d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 14:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jjsploit_8.17.9_x64_en-US.msi
Size 6.0MB
Sample260511-rkr2hsfv7k
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3568	jjsploit.exe

Loads dropped DLL 1 IoCs

pid	Process
1332	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2388_416481955\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2388_492241584\crl-set	msedgewebview2.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2388_416481955\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2388_416481955\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2388_492241584\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2388_492241584\manifest.json	msedgewebview2.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}	msiexec.exe
File created	C:\Windows\Installer\e58ba04.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB1D.tmp	msiexec.exe
File created	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58ba06.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ba04.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3724	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b0ff7bfecd5a687b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b0ff7bfe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900b0ff7bfe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ab0ff7bfe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db0ff7bfe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229825868321250"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\PackageName = "jjsploit_8.17.9_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\PackageCode = "9FC2B6F90A0842C469E6F4CAD3052A7D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Version = "135331849"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductIcon = "C:\\Windows\\Installer\\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductName = "jjsploit"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3728	msiexec.exe
3728	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2388	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3724	msiexec.exe
Token: SeSecurityPrivilege	3728	msiexec.exe
Token: SeCreateTokenPrivilege	3724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3724	msiexec.exe
Token: SeLockMemoryPrivilege	3724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3724	msiexec.exe
Token: SeMachineAccountPrivilege	3724	msiexec.exe
Token: SeTcbPrivilege	3724	msiexec.exe
Token: SeSecurityPrivilege	3724	msiexec.exe
Token: SeTakeOwnershipPrivilege	3724	msiexec.exe
Token: SeLoadDriverPrivilege	3724	msiexec.exe
Token: SeSystemProfilePrivilege	3724	msiexec.exe
Token: SeSystemtimePrivilege	3724	msiexec.exe
Token: SeProfSingleProcessPrivilege	3724	msiexec.exe
Token: SeIncBasePriorityPrivilege	3724	msiexec.exe
Token: SeCreatePagefilePrivilege	3724	msiexec.exe
Token: SeCreatePermanentPrivilege	3724	msiexec.exe
Token: SeBackupPrivilege	3724	msiexec.exe
Token: SeRestorePrivilege	3724	msiexec.exe
Token: SeShutdownPrivilege	3724	msiexec.exe
Token: SeDebugPrivilege	3724	msiexec.exe
Token: SeAuditPrivilege	3724	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3724	msiexec.exe
Token: SeChangeNotifyPrivilege	3724	msiexec.exe
Token: SeRemoteShutdownPrivilege	3724	msiexec.exe
Token: SeUndockPrivilege	3724	msiexec.exe
Token: SeSyncAgentPrivilege	3724	msiexec.exe
Token: SeEnableDelegationPrivilege	3724	msiexec.exe
Token: SeManageVolumePrivilege	3724	msiexec.exe
Token: SeImpersonatePrivilege	3724	msiexec.exe
Token: SeCreateGlobalPrivilege	3724	msiexec.exe
Token: SeCreateTokenPrivilege	3724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3724	msiexec.exe
Token: SeLockMemoryPrivilege	3724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3724	msiexec.exe
Token: SeMachineAccountPrivilege	3724	msiexec.exe
Token: SeTcbPrivilege	3724	msiexec.exe
Token: SeSecurityPrivilege	3724	msiexec.exe
Token: SeTakeOwnershipPrivilege	3724	msiexec.exe
Token: SeLoadDriverPrivilege	3724	msiexec.exe
Token: SeSystemProfilePrivilege	3724	msiexec.exe
Token: SeSystemtimePrivilege	3724	msiexec.exe
Token: SeProfSingleProcessPrivilege	3724	msiexec.exe
Token: SeIncBasePriorityPrivilege	3724	msiexec.exe
Token: SeCreatePagefilePrivilege	3724	msiexec.exe
Token: SeCreatePermanentPrivilege	3724	msiexec.exe
Token: SeBackupPrivilege	3724	msiexec.exe
Token: SeRestorePrivilege	3724	msiexec.exe
Token: SeShutdownPrivilege	3724	msiexec.exe
Token: SeDebugPrivilege	3724	msiexec.exe
Token: SeAuditPrivilege	3724	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3724	msiexec.exe
Token: SeChangeNotifyPrivilege	3724	msiexec.exe
Token: SeRemoteShutdownPrivilege	3724	msiexec.exe
Token: SeUndockPrivilege	3724	msiexec.exe
Token: SeSyncAgentPrivilege	3724	msiexec.exe
Token: SeEnableDelegationPrivilege	3724	msiexec.exe
Token: SeManageVolumePrivilege	3724	msiexec.exe
Token: SeImpersonatePrivilege	3724	msiexec.exe
Token: SeCreateGlobalPrivilege	3724	msiexec.exe
Token: SeCreateTokenPrivilege	3724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3724	msiexec.exe
Token: SeLockMemoryPrivilege	3724	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3724	msiexec.exe
3568	jjsploit.exe
3724	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 1332	3728	msiexec.exe	91
PID 3728 wrote to memory of 1548	3728	msiexec.exe	108
PID 3724 wrote to memory of 3568	3724	msiexec.exe	113
PID 3568 wrote to memory of 2388	3568	jjsploit.exe	114
PID 2388 wrote to memory of 5016	2388	msedgewebview2.exe	115
PID 2388 wrote to memory of 4336	2388	msedgewebview2.exe	116
PID 2388 wrote to memory of 4336	2388	msedgewebview2.exe	116
PID 2388 wrote to memory of 4336	2388	msedgewebview2.exe	116
PID 2388 wrote to memory of 2624	2388	msedgewebview2.exe	117
PID 2388 wrote to memory of 3720	2388	msedgewebview2.exe	118
PID 2388 wrote to memory of 3720	2388	msedgewebview2.exe	118
PID 2388 wrote to memory of 4892	2388	msedgewebview2.exe	120
PID 2388 wrote to memory of 4892	2388	msedgewebview2.exe	120
PID 2388 wrote to memory of 4892	2388	msedgewebview2.exe	120
PID 2388 wrote to memory of 2468	2388	msedgewebview2.exe	126
PID 2388 wrote to memory of 2468	2388	msedgewebview2.exe	126
PID 2388 wrote to memory of 2124	2388	msedgewebview2.exe	127
PID 2388 wrote to memory of 2124	2388	msedgewebview2.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.9_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Program Files\jjsploit\jjsploit.exe
  "C:\Program Files\jjsploit\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3568.4188.10339021328095474585
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x190,0x7ffb99b4b078,0x7ffb99b4b084,0x7ffb99b4b090
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,2767349250428896866,7289800542937132363,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,2767349250428896866,7289800542937132363,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2388,i,2767349250428896866,7289800542937132363,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:8
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3708,i,2767349250428896866,7289800542937132363,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2204,i,2767349250428896866,7289800542937132363,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:8
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4504,i,2767349250428896866,7289800542937132363,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
      4⤵
      PID:2124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7CEB80337FD26D17E434F1FB14F2D9F6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ba05.rbs

Path C:\Config.Msi\e58ba05.rbs
Size 21KB
SHA256 7d76b9e29210df5ea20380e373692c14a316eea90334ab7864766240842babdc
MD5 c316fad886820f2974ece67ccce4076c
SHA1 8d1274a424039d6df47e77ce6ae70d8e40065c84
SHA512 978bbc4ffcc996347d0b53d8acfdd70a6c834ecac17096f0fa5e0c328285a4d76d38d5959417a6364e6c961ac5e2aba8f0675792d531b20a76fceb9620f026b5
SSDEEP 384:N3ZAB7OTEXTIrY8nTZoWjdLRWixkt8t8t8t0tstststststststitztztuuGO/O6:N3ZAB7OTEXTIrY8nTZoWjdLRWixkt8tQ
TLSH
T108A201835A50C2E6E66B0774DB975B043B72C58E9358420B46CC827A9D877C83FF9A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2388_416481955\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2388_416481955\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
MD5 f5b2fd9a39c097322b6cb663cca5b4e8
SHA1 08c113bccec7d3cdf4f6a2b313d1b1421ad62f85
SHA512 490b5c18b55ca136782d2f25e8f8b86a3cc5ae0ad25fda274bfe1a3adc759cbbb8f11592f6e7ad3451b758199e90db482767f4ebae7d93db61d8b90b3f61aae8
SSDEEP 196608:h9Uzqh1cmdDOf+IHFLU/6NW+tiFZJXij:MzqoyS+IHFI/extiFZJXi
TLSH
T139070725BE8B996CD05FC474834B8A720A7570CB0B35B9FF448596392F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 817de7d09ce7fbddd5141c19a9eca265ca08eef7aca624b51ce6116aa5faf771
MD5 2b6804201261a0d7dafdb6cb01b179c8
SHA1 c65ace202c61d2c3718e48e52afc79ce325db9cc
SHA512 b1698054577d7e834fabaf6ea8812b32d663de402c4de1e47fd2b9e6d87dd9b3223b64decce7b5fb339cb7e12737ab4cbf8549cdc8a89d5c742b4ae3a9035a1c
TLSH
T11541E20056E10726E3B586796F6247218A7BFC12ADA06F6B8189418E4D79100E97DF7F
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe58bd31.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58bd31.TMP
Size 1KB
SHA256 c1e1d8f35ebff73a8422409fea2d434f7a2a49ac075d4fab5feba18ab704878c
MD5 319955912b282a517a5ae3bff8f8b977
SHA1 503b522d05c1f6060e3b865a961364bf430e4f74
SHA512 527311bcf355ce923ee94d6b6b9ad8c58a8c459feda4a97ecfae0b1fe5032da158ca215d14a8926330d400c5e9d5f7936c3d9103dac3790e80fb57bd21e52f56
TLSH
T16041DC0056E1072AE3B582796F524721DA7FFC12ADA06F6781C9018E4969200EA6DF7F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5D3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5D3E.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 54e1835bf76c50a69909f181cb49b2a05ccf14ff34aacda1225c85bc4c7675cd
MD5 b8774c03942491b9f65632ea491b387f
SHA1 f8a15555b9aa3f0cb0c687e1b60f6a214cd7735c
SHA512 9653074cacc0c1804d069ed0243f56f1bf43f95723cb551475b1fdb13c3882d62cbfda6ca374e265ab363167f385586c8fe85ae6d40419c3408fb97ada5e66f7
TLSH
T192D0121F32110134C01061331003710D1D80D23B40068100DC29851D1B040F40E52441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 721349a968a19bcc0c96e661a2aae48dab03372997ad82e256f0085358ae1a40
MD5 8998738231785e4bc725fd5e9747112a
SHA1 e58e3caed9272666b6cac850fbed53d1d2beb718
SHA512 80db74631aebb0da09fce13c044cb065608cee5c48e9d57c6f1445eb191ff5ab82bf77fd2c34d9a2c742ff8d503c9f6880f6c4a1d5f7261f84f20c7ed57af41f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1920b906a17201d11b3eb2f9f4395e53e1bb61ffe038e49ab42649ccd4af37fd
MD5 48bafb6b8995230900d63348eff5dacd
SHA1 3210ac46d45cd5f8972707cf688f3c040ba6b0d8
SHA512 9b3e85534b238ef92f195ada53f13bab125cb8223201a5b5de54b9932459e80943fc81aa95630ee6b3c7ae5c56d1d4e89d84e28471c82c547495b3af163ae93c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 942952ab5ca248ebb49b093ae908d73df127e16f5449bbd69650db14c1f8afb7
MD5 fa276605370ffa37fcff09aca3c0fc16
SHA1 07e15773a9c078cd17aa38bb2c436c8b96131e16
SHA512 cd23ae551d7d9635948e8b26433390f93230e763e0193ea79835fb77371364c2d99093236f3e02b9221df6f1b3266441fb659197995de11d031783568f277136
TLSH
T13DC09288D64428E0C3C3A27BA4F34A843E722B4709831979129814B4A4313DDE243004
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 f293d4175ece0f9eed671fdd0337deaac525b2c8baddc2c409c6b5c58a69ee24
MD5 1dcec26b1ca637ee99399eae3979948e
SHA1 2701183009fc66d37ce7e79a0ef10f1d8f57d6f4
SHA512 5bfbb7c8d6ab2412122899e2783dad048263f3bebbb722e15bb5cc87a5b7839ef4dd67bf26e5058da1767a709f8d92b2a84591dd348285e59246362bf9302b69
TLSH
T11551A8B7C6E486AEC95152F926203D1BCF5D091806B83D2E88E9EF8B5BE1470D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59ef09.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe59ef09.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 6KB
SHA256 9cd07e173f40cc8f9f70a4112beeb783a8e7107ae4fb9b4734343a9622df4607
MD5 a918c0f37212231ac0e5beb7d0c9d3f7
SHA1 d5da3080fb4b9f0e15c02db9b8989de1fa8108c9
SHA512 ff9b103f1b3dd63f4cb53fd1a61813f409acafebc0b24066730ac028e8937e9e7770d5553a2e473a4231d9deb42eb1215ebf26d1bc4f05b36e143ee7342aaf8a
SSDEEP 192:st4Y00SeIfBZ8paET/S+Wi7+9wYB0qSaUMC:st4B0uMJ/VIwcC
TLSH
T148E1A843AF24A9774CC7E2197A35FB22E6F5203256D45E94ABFC860C04D69DCA207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5975b3.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences~RFe5975b3.TMP
Size 6KB
SHA256 d9c788ca92bd1edb268a9f45f10090393039de5b60dffba0112da8463d0ca8e6
MD5 e8b3f8d6bb1649a9f84f01b57e1b7ff0
SHA1 6a4d590712f93f90534641ab39de4263a78dda51
SHA512 dc8bc9e0dca5868ee20296d24bbbcb906756fabad45313b81ef435772a7e8ddddb9bc41923c77ba99bf85f19333ca6a6376396e5439c38306e6f268f06173730
SSDEEP 192:st4Y00SgIfBZ8paET/S+Wi7+9wYB0qSxUM8:st4B0YMJ/VIwD8
TLSH
T147E1B843AF24A9774CC7E21ABA35FB26D6F5203166D45E94EBFC860C04D69DCA207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 1KB
SHA256 2b29152c368a12c35163a85b1f08f60e218123105d09944f20fbf28dc72441c2
MD5 d8682c25bea4faa5b0bda46590f5e132
SHA1 f7f5c12d4b3a9dba3c84d2e899054ee65e8b7d50
SHA512 acdce55a8c3a3ae176ee556442f60134958e03285cbda1a5dcd3b443b3008aee184bd0771c13016df42dcb561d1f98fcfbdcaf5811d9a6194fc948bb3e2d5ae4
TLSH
T16831A7B3F49457339EC1B1D670422B6B2D646076C3168D6862DE0B0C12EBACCA536C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 a97e7decb96c15d51ef0567d801611584c7f49462e9300363c0aff037125643a
MD5 97d8678fed2a9a701adc2834cdbf36d1
SHA1 7f284d89b36595e8bec4599b9919d867f7e54ae4
SHA512 e633bf0c3b964c3246153cc377bf575dcca87e965016c35d41d4c14c307782f5659ed90dc3dad9f3bd73c7571816ccc294ba63702993993755ff6d8b223db7ac
TLSH
T12251C573FC14D7378AE3A98578463F23AE79A061C7522F649ADD0B0C01DBA9C2312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 293ef2b7df4785cf977ea37cce238f116415556f0b307e49197ddd0edab33e49
MD5 db978b55a2ee9deddc3c47f5e1fe66b7
SHA1 d452e5eedafb8bb774e04d1f3e1438f7532868f2
SHA512 78982787973b99cd6e2cc3eb384b5a3a161aff2b0bb12b973c178e247a6ada82042ca2a3b592b820f605be3575990662d2bd428c1395e25d038049a9f5e3a1d1
SSDEEP 384:zlVvsrvyOiyp4+IWA1eUVWGfvvLhNbL94TNiE3uzb:BV0raxyp4sQe6WGfvL9OdA
TLSH
T1AA72C0B11D759A37DDE6A887BC0B3A1B7D9CA466CAD12F98E4D56F0E014B6CC0702C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 d2a3ca52647b245fa65c54995ae938145b1589bf0ac76dcbf06ec04f581ee693
MD5 8310f129295ecf645b6c822299b5085c
SHA1 f856f5205a9b2552ead35d445f3ba630b3ba5c63
SHA512 0aed4b4fcd54c8d2d836f3864a1322e082e2c49843c6b18f7c0a268b221bbd88eeee989f753faee1e313938b4c998ca4db1cceb680e6652e7273c6bf3301df1f
TLSH
T16671B673B864D6374EE3E941B8852B16BAA56032D6853FA9CAED0F0C01DB7D82312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58d675.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe58d675.TMP
Size 1KB
SHA256 ec27e90b41d5d88828ce2e2d0ab33d6bbbd0fecc4a486fe5e37aba7530166ccd
MD5 bc2d873fed3e1a7148bc6326f521c688
SHA1 ef976711a4d6befde8a6281f2b29c40a37e15683
SHA512 42ce85722ca820db2bc0245cfac79af944a7e2c4e7a0be35d3b9bd1eedc9162481e413ce09744f6a627a7ba1f7145ad43d04e3facb0772fb45971a2d12d808e0
TLSH
T1872165B3E49457779A8174D570526B9B2D606075831A4D2892DE071D12DB9D89632C33
MD5 SHA1 SHA512 TLSH

Submit Download

e58ba04.msi

Path C:\Windows\Installer\e58ba04.msi
Size 6.0MB
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 0fa399e27c5a250c409f2fff5a50bdc31d378f22f8675ca5820722a84e63abf2
MD5 1344ea6fae508e9b1933a200555cd3fa
SHA1 c969f80d69afecbb84f55020a4c1196198e84516
SHA512 3676a33317a053529b030016f3de379bfff1b1724b422de5700c276ca5400c6617e28f8877c6000aff824b347dfb516692f4776db8aeb53953225cdc64a93b68
SSDEEP 24576:cu8m+1zldoO/vvTLLWJOs2a9ogEDB15yF/mNrmY1BUaI+uwUofFABfSR8:G
TLSH
T13B47F42432F92110E7F39E3C68F06A63493A7D5B9C199E8D45421F4E0A61FB1E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0ed6b0c8-4f0f-4980-91d2-57481298862f}_OnDiskSnapshotProp

Path \??\Volume{fe7bffb0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0ed6b0c8-4f0f-4980-91d2-57481298862f}_OnDiskSnapshotProp
Size 6KB
SHA256 10502a0aba000962f1974b0b819adbf2c5e682e00e3d271cf4ad92acae27784b
MD5 b8958cbf355e76b48a717868538ecde0
SHA1 c5c91f1c54c23c76551f2e17b8535c391f599067
SHA512 868ccf83121258c7acd3d1583b74aad74e7fc98ad58c4189b5c94286e4d4795326717b8302d73a022781f4ec419e2206b8381fe3d935b061e3516546b44c1b7c
SSDEEP 96:FFDQe8D5vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:HDQlXb++ZVmN
TLSH
T1C8D189185AF54711E2B3AB7228F14557A877B811EF33CB8E0198238E6670A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-319-0x0000015217E90000-0x0000015217F3D000-memory.dmp

Download

memory/1548-274-0x0000015217E90000-0x0000015217F3D000-memory.dmp

Download

memory/2388-294-0x0000022603010000-0x0000022603018000-memory.dmp

Download

memory/2388-363-0x0000022600D00000-0x0000022600DAD000-memory.dmp

Download

memory/2388-296-0x000002260ABD0000-0x000002260AC0B000-memory.dmp

Download

memory/2388-291-0x0000022600D00000-0x0000022600DAD000-memory.dmp

Download

memory/2388-295-0x000002260ABA0000-0x000002260ABC7000-memory.dmp

Download

memory/2388-292-0x0000022600DD0000-0x0000022600DFC000-memory.dmp

Download

memory/2388-293-0x0000022602FF0000-0x0000022602FFC000-memory.dmp

Download

memory/2624-316-0x000002BD017F0000-0x000002BD017F8000-memory.dmp

Download

memory/3248-7-0x0000022E38A40000-0x0000022E38A48000-memory.dmp

Download

memory/3568-290-0x000001E6E0650000-0x000001E6E06FD000-memory.dmp

Download

memory/3720-119-0x00007FFBB8030000-0x00007FFBB8031000-memory.dmp

Download

memory/3720-118-0x00007FFBB8FD0000-0x00007FFBB8FD1000-memory.dmp

Download

memory/3724-0-0x00000129BE640000-0x00000129BE6ED000-memory.dmp

Download

memory/3724-69-0x00000129BE640000-0x00000129BE6ED000-memory.dmp

Download

memory/3728-338-0x000002E0006C0000-0x000002E00076D000-memory.dmp

Download

memory/3728-64-0x000002E0006C0000-0x000002E00076D000-memory.dmp

Download

memory/4336-315-0x000001A482540000-0x000001A4825ED000-memory.dmp

Download

memory/4336-95-0x00007FFBB8CA0000-0x00007FFBB8CA1000-memory.dmp

Download

memory/4336-314-0x000001A4FB270000-0x000001A4FB30B000-memory.dmp

Download

memory/4892-203-0x00007FFBB8CA0000-0x00007FFBB8CA1000-memory.dmp

Download

memory/4892-320-0x000001E613E10000-0x000001E613EAB000-memory.dmp

Download