Overview

overview

8

Static

static

3

jjsploit_8...US.msi

windows10-2004-x64

7

jjsploit_8...US.msi

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    123s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/06/2026, 15:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jjsploit_8.17.9_x64_en-US.msi
  • Size 6.0MB
  • Sample260620-tbfm8sg141
  • SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 15 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.9_x64_en-US.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Program Files\jjsploit\jjsploit.exe
      "C:\Program Files\jjsploit\jjsploit.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5572
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5572.2896.11527543451166319261 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:2656
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x140,0x194,0x7ffdc09e5fd8,0x7ffdc09e5fe4,0x7ffdc09e5ff0
          4⤵
            PID:2312
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1684 --field-trial-handle=1692,i,14572504446724734771,8504012917959481908,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
            4⤵
              PID:2500
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1692,i,14572504446724734771,8504012917959481908,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
              4⤵
                PID:1696
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1692,i,14572504446724734771,8504012917959481908,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
                4⤵
                  PID:3824
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3304 --field-trial-handle=1692,i,14572504446724734771,8504012917959481908,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f /prefetch:1
                  4⤵
                    PID:6084
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Enumerates connected drives
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4748
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 6FD65FE0324157B0C5E0586B00886D25 C
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1788
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                2⤵
                  PID:5900
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                PID:4260
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k GPSvcGroup
                1⤵
                  PID:5564
                • C:\Windows\system32\sihost.exe
                  sihost.exe
                  1⤵
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:5360
                  • C:\Windows\explorer.exe
                    explorer.exe /LOADSAVEDWINDOWS
                    2⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Enumerates connected drives
                    • Checks SCSI registry key(s)
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:3744
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:1084
                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:2628

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Event Triggered Execution

                      1
                      T1546

                      Installer Packages

                      1
                      T1546.016

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Active Setup

                      1
                      T1547.014

                      Event Triggered Execution

                      1
                      T1546

                      Installer Packages

                      1
                      T1546.016

                      Defense Evasion

                      Modify Registry

                      3
                      T1112

                      Subvert Trust Controls

                      2
                      T1553

                      Install Root Certificate

                      2
                      T1553.004

                      System Binary Proxy Execution

                      1
                      T1218

                      Msiexec

                      1
                      T1218.007

                      Credential Access

                      Discovery

                      Network Share Discovery

                      1
                      T1135

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      4
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e590130.rbs
                      • Path C:\Config.Msi\e590130.rbs
                      • Size 21KB
                      • SHA256 b61a136ff3121ebaae07d1be46c4079197fcfa77002cce77b5801813fe495234
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jjsploit.exe
                      • Path C:\Program Files\jjsploit\jjsploit.exe
                      • Size 17.6MB
                      • SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      jjsploit.lnk
                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
                      • Size 1KB
                      • SHA256 f7451bd3f477f90fe88bf1b866f42248152c84ea57cce8a6f578db52cc45758c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      jjsploit.lnk~RFe590aa5.TMP
                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe590aa5.TMP
                      • Size 1KB
                      • SHA256 93606fffb837c3dee6c6072e49e7e122fb3202739509e33136b5285f2e70b817
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 599B
                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 595B
                      • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSIBAA0.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSIBAA0.tmp
                      • Size 132KB
                      • SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 954d833a2aa37f5daa3405774b05c965a65a5703adf9770b34f65ad33338d230
                      • MD5 SHA1 SHA512
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 d10c188fee135e9b46f3ed2a52ba342bf06675c572ee62f020f6a8927efbe62b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      throttle_store.dat
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
                      • Size 20B
                      • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                      • MD5 SHA1 SHA512
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 144B
                      • SHA256 b77305e8f54e18fe03b03df1c499ccc6b6730259806badadc1944e524e1b4a96
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      the-real-index~RFe59ceb0.TMP
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59ceb0.TMP
                      • Size 48B
                      • SHA256 efd8895fd89c9bf99a62e37bbb42a8acd2a02fb3e5ea6ca08e88477e891696ef
                      • MD5 SHA1 SHA512
                      Submit Download

                      0b07c0f0-9ae9-4fbc-899a-707dc5e46bad.tmp
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\0b07c0f0-9ae9-4fbc-899a-707dc5e46bad.tmp
                      • Size 1024B
                      • SHA256 42494a766fc6ddbd74891f3a335705a98908f4fe333e591336586eda043bf7b1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Network Persistent State
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
                      • Size 2KB
                      • SHA256 9242d3429cf8f26b626af530b67b17c8989d45819ffb2e8968c165f783f71c16
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Network Persistent State~RFe5a8c82.TMP
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5a8c82.TMP
                      • Size 59B
                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      SCT Auditing Pending Reports
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
                      • Size 2B
                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                      • MD5 SHA1 SHA512
                      Submit Download

                      TransportSecurity
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity
                      • Size 1024B
                      • SHA256 8ca5402afd87243b57f94dd2e97eacbe067d0698f343e822f77beecb7ed35045
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      TransportSecurity~RFe5a6b4e.TMP
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity~RFe5a6b4e.TMP
                      • Size 1024B
                      • SHA256 e011760ae75f83ede473cbec05d767fe9d2138237163aa13fdef5fa49cffbda0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MANIFEST-000001
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
                      • Size 41B
                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                      • MD5 SHA1 SHA512
                      Submit Download

                      a47526c3-1b16-4ddf-90a4-1eb02d6a40b4.tmp
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\a47526c3-1b16-4ddf-90a4-1eb02d6a40b4.tmp
                      • Size 6KB
                      • SHA256 5cdf41f5c52b2635dcc301c8fc595c99ff3142b058ad8590c564a2991361afc8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CURRENT
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\shared_proto_db\metadata\CURRENT
                      • Size 16B
                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                      • MD5 SHA1 SHA512
                      Submit Download

                      data_0
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0
                      • Size 8KB
                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_1
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_1
                      • Size 264KB
                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_2
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_2
                      • Size 8KB
                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_3
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_3
                      • Size 8KB
                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                      • Size 2KB
                      • SHA256 2ccd56d15fab18bdab3459e001fee98ecd3886a41218d473e405b2b0d093dc14
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                      • Size 3KB
                      • SHA256 3263eac4c24783f50dacba681fff6a48d4c9dfe723441589d3986752d48c5ede
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                      • Size 15KB
                      • SHA256 68de0fa864a31a8fa71d9a18fba2455b5e64bbfc88902e010cf1e3160d4ca0e8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Local State~RFe597778.TMP
                      • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe597778.TMP
                      • Size 1KB
                      • SHA256 d58216b444cdcc95eefddfdbff2da9b42992c3a5f2840a5c525ff8ab5bfc162a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      default.exc
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                      • Size 2B
                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                      • MD5 SHA1 SHA512
                      Submit Download

                      jjsploit.lnk
                      • Path C:\Users\Public\Desktop\jjsploit.lnk
                      • Size 999B
                      • SHA256 6d3307e493e6e50268122523ec9d58283c9ae37ca3069cf8f4ce73348ca39147
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      e59012f.msi
                      • Path C:\Windows\Installer\e59012f.msi
                      • Size 6.0MB
                      • SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      metadata-2
                      • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                      • Size 26.1MB
                      • SHA256 89631ae75941034b6f68cab4afc8686dc7482f6889f42c929b9beb6e855f9332
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      {9a140e9d-e13c-405e-b909-5adcc168de8f}_OnDiskSnapshotProp
                      • Path \??\Volume{fc7fe687-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9a140e9d-e13c-405e-b909-5adcc168de8f}_OnDiskSnapshotProp
                      • Size 6KB
                      • SHA256 10b102bb9c0974d6c443334a6d2580d7337e662bc5fc32265350fac8a1b3eeee
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/1084-453-0x0000029086870000-0x0000029086B0E000-memory.dmp
                      Download

                      memory/2500-93-0x00007FFDE4860000-0x00007FFDE4861000-memory.dmp
                      Download

                      memory/2500-288-0x000002461FEC0000-0x000002461FF68000-memory.dmp
                      Download

                      memory/2628-294-0x000001E9801E0000-0x000001E9802E0000-memory.dmp
                      Download

                      memory/2628-454-0x000001E9981A0000-0x000001E99843E000-memory.dmp
                      Download

                      memory/2628-325-0x000001E9948F0000-0x000001E994910000-memory.dmp
                      Download

                      memory/2628-339-0x000001E9948D0000-0x000001E9948F0000-memory.dmp
                      Download

                      memory/2628-306-0x000001E981FD0000-0x000001E981FF0000-memory.dmp
                      Download

                      memory/2628-307-0x000001E9943F0000-0x000001E9944F0000-memory.dmp
                      Download

                      memory/2628-293-0x000001E9801E0000-0x000001E9802E0000-memory.dmp
                      Download

                      memory/4748-59-0x000001DCCFB20000-0x000001DCCFBED000-memory.dmp
                      Download

                      memory/4748-257-0x000001DCCFB20000-0x000001DCCFBED000-memory.dmp
                      Download

                      memory/6084-115-0x00007FFDE4860000-0x00007FFDE4861000-memory.dmp
                      Download