Analysis
- max time kernel
149s - max time network
158s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/02/2026, 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjsploit_8.17.6_x64_en-US.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
jjsploit_8.17.6_x64_en-US.msi
Resource
win11-20260130-en
windows11-21h2-x64
19 signatures
150 seconds
General
- Target jjsploit_8.17.6_x64_en-US.msi
- Size 6.1MB
- Sample260210-aa7ksafw4e
- SHA256 a8a547cf25bc242a551238e557e24b4edb9af153ec27da2830e096e3c064dc43
- MD5 51c312bba8c70cfbec72f41eef975c04
- SHA1 621fc67cd19f1f963e73c268b0a851e9a7538d0b
- SHA512 27930d55c34a5351fcd2ebe20dc359700d62d411dc9cd195298a8992e7ca5a6826020be607c20485e3a2e14e990061464885bf1ec318d913b142f8f7f2f18577
- SSDEEP 196608:aZTuReE1Wse6573++uQoyYsGKWpizgm1j9wtV:w0/1Wsei32JLKWpqHQ
- TLSH T18A563357BD41C9A2DA2A1D35083E87A11739BC155FAA1D1337A4728DDEF23C08FB29D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1060 jjsploit.exe - Loads dropped DLL 1 IoCs
pid Process 5660 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jjsploit.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\god.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua msiexec.exe File created C:\Program Files\jjsploit\jjsploit.exe msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\fly.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua msiexec.exe File created C:\Program Files\jjsploit\Uninstall jjsploit.lnk msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFDC7C435CA5AEBE58.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF1ED.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF1F9F8F053FDB860B.TMP msiexec.exe File created C:\Windows\Installer\e58ef2d.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{FFDBDCFE-0F22-4352-8044-DF9A5EF27006} msiexec.exe File created C:\Windows\SystemTemp\~DF82B7A3611539B36D.TMP msiexec.exe File opened for modification C:\Windows\Installer\{FFDBDCFE-0F22-4352-8044-DF9A5EF27006}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{FFDBDCFE-0F22-4352-8044-DF9A5EF27006}\ProductIcon msiexec.exe File opened for modification C:\Windows\SystemTemp msedgewebview2.exe File created C:\Windows\Installer\e58ef2f.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCC08766B414353B4.TMP msiexec.exe File opened for modification C:\Windows\Installer\e58ef2d.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5132 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a09cc7b9ddbd1cc00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a09cc7b90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900a09cc7b9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aa09cc7b9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da09cc7b9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134151553978486702" msedgewebview2.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760\MainProgram msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\ProductName = "jjsploit" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760\External msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\PackageCode = "A5B5E9EE8D918414C97AAFB4BF7E622F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\Language = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760\ShortcutsFeature = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\ProductIcon = "C:\\Windows\\Installer\\{FFDBDCFE-0F22-4352-8044-DF9A5EF27006}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\EFCDBDFF22F025340844FDA9E52F0760 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\PackageName = "jjsploit_8.17.6_x64_en-US.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\Version = "135331846" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5064 msiexec.exe 5064 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3772 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5132 msiexec.exe Token: SeIncreaseQuotaPrivilege 5132 msiexec.exe Token: SeSecurityPrivilege 5064 msiexec.exe Token: SeCreateTokenPrivilege 5132 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5132 msiexec.exe Token: SeLockMemoryPrivilege 5132 msiexec.exe Token: SeIncreaseQuotaPrivilege 5132 msiexec.exe Token: SeMachineAccountPrivilege 5132 msiexec.exe Token: SeTcbPrivilege 5132 msiexec.exe Token: SeSecurityPrivilege 5132 msiexec.exe Token: SeTakeOwnershipPrivilege 5132 msiexec.exe Token: SeLoadDriverPrivilege 5132 msiexec.exe Token: SeSystemProfilePrivilege 5132 msiexec.exe Token: SeSystemtimePrivilege 5132 msiexec.exe Token: SeProfSingleProcessPrivilege 5132 msiexec.exe Token: SeIncBasePriorityPrivilege 5132 msiexec.exe Token: SeCreatePagefilePrivilege 5132 msiexec.exe Token: SeCreatePermanentPrivilege 5132 msiexec.exe Token: SeBackupPrivilege 5132 msiexec.exe Token: SeRestorePrivilege 5132 msiexec.exe Token: SeShutdownPrivilege 5132 msiexec.exe Token: SeDebugPrivilege 5132 msiexec.exe Token: SeAuditPrivilege 5132 msiexec.exe Token: SeSystemEnvironmentPrivilege 5132 msiexec.exe Token: SeChangeNotifyPrivilege 5132 msiexec.exe Token: SeRemoteShutdownPrivilege 5132 msiexec.exe Token: SeUndockPrivilege 5132 msiexec.exe Token: SeSyncAgentPrivilege 5132 msiexec.exe Token: SeEnableDelegationPrivilege 5132 msiexec.exe Token: SeManageVolumePrivilege 5132 msiexec.exe Token: SeImpersonatePrivilege 5132 msiexec.exe Token: SeCreateGlobalPrivilege 5132 msiexec.exe Token: SeCreateTokenPrivilege 5132 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5132 msiexec.exe Token: SeLockMemoryPrivilege 5132 msiexec.exe Token: SeIncreaseQuotaPrivilege 5132 msiexec.exe Token: SeMachineAccountPrivilege 5132 msiexec.exe Token: SeTcbPrivilege 5132 msiexec.exe Token: SeSecurityPrivilege 5132 msiexec.exe Token: SeTakeOwnershipPrivilege 5132 msiexec.exe Token: SeLoadDriverPrivilege 5132 msiexec.exe Token: SeSystemProfilePrivilege 5132 msiexec.exe Token: SeSystemtimePrivilege 5132 msiexec.exe Token: SeProfSingleProcessPrivilege 5132 msiexec.exe Token: SeIncBasePriorityPrivilege 5132 msiexec.exe Token: SeCreatePagefilePrivilege 5132 msiexec.exe Token: SeCreatePermanentPrivilege 5132 msiexec.exe Token: SeBackupPrivilege 5132 msiexec.exe Token: SeRestorePrivilege 5132 msiexec.exe Token: SeShutdownPrivilege 5132 msiexec.exe Token: SeDebugPrivilege 5132 msiexec.exe Token: SeAuditPrivilege 5132 msiexec.exe Token: SeSystemEnvironmentPrivilege 5132 msiexec.exe Token: SeChangeNotifyPrivilege 5132 msiexec.exe Token: SeRemoteShutdownPrivilege 5132 msiexec.exe Token: SeUndockPrivilege 5132 msiexec.exe Token: SeSyncAgentPrivilege 5132 msiexec.exe Token: SeEnableDelegationPrivilege 5132 msiexec.exe Token: SeManageVolumePrivilege 5132 msiexec.exe Token: SeImpersonatePrivilege 5132 msiexec.exe Token: SeCreateGlobalPrivilege 5132 msiexec.exe Token: SeCreateTokenPrivilege 5132 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5132 msiexec.exe Token: SeLockMemoryPrivilege 5132 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 5132 msiexec.exe 5132 msiexec.exe 1060 jjsploit.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 5064 wrote to memory of 5660 5064 msiexec.exe 80 PID 5064 wrote to memory of 5408 5064 msiexec.exe 84 PID 5132 wrote to memory of 1060 5132 msiexec.exe 87 PID 1060 wrote to memory of 3772 1060 jjsploit.exe 88 PID 3772 wrote to memory of 5468 3772 msedgewebview2.exe 89 PID 3772 wrote to memory of 5860 3772 msedgewebview2.exe 90 PID 3772 wrote to memory of 5860 3772 msedgewebview2.exe 90 PID 3772 wrote to memory of 5860 3772 msedgewebview2.exe 90 PID 3772 wrote to memory of 4212 3772 msedgewebview2.exe 91 PID 3772 wrote to memory of 488 3772 msedgewebview2.exe 92 PID 3772 wrote to memory of 488 3772 msedgewebview2.exe 92 PID 3772 wrote to memory of 2360 3772 msedgewebview2.exe 93 PID 3772 wrote to memory of 2360 3772 msedgewebview2.exe 93 PID 3772 wrote to memory of 2360 3772 msedgewebview2.exe 93 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.6_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Program Files\jjsploit\jjsploit.exe"C:\Program Files\jjsploit\jjsploit.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1060.4072.6635534718977728683⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x178,0x7ffab0fab078,0x7ffab0fab084,0x7ffab0fab0904⤵PID:5468
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1820,i,1825941409760005373,8804266540430337388,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:24⤵PID:5860
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2132,i,1825941409760005373,8804266540430337388,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:114⤵PID:4212
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2212,i,1825941409760005373,8804266540430337388,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:134⤵PID:488
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3224,i,1825941409760005373,8804266540430337388,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14⤵PID:2360
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F506397E97C68D95D206BB65B2E9B648 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5660
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5408
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58ef2e.rbs
- Size 21KB
- SHA256 e5439f48cc7269e4a37142b57b152c0132bf0ba6a2bd6b4a4898ed992ea4b1df
- MD5 deefc4d72d08319f3b680a4ad302a309
- SHA1 d08dd9fc4c2fb3ce8dfdd3c8fff82ff20c7a85b2
- SHA512 11fcb21bfd2b61684ac056d1757314509265b4921375758a36b7fee25b4486c02c2f2d5a46a8487a85c318bc5b915d60b2802a73ef1f0025133352ad4309c85e
- SSDEEP 384:3eTKsnkLZWdVtgGEADq5iSz2WkLst8t8t8t0tstststststststitztztYwLwUs:3eTKsnkLYdVtgGEADq5iSz2WkLst8t8k
- TLSH T1CFA23282AB50C2A2D19B07B4EF9B57413B71C88EA349420B46DC527A8DD73903FF999D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\jjsploit\jjsploit.exe
- Size 17.8MB
- SHA256 324e940b37f08ba22399e9bddf5fb500ff2391e46317c1439b71d07ecabd419c
- MD5 5ae6a31cd8167d216b8b96e937abcdf6
- SHA1 5ede9de8b330d9d4b5220f50144b485aef77c6ee
- SHA512 ad8d67474f94aa248e36bbafaf7305d23bc1ce6c108adb46af1c31748a867b54f97dcb6fb9fd390f06b537238ca35d560ea8005cff0938e1806cc55771b66059
- SSDEEP 98304:Klu18o6AJASq4d1DbDTAb8T7wB7yOGHZESVvI6iOSfat5IgqkZvuid3L5HQi1+Zf:Khoq0bDT2EGGUa5Hw6yZ1OtWKO9
- TLSH T1A217F820BF9B59ACD05EC470834B8A724A7570CB0B35B9BF888555392F6EBF41F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
- Size 1KB
- SHA256 18f2d1b4835a8e3d30502ee759224fa325e59a2559ce1b461086c7dfb1afd0dd
- MD5 aed7f37aad3323764faa2a1a2d44355a
- SHA1 2c29f2ccafdd8d5d5c86736ba804e3b3a7501241
- SHA512 0c276384d8ece57bf3bdba3fcd73f653fc9f24ae773bf330c05564be488ad73ac4e993bbc2b508fbcd4ba2c86699b68e166a05a118a8b8224f69812741fac48b
- TLSH T11A41E20457F50339E3B1CB396EA147528A7BF826DA749E6AC1C401CD0964600E9BDF7B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58f690.TMP
- Size 1KB
- SHA256 d520df631751e6efc0b91be7b5915530a64e3a1c17f68dffed628974173c684f
- MD5 a7493656cb1c6edccf8a41dac658e310
- SHA1 9587694c56a8fe92112868f60462826de27b89dc
- SHA512 48b1ae45737532601ecee6da51596ccac821089ecf24432f1930602fcb9981c5b66c72285c758625ceb4ba51feb471c072d961a04c898835be07ba9c67bc981f
- TLSH T17F41DF0457F5033AE3A1CB396E9247528A7FF825DAB45E66C1C501CD05A4600E9BEF7B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3E0E.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 bf3cd515be4c4536d38b61bcd9a38296d5759769fac7ba755e4b74615024ad81
- MD5 12ff3702edec81cb771b2e2e92e92d5c
- SHA1 e1c84695714982eed1203e769798e45d8626060e
- SHA512 30da024e3e29b1af3353955f7bbdbf0a1b1dcdfaddd82899b36b1bb71d25dadd6a9618af597db4c652b3672809917c1385340bda78c9f91a5a278d5b7d0b819c
- TLSH T171D0121336028139C02030731D526B4C1400D11B41454040A438852E2A140701D16D41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 1e362f2dbc2c264f7b26b2e1fd9ff685404f111ba392c8962ff58e4c0d59533e
- MD5 e64f771cea39fcd5215bed33d580ea93
- SHA1 0d7eaeb59c9f6720f4986c0ccc30ee9e500cb253
- SHA512 32a06b9ed087502197faa1d2bb99cbc4de153e4ae77c77b174388af301516f2f73856c0fb686ed80523533d5308b116b643140367bad9bccebf7274f4bb122fa
- TLSH T1D6D004117505C007C11070775D704F4411105410114111505030001514500301455F04
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 9790bc8d2e30c643e03f7eb9331cf31e87c96747fcacf315add1627447f1bf17
- MD5 24002b4fe3a5602038eab371af75d2d9
- SHA1 7a9b9ec283c7e2c947df1c7a93d01bc8c6d31d06
- SHA512 2a81baa7ae8da6fcc3d4879eb47945d1a6a2e2be9da8a0c1984be5609ab384b699a5f4b174169fb16e84ddaa40146c75320ddc68e18834a09d6e58869d5851a7
- TLSH T14DC09251F6EB5CF3C35126B1998F6008E7391E4B06C3166209AC0891902F70A8013424
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599a13.TMP
- Size 48B
- SHA256 34baf511abf376195a528c29044d9e6c08f02a6e613c4f3cc14cd5f2f5c5bac0
- MD5 46f6ed27fa77e709e1fb53318f13f76f
- SHA1 423491b8169f3bf2d84b21be467fbc7f06b60de0
- SHA512 3d9c5ef08b6b5c3ba6aaf1a74e70ecae2ebbb59a181688205d572abcb2b00d3b06bafc70b84536442514e0475288a0a3c58c4f478cc694b3019b862cd2445f39
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
- Size 2KB
- SHA256 1109ae2935bd60ef32cc06d363e6c89a03b10c41126484fb452fd84fb4c55154
- MD5 411bae19b97b57c5a4b8ae26897ff8eb
- SHA1 bbc6052bcb3650df0110f23dda4b70164b244eda
- SHA512 5d12a9f40a1b2aa4b541ee60c8ea4b676234401eab15edbff36a6711d303968e87e2df051e456ff4608eaa687b85be7504d1e0e3b51d9381734c1041b3ae955a
- TLSH T12F51ABA7C7E8896D885195F85A243E1BDB9E091882B83C9E88E5EF8B57D1071D30458F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5a417f.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
- Size 6KB
- SHA256 2749c79ef92943be29f7265b0b0795668c45ba3bf31fcf473f07849c67e3ac07
- MD5 4f29007d35d8a52c1c68c28fb6e71b73
- SHA1 f40f4231755cb67e0db4fee87613a671a42e3229
- SHA512 a8dbc6ddefcf09b6dedf6c1ed0519626b83b68a4255a8de6d5e7f9d345b5a868589a16685e81b6ffd465908c4edf9f3139fa98d32179710d722024bcbc4f0778
- SSDEEP 192:stf00WfbZ8paJm/S+Wi7kawYX2QRqFBM8:st80Wa9/V1w08
- TLSH T1E6E1A642AF3869B78CC7E619B925FB16E2F6102265D45E9CEBFCC90C04D66CD620784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
- Size 6KB
- SHA256 d15e327182c07f840f1af6b6a7f735ff28b88c6d02a85a1726be04f67e4215db
- MD5 2ccc758a349efbc67d32567186684d4c
- SHA1 a46cc8d9d76a2414d3321e4c401e9e83826fb2c2
- SHA512 5d159c881b35a5a3039e48deae550a84ea0e7b915e9aa5ae6ce6bb430f149a172e24cbc9e32fb8e95e1b17bb48b2bf29c02d65613c778ea8489033c0d14c5350
- SSDEEP 192:stf00IfbZ8paJm/S+Wi7kawYX2QRqRBMC:st80Ia9/V1wQC
- TLSH T149E1A542AF3869B78CC7E6197925FF16E2F6103261D45E8CABFCCA0C04D66CD620784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences~RFe596dd3.TMP
- Size 6KB
- SHA256 938255056c071d6249b5530f252db974130764a1cdc3654c295dcf0a70347f0b
- MD5 9d10a972bd8b618766845471bd10669e
- SHA1 3927455acb0de5f99177a0bbb5a0a576a2188752
- SHA512 dd70d02c01bb4ddba680ec7d9cc60840d640aa43a05c9151f61051867635e57fa8f6419938062ef83945ce59e91a224f3dfbe4a17fe6e3e8cfd418a5e8796a2c
- SSDEEP 96:rf05SH9Sb9xffqMdZ8i0vhEDkUnm/7qx+WVHMSm+uecpka1iY2G/xG/QQjo+ggFP:rf00WfFZ8paJm/S+Wi7kawYX2QRqFBM8
- TLSH T1CBE1B742AF3869778CC7E619B925FB16D3F6102265D45E9CEBFCC90C04D66CD620784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 1KB
- SHA256 c1813792a189373ea4937ee9e4378e16a67400130a4d7482f6820d6a195d5636
- MD5 b9d5c1c94f02d27e034edd88f5e2b020
- SHA1 b12f8727f66dc7d0aa9ff97fde2877c6039eeba0
- SHA512 aa49f8a1832df93e55420cd43418450ffc9e97000b9d4c71ed93a5b565003ab7ee2656b70824e353dc73e628757436674942b5f8eeaac821e02b8fd05246a43f
- TLSH T18031B5B3D5A46B77DCE691867152BE572D310027C1008F8CA2DF8B0C03A628D952BC32
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 2KB
- SHA256 653c180c49e705abb6a4844683fb04d0baf967c7ca71be96d960637a79ec47a7
- MD5 45e347c68a26b0368c83379aa2bcf1fd
- SHA1 1f9162f9af70a289a7f018f8c6aca5d43c70233a
- SHA512 254bf2e616dbd3a3c7903edda2b53489f7ad47fb1c74120cf5d0bc24a1cd7f678a1aa4fc3aa697cf5ff76480c0b98782b1ec18a711d905457b2254b2319b4789
- TLSH T103510873A928AAB7C8F78584795A3F235E315167C6522F9896EE1F0C02DB24D2303C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 15KB
- SHA256 4403283e0589b8e90a4336687b4ade2691c1aca0c726ce57d02955b240612b3c
- MD5 b01c2698d8bccdbd7a9955797676f971
- SHA1 4b69f8cdb279bf5286b57d38fe84d2d0dbdf668f
- SHA512 a17c8a1af8e5f40d86fcb4f6543261841c861c4be866cb9a9a600091efb396517674dcdb7c612c19d38b21f8fbe458c5ff0c4ac789d5bf765dc6b0e9412ee1c3
- SSDEEP 384:zIfeJzfbqZkSJLdjqiFDwdWqA2Nb7ha1H0T61L3L:AYfJSJLdOuDwLAaYHn1DL
- TLSH T183729E73BE785DBB08F38D1AB468574B4A718067D0826F9899D95F0C4BE724E2317C27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 3KB
- SHA256 a39b47d50e8058566c7184bd1d394cb506dbca8de10aa0c96d36c96cb7b5fb83
- MD5 18351060f8b9cf9f937d778e7562d30b
- SHA1 c1cd902b93e5e25b28afe7476ec8da7f06af85d1
- SHA512 e7209aca0644d61df2c75232c38cc62671dcbcbe38e4ca5dfe8090c283363aab1bf70b49d8ee3784abdd43e5fa9365b7e0b69042ee6b939eabbd79008cc328c6
- TLSH T108719263AA78A97B8DF78945B8863F167A615127D5817F9CD6ED0F0C02DB3882302C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe591841.TMP
- Size 1KB
- SHA256 07b1b2a5d5fbd058b6ae3323cb335b51202a2737772f9807f675727049848797
- MD5 e916a1e562fc934886a77c5bf3195dfd
- SHA1 4c0eba3168a24c5d7da72d5733aa3bc04ab4047c
- SHA512 53f17c225456f08cc34bdc0a4da245ce5b2145bf8d21c9fa404304091f34f59fef9bbca5f4602fd87632d3ca855d35aea052c8d06124e90e17821bd11e396738
- TLSH T1CC219873C5A86AB7D8D58486B052BF572D201167C1108F4CE3DE570C07A758D963BC33
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e58ef2d.msi
- Size 6.1MB
- SHA256 a8a547cf25bc242a551238e557e24b4edb9af153ec27da2830e096e3c064dc43
- MD5 51c312bba8c70cfbec72f41eef975c04
- SHA1 621fc67cd19f1f963e73c268b0a851e9a7538d0b
- SHA512 27930d55c34a5351fcd2ebe20dc359700d62d411dc9cd195298a8992e7ca5a6826020be607c20485e3a2e14e990061464885bf1ec318d913b142f8f7f2f18577
- SSDEEP 196608:aZTuReE1Wse6573++uQoyYsGKWpizgm1j9wtV:w0/1Wsei32JLKWpqHQ
- TLSH T18A563357BD41C9A2DA2A1D35083E87A11739BC155FAA1D1337A4728DDEF23C08FB29D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 3ff75be435835841ec9012086aedfc8b1acc745ce97b4562615a2aebd421ba4a
- MD5 b08420745dea5659efda40b9d4ee5f2a
- SHA1 e632495e28e6b42b115f103d67e4aac2a4c09ed6
- SHA512 258e0401b64832e619d2da5ba3ab70ea6c116469ad131d34fa4c614253ba5ad3e17e6763fcef3d6950fababecee4b1924950694d0cc4e401a5e43f182fd3343c
- SSDEEP 24576:r2gmSp1NdoO/vvTLx26+xEHqfqJRg4OQW25dXpkajB6IkG+/4hrtb3w9h:z
- TLSH T18C47C32436F92110E7F79E3C68F0AA234D3A7D5B9C1A9E8D05451F4E0961FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{b9c79ca0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a25ecb0a-5a7e-4fbd-8494-89c84672e359}_OnDiskSnapshotProp
- Size 6KB
- SHA256 18114b18f672462b05127a59c6c0c49b8f752d5256684f412203eab2bb7f06e5
- MD5 53acf5e4f0235997e649bd38511b56c4
- SHA1 cfd7c12eceac168075ffcf19c8e3b7308ffc7928
- SHA512 3a151f3aafeede282fc84c5b4b535d630915124dedb17921fc9d58e0f6f40ebd144eca7059304835d67b5974e567b328f1ba58dcdfd406323234ced9d158559a
- SSDEEP 96:F/klQe7Sltvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:alQHlnb++ZVmN
- TLSH T170D18A185AF54711E2B3AB7228F14557A877B911EF33CB8E0198238E2670910F976F6F
- MD5 SHA1 SHA512 SSDEEP TLSH