab1ff110d24115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5808b5.TMP

Filesize
1KB

MD5
f60ae705c2a96d2549d19bb0e855fcc4

SHA1
3bb1a0934e57ecb7a9fea36b4b201fcbf4d4d300

SHA256
988b4d619833f9693888eafdb616c3a6d564a462cd5cf75bb071eb52ff70b99f

SHA512
87f2cb8cc736175d56a28e6db783726d2dafc4c43fdc1c05dd69b4ff1df0b9394ad7bb18578b70a3db0c371080eef40266dc049bc87797005bbb3f309679aea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
538ab5583eaac9710e0eae0782b87f96

SHA1
7bbf6178059a75c7b66de9b3e9b686e643c81f24

SHA256
331e870ac06ce3f95f24743cf30e7215b0333211c2ed767a316eb9fe1a5c0eb8

SHA512
0b46688ec3cd49d3af4f0a4f5a6ba645076f3edc4eaec05dda6f63b3472dc149a6eea95f79e9578b698c7fd7e869a95316a19642a16a59d14ab4fc4fcf7f66c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b76fa86fd237d40eca7402884231ae75

SHA1
bccdd313bdb0be96207ad5d95fdffc975d38bedb

SHA256
d8ae2e7440dc20d79f0b8c315bd158103514838c20b910649a2b53031ef184c4

SHA512
9e0ac568e03a655d22cd197b8ddb46ccfff325ed6ee100f8033cf004622aeb53ddd9c26d42f0768f250c38afb216909d31e40e52aa5bdb6c116b8a3047f0a75f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e37f9f3f3efe535e85482b231bd27e71

SHA1
4dc7b51327cdda3b297d7bfeb103770ba19dbba9

SHA256
16a8466b64092043f5b41457c1a463d10900af52c27000d4ae5beb9c0aeb9905

SHA512
bb60c2d203c86f04ed2ff137cbfac11621fbd259c1aff1995240e0f23727c2657a656d5d7fe38a1324fec9fec1b139f1fe461afde08b2f9a3173fc20557c5b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0448db0baa7b9593d3d6f75abad0886e

SHA1
81b16ffb509ebbeccde7a2e7dcc30ad822cd5ca1

SHA256
e05682a1a31703b9b192cd93126d81b8310d3aa82def0ee83e713b485b6de3c9

SHA512
917eb1818036aec3fbaea05f26fe0f41c5881e3ec58b2193b2698a328a04005eeea3c86ad08b076b06bf56ed231bdc93f14f9544faf9fe5478b57f4ab553c540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb5ce304ae50b580d7ad435f07d25185

SHA1
59d7c332b949060802f64840b167fbba274dd41a

SHA256
1adbf6bb02d66b82dac98fb9664ab57bb8cc30450d0ac8afe802d3ce08bc4828

SHA512
1cf2c4a5151b09f49ca9b2a69b519c4320779215d4c69f061e6b621bd1a90d20c360b1b37f9e78f9f1a884a23d72bf1da2e9e17204752027f23d293a63c94c61

Download Submit
C:\Users\Admin\Downloads\Windows-20240807T144407Z-001.zip

Filesize
34.1MB

MD5
6497fd141cb795f4c7b62734985a2416

SHA1
637f16958af9ce45293071ac11ad89b94de35437

SHA256
e5b84b2bb51cff696416339673b7b9916f0fb33e500c882a9c827fc8761a834a

SHA512
9b4370d6cf260ae8d9c64c9e0e676049133588a2f462e7e33967753339c530deddc5fa62b83a6a9855c74f5f474e36aef69766c35ba9ff7895b54d5f751394db

Download Submit
C:\Windows\Installer\MSI23CA.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\e59236c.msi

Filesize
34.7MB

MD5
a1b837172ef0f284c54d0f9238b6c6bc

SHA1
bc489940ab5cde8429914e6e86321e5fb9c0038d

SHA256
af86c253f2f1715e5b83543eb5c8162e2749b3380f6a5445583a971091ea24cb

SHA512
223f71fc235136bb14b4fb03cf2d8f4e70a54d7ae1376cf8b133249873722617cf9c04b2cdfe3217cbbcb45e3d05891a92bac45c2dc27d6158b3944873a5e4a3

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
4885e921f526b4e3847466117b3f79aa

SHA1
ac66585d485be031377a00ee451f9bdc68ec9812

SHA256
e274bcf19fe970ed4ac5ff1ea53aca8fe65cff7e59d9ff085c1b89c04a25367d

SHA512
c42f2c8c7e73114faf88e132b635fc1643fb37ab2e073bb7f4226e18f9b995f3cbd092ef07893cda3320ae31f6edbb0f537b84958748adbc5eaf9d6d633b4dce

Download Submit
\??\Volume{83bffa96-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{87d909cf-6da3-4d34-9720-16a60f47c516}_OnDiskSnapshotProp

Filesize
6KB

MD5
9ed05a613ab789dc0589d34895160385

SHA1
851801c5174ba1153b02c93861399457f1c6b5aa

SHA256
85199e17c2f34e9ec9298cdd94dcd9e7c7e26e41fa7a05a2beef0a2ecb3db651

SHA512
a42063a0ffd07515a082137d5a5ed6374f4952eecf6e991849d55ba8b2cb8894ca56d860dd277f9769028540322b2aaf80fddf5609d2881b483c8257a4dfd816

Download Submit
memory/3916-1069-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download
memory/3916-1059-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download
memory/3916-1060-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download
memory/3916-1058-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download
memory/3916-1067-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download
memory/3916-1066-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download
memory/3916-1070-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download
memory/3916-1065-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download
memory/3916-1068-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download
memory/3916-1064-0x000001915AA50000-0x000001915AA51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads