salatstealer | eb87a8aab833d5c2d60eaf7e86227e047b6e9c3910ed30426cf1a1aafdc7ea2a

Resubmissions

27/06/2026, 04:40

260627-falk7shv2m10

27/06/2026, 04:40

260627-fahvbahv2k

27/06/2026, 04:28

260627-e32bpagx5x10

Analysis

max time kernel
48s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-uk
resource tags

arch:x64arch:x86image:win10v2004-20260513-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
27/06/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jjsploit.exe
Size 9.5MB
Sample260627-e32bpagx5x
SHA256 eb87a8aab833d5c2d60eaf7e86227e047b6e9c3910ed30426cf1a1aafdc7ea2a
MD5 17f5422b04932ab3740a4a2d30bc20e4
SHA1 b122d6ba6b0624db9f303e2cc5ec4a31f099c62d
SHA512 9e2c6875f517337ed2715eacc352b5fa7dd929f6e3d21ada615604d5a6577233353b3d4d5b33ac3caff65238017310407724076c0dd62bcf72379faa0e8b7685
SSDEEP 196608:0H0s7mytQg7otWq1/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:G0OtdaJ/HwIxBinv1NGtVhT
TLSH
T1FEA6338BFE81EC33D4690C32863B47569314BC208B4A995727D976A9C9F27C41E36EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery salatstealer persistence ransomware spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/4032-17-0x00000000000A0000-0x0000000000CF7000-memory.dmp	family_salatstealer
behavioral1/memory/4032-22-0x00000000000A0000-0x0000000000CF7000-memory.dmp	family_salatstealer
behavioral1/memory/4032-30-0x00000000000A0000-0x0000000000CF7000-memory.dmp	family_salatstealer
behavioral1/memory/2308-36-0x0000000000B00000-0x0000000001757000-memory.dmp	family_salatstealer
behavioral1/memory/2304-37-0x0000000000B90000-0x00000000017E7000-memory.dmp	family_salatstealer
behavioral1/memory/2304-43-0x0000000000B90000-0x00000000017E7000-memory.dmp	family_salatstealer
behavioral1/memory/4048-112-0x00000000007F0000-0x0000000001447000-memory.dmp	family_salatstealer
behavioral1/memory/2304-118-0x0000000000B90000-0x00000000017E7000-memory.dmp	family_salatstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	jjsploit.exe

Executes dropped EXE 4 IoCs

pid	Process
4032	jjsploit.exe
2304	dllhost.exe
2308	dwm.exe
4048	dllhost.exe

Loads dropped DLL 1 IoCs

pid	Process
2616	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Program Files (x86)\\Google\\dllhost.exe"	jjsploit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "C:\\Users\\Admin\\AppData\\Local\\Packages\\dwm.exe"	jjsploit.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002444c-9.dat	upx
behavioral1/memory/4032-10-0x00000000000A0000-0x0000000000CF7000-memory.dmp	upx
behavioral1/memory/4032-17-0x00000000000A0000-0x0000000000CF7000-memory.dmp	upx
behavioral1/memory/4032-22-0x00000000000A0000-0x0000000000CF7000-memory.dmp	upx
behavioral1/memory/4032-30-0x00000000000A0000-0x0000000000CF7000-memory.dmp	upx
behavioral1/memory/2304-31-0x0000000000B90000-0x00000000017E7000-memory.dmp	upx
behavioral1/memory/2308-34-0x0000000000B00000-0x0000000001757000-memory.dmp	upx
behavioral1/memory/2308-36-0x0000000000B00000-0x0000000001757000-memory.dmp	upx
behavioral1/memory/2304-37-0x0000000000B90000-0x00000000017E7000-memory.dmp	upx
behavioral1/memory/2304-43-0x0000000000B90000-0x00000000017E7000-memory.dmp	upx
behavioral1/memory/4048-99-0x00000000007F0000-0x0000000001447000-memory.dmp	upx
behavioral1/memory/4048-112-0x00000000007F0000-0x0000000001447000-memory.dmp	upx
behavioral1/memory/2304-118-0x0000000000B90000-0x00000000017E7000-memory.dmp	upx

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\f2724f29-7c0f-0d1c-fa60-044b95cc297c	jjsploit.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\dllhost.exe	jjsploit.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dllhost.exe	dllhost.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5944fe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5944fe.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4608.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e594500.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jjsploit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductName = "jjsploit"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\PackageCode = "9FC2B6F90A0842C469E6F4CAD3052A7D"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	jjsploit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bnd_49295378\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\bnd_49295378\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Version = "135331849"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\PackageName = "jjsploit_8.17.9_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductIcon = "C:\\Windows\\Installer\\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4032	jjsploit.exe
4032	jjsploit.exe
4032	jjsploit.exe
4032	jjsploit.exe
1468	msiexec.exe
1468	msiexec.exe
2304	dllhost.exe
2304	dllhost.exe
2304	dllhost.exe
2304	dllhost.exe
3972	powershell.exe
3972	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	364	msiexec.exe
Token: SeSecurityPrivilege	1468	msiexec.exe
Token: SeCreateTokenPrivilege	364	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	364	msiexec.exe
Token: SeLockMemoryPrivilege	364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	364	msiexec.exe
Token: SeMachineAccountPrivilege	364	msiexec.exe
Token: SeTcbPrivilege	364	msiexec.exe
Token: SeSecurityPrivilege	364	msiexec.exe
Token: SeTakeOwnershipPrivilege	364	msiexec.exe
Token: SeLoadDriverPrivilege	364	msiexec.exe
Token: SeSystemProfilePrivilege	364	msiexec.exe
Token: SeSystemtimePrivilege	364	msiexec.exe
Token: SeProfSingleProcessPrivilege	364	msiexec.exe
Token: SeIncBasePriorityPrivilege	364	msiexec.exe
Token: SeCreatePagefilePrivilege	364	msiexec.exe
Token: SeCreatePermanentPrivilege	364	msiexec.exe
Token: SeBackupPrivilege	364	msiexec.exe
Token: SeRestorePrivilege	364	msiexec.exe
Token: SeShutdownPrivilege	364	msiexec.exe
Token: SeDebugPrivilege	364	msiexec.exe
Token: SeAuditPrivilege	364	msiexec.exe
Token: SeSystemEnvironmentPrivilege	364	msiexec.exe
Token: SeChangeNotifyPrivilege	364	msiexec.exe
Token: SeRemoteShutdownPrivilege	364	msiexec.exe
Token: SeUndockPrivilege	364	msiexec.exe
Token: SeSyncAgentPrivilege	364	msiexec.exe
Token: SeEnableDelegationPrivilege	364	msiexec.exe
Token: SeManageVolumePrivilege	364	msiexec.exe
Token: SeImpersonatePrivilege	364	msiexec.exe
Token: SeCreateGlobalPrivilege	364	msiexec.exe
Token: SeCreateTokenPrivilege	364	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	364	msiexec.exe
Token: SeLockMemoryPrivilege	364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	364	msiexec.exe
Token: SeMachineAccountPrivilege	364	msiexec.exe
Token: SeTcbPrivilege	364	msiexec.exe
Token: SeSecurityPrivilege	364	msiexec.exe
Token: SeTakeOwnershipPrivilege	364	msiexec.exe
Token: SeLoadDriverPrivilege	364	msiexec.exe
Token: SeSystemProfilePrivilege	364	msiexec.exe
Token: SeSystemtimePrivilege	364	msiexec.exe
Token: SeProfSingleProcessPrivilege	364	msiexec.exe
Token: SeIncBasePriorityPrivilege	364	msiexec.exe
Token: SeCreatePagefilePrivilege	364	msiexec.exe
Token: SeCreatePermanentPrivilege	364	msiexec.exe
Token: SeBackupPrivilege	364	msiexec.exe
Token: SeRestorePrivilege	364	msiexec.exe
Token: SeShutdownPrivilege	364	msiexec.exe
Token: SeDebugPrivilege	364	msiexec.exe
Token: SeAuditPrivilege	364	msiexec.exe
Token: SeSystemEnvironmentPrivilege	364	msiexec.exe
Token: SeChangeNotifyPrivilege	364	msiexec.exe
Token: SeRemoteShutdownPrivilege	364	msiexec.exe
Token: SeUndockPrivilege	364	msiexec.exe
Token: SeSyncAgentPrivilege	364	msiexec.exe
Token: SeEnableDelegationPrivilege	364	msiexec.exe
Token: SeManageVolumePrivilege	364	msiexec.exe
Token: SeImpersonatePrivilege	364	msiexec.exe
Token: SeCreateGlobalPrivilege	364	msiexec.exe
Token: SeCreateTokenPrivilege	364	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	364	msiexec.exe
Token: SeLockMemoryPrivilege	364	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
364	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 4032	728	jjsploit.exe	86
PID 728 wrote to memory of 364	728	jjsploit.exe	87
PID 1468 wrote to memory of 2616	1468	msiexec.exe	99
PID 4032 wrote to memory of 2304	4032	jjsploit.exe	101
PID 1468 wrote to memory of 3572	1468	msiexec.exe	111
PID 2304 wrote to memory of 3972	2304	dllhost.exe	114
PID 2304 wrote to memory of 4048	2304	dllhost.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jjsploit.exe
"C:\Users\Admin\AppData\Local\Temp\jjsploit.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:728
- C:\Users\Admin\AppData\Local\Temp\bnd_49295378\jjsploit.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_49295378\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Program Files (x86)\Google\dllhost.exe
    "C:\Program Files (x86)\Google\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3972
  - - C:\Program Files\Google\Chrome\Application\dllhost.exe
      "C:\Program Files\Google\Chrome\Application\dllhost.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4048
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\bnd_49295378\jjsploit_8.17.9_x64_en-US.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:364
- - C:\Program Files\jjsploit\jjsploit.exe
    "C:\Program Files\jjsploit\jjsploit.exe"
    3⤵
    PID:3440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=uk-UA --mojo-named-platform-channel-pipe=3440.2900.4047603177285593092
      4⤵
      PID:592
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x40,0x7ff87958b078,0x7ff87958b084,0x7ff87958b090
        5⤵
        
        PID:4232
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1840,i,10785473239979169771,5480120845980756984,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
        5⤵
        
        PID:4808
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2172,i,10785473239979169771,5480120845980756984,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
        5⤵
        
        PID:936
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1724,i,10785473239979169771,5480120845980756984,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
        5⤵
        
        PID:1976
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=uk_UA" --always-read-main-dll --field-trial-handle=3784,i,10785473239979169771,5480120845980756984,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
        5⤵
        
        PID:4936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 48657FE461511BB2C89407F58CA97AE7 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2616
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4816

C:\Users\Admin\AppData\Local\Packages\dwm.exe
C:\Users\Admin\AppData\Local\Packages\dwm.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5944ff.rbs

Path C:\Config.Msi\e5944ff.rbs
Size 21KB
SHA256 44209f5195203c51f0797785ddf238ea036bba622ba0b683de4eee5c57031af1
MD5 9755c2c8fbeb5a54e6d8e76772421556
SHA1 c23e0e8c38a649820490f6930456b05237697ae0
SHA512 715e58038b1a89aaa23b99d258b1ae0cbcb7eaef8605df48db00289f1476fa21c803e5c6ea6d34c5a103a6f0b5888a560028b37f2db574ccda0b70b731097b55
SSDEEP 384:P3ZAB7OTEXTIrY8nTZoWjdLRWixkt8t8t8t0tstststststststitztzty9GB/BO:P3ZAB7OTEXTIrY8nTZoWjdLRWixkt8tD
TLSH
T156A212835A00C2E6E66B0774DB975B043B72C58E9358424B46CCC27A9D877C83FF9A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
MD5 f5b2fd9a39c097322b6cb663cca5b4e8
SHA1 08c113bccec7d3cdf4f6a2b313d1b1421ad62f85
SHA512 490b5c18b55ca136782d2f25e8f8b86a3cc5ae0ad25fda274bfe1a3adc759cbbb8f11592f6e7ad3451b758199e90db482767f4ebae7d93db61d8b90b3f61aae8
SSDEEP 196608:h9Uzqh1cmdDOf+IHFLU/6NW+tiFZJXij:MzqoyS+IHFI/extiFZJXi
TLSH
T139070725BE8B996CD05FC474834B8A720A7570CB0B35B9FF448596392F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 6f3bb0d237a83d25d8d2a7c31c3c4fe2c1d5369c75162e5f049fc53db39b61ca
MD5 d9fbc7ff665cdb50bcc7e53fcc467f70
SHA1 921959aa80d2c659ba18ae6fcce227fe66d09945
SHA512 83afcaad0062a8a94e7474b11bbdc5825284be47afd04bd663aecfe27ea61ebd17f3bc237b4827fb82794082b7874333e230325641bc3c049c1f0ff4d68436c1
TLSH
T1CF41E20042E1072AE3E58675AF6247219A7BFC15AEB49F678188418E9D39100E97DF7E
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe594b86.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe594b86.TMP
Size 1KB
SHA256 71dbb71b2c45692df528e5e45febf216c7517dd0ad9eb14f490a4ab6c4da702b
MD5 3ea0660b1008b6bd44b208ee5b4f72f6
SHA1 6f7d75a5bc60e20f137fcdf89cf8e41f5ba63f0f
SHA512 28cf1886ef69fde40d2b6d856f6a1a95de97d7bf87a8cb487e2b2c8458f6ce0b2976210d5a1ced148e457c3c353157cdc035c3f0396369fb713d473f9759b259
TLSH
T1D241F10002F0072AE3E586787F624B219A7FFC11AEB09FA78188418E8834100E97DF7E
MD5 SHA1 SHA512 TLSH

Submit Download

MSIDB48.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIDB48.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4gx13mbj.dxh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4gx13mbj.dxh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_49295378\jjsploit.exe
Size 3.4MB
SHA256 af227894e7648154bba3f519f16c3ac395a0f9e241ce6f0c0d28bd88fdb6175b
MD5 5ffdb8236394214d6163b955c4119422
SHA1 ded3671954c9225c36ef32aef9885318e9d5fdc7
SHA512 10390df168c8118930c8ed5f8d207fdc2509b0e4d910cc3ef2aece454be3637e0e59576bc44d405314d96aaa4404c2b22eb7cae4118fc9fb4b0f33c2bb0e2cce
SSDEEP 49152:96+Cwgua4sCMuijTMkFr8h+5+AS2aVWdhxT+m60kAp0OcS/gQogSUxSKG09Hio:9kH0s7mE5tSzV4hp9kaLjogS0b
TLSH
T128F533C60794F472E139BD3A8B73660AB044B03CD897DD751BCA4AA98323DCE775296C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit_8.17.9_x64_en-US.msi

Path C:\Users\Admin\AppData\Local\Temp\bnd_49295378\jjsploit_8.17.9_x64_en-US.msi
Size 6.0MB
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cad9dde0bfa9a7d6f36d5c51e6da97c5894bb359a0b1107be046d5bdd74f3e68
MD5 926e4c6e6e95895c8b098acd3acb8e2a
SHA1 f71d1b95bdfe4c816225ae6236441ad1f889b7f5
SHA512 8bb56c583187be7873bddee81e1631e598a53f3c90968eb286811c15b20ac08c26160b967f74fae3be654233a4ae078377e87597bd57ff66aa9e1523b20ee63d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 627d5aa592d8ae596489cf7554d926b05df4dd461b3e7285f6330f5dba753939
MD5 41f36a263a216dbec34cef067fca5947
SHA1 b70ee3f5c5b72c8558be9a90089b29ab0d4d6a49
SHA512 7b6196d6dfa755be241d71ab44039a8f5bada14444fa56e4c95707d92cbf4cfa7afbe096b1517df56b25f728f0ac5dec22c7e5eb3aba68aa2ad8b28bde54355d
TLSH
T1BDD0123E32110634C1103A330843E1880401D21B40468000642D851E2A550541D23852
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 9fabdbd6cc90a18e443fe761d2484ddddb97bb096c30dfae9ac4021025393e59
MD5 4f6bb2d40d5cd365b90231727e4980c7
SHA1 d88fcea3afc4fef48f1f3f2e46f1298d60d1f4f3
SHA512 737dcf6288e9710a7edf9415ba4fb83db1c161daa59f8001037a0b7b7ab9e1a79e6c0b2bbd9a7be752e8dac04dff7cdf098c2955802815c07fa6d0159898c01e
SSDEEP 3:LstlNllkll/lS:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 8a4ad587ee0671e4f309a79d44a7d9af1743de912de07b1763b58669e4812d2a
MD5 3635f375f78cb9a823ecd5a69b1fb0cc
SHA1 aa6cfbc2f2dac3d1304f13dd3b958d91e4b68064
SHA512 7d809c669d96e513ae9cc269c235e8b70149ea4358676fcd4c98e665cb76b050c67ebacfcc4f6195019f5767eeaf703a5e655121b73d1a1b0e7cf75e8854f82c
TLSH
T14251B833EC445B3789E38944B95F3F139A729065AB512F9499DE4B0C02EB2AC6342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 0dba2054719b276672e2705ad7161f14d1af59dad3464cb87dde2d32ffd11c78
MD5 0bbe6ea24bd7da2efef0371642091a62
SHA1 7b6dd1a70381a7cd0a7419989739c66ea330ee82
SHA512 ddf8890f13fbab9f93849724339f8bf019053a74954f6e987f48777284bf80ad2633d12993aec765eb035251564346a89340ca2cd21823d01213cfe66887c134
TLSH
T19F719732A9649A374DE2D940B88A3F16B7A25037E6813F99D9ED0F0D02DB3DC5352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 1KB
SHA256 51ea3247b65d5cc4a41894c78df1cb065d9e3c3487a0e013664376ef38c03629
MD5 724fb69288ff1f9bb2eabe67e9aa361d
SHA1 51827850f161712627c6402bce7725fd51b2639b
SHA512 1fcab7412c9e0e3af5e6234af18e0d3e992eebf290d2fa3c8ffd0a0153ed331566bd47eba1235d3054bfd97817baadad2fd6d2a9063306e35922b896cace1ed7
TLSH
T1A1318572D8901F32ACC29580B15B7F5B5E62502AD2419F88E5DE8B1D03F72DCD166C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597b22.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe597b22.TMP
Size 1KB
SHA256 392d4148d8900b4fe7b488a5a7d4d4555d1371563d0f9011eeab436a6ce4a284
MD5 04e7bb2ac8ca1b5531544a7a0116a5ac
SHA1 aad20fa69cda057c623eadee6b413d2c8dfdc015
SHA512 0ebd639a52e8c6a8cb2d78d76cc606b843fe0016d16a48f7d5898c69a3760f86e354ab4d1ed5acfa5ef2320ef982e02f4002f6f030a07dc9a7f62cd5d94568cc
TLSH
T1BD216573C8902F36A8C14880B11BBF8B1EA1902992009F08E5DE871D13FB2ECD276C32
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 f649b6d93cd3201a77faa201f15d94a875aa18d74765549920df9122b965aaa6
MD5 041ac384d496d2036fc9e71a523c1af6
SHA1 ff94fbab74334dbb41dd260c750244e7ed3d45ab
SHA512 3d537ab6c6c29210e6ae662892827926891b96e25d6b2a056cc1994b2eb1a292dd7cea0a7fd7dd721703f98b91a352997dd0b39b1395b4c7067a474efb18f978
SSDEEP 24576:6u8m+1zEdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:t
TLSH
T15347D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{afe75e04-58a6-4b7e-918f-5dfa61849594}_OnDiskSnapshotProp

Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{afe75e04-58a6-4b7e-918f-5dfa61849594}_OnDiskSnapshotProp
Size 6KB
SHA256 38bbeb0df1bb855a8e47d5d8ded085a11a59a34b69469b3507b580a2b5d5a862
MD5 4b5f36e557c447c9680faa7fdad9cc15
SHA1 cd3a15765d8f69a6c29076ca23e164c83741cb33
SHA512 038b2209b17e167c0029709d54df41b76280fea1ee3e82a14137ca74542a371f1c484f022d06d418d69e7aa16d61c3ca899aaccb34536cfdb15fa5f1609e04d7
SSDEEP 96:FjQeVsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:1Q1b++ZVmN
TLSH
T11BD189185AE54711E2B3AB7228F14557A477B911EF33CB8E0198238E6670A10F876F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-0-0x0000000000A40000-0x00000000013C2000-memory.dmp

Download

memory/1976-183-0x00007FF8996B0000-0x00007FF8996B1000-memory.dmp

Download

memory/1976-184-0x00007FF897F20000-0x00007FF897F21000-memory.dmp

Download

memory/2304-31-0x0000000000B90000-0x00000000017E7000-memory.dmp

Download

memory/2304-37-0x0000000000B90000-0x00000000017E7000-memory.dmp

Download

memory/2304-118-0x0000000000B90000-0x00000000017E7000-memory.dmp

Download

memory/2304-43-0x0000000000B90000-0x00000000017E7000-memory.dmp

Download

memory/2308-34-0x0000000000B00000-0x0000000001757000-memory.dmp

Download

memory/2308-36-0x0000000000B00000-0x0000000001757000-memory.dmp

Download

memory/3972-128-0x0000000007490000-0x00000000074C2000-memory.dmp

Download

memory/3972-103-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/3972-138-0x0000000007470000-0x000000000748E000-memory.dmp

Download

memory/3972-139-0x00000000074D0000-0x0000000007573000-memory.dmp

Download

memory/3972-141-0x0000000007630000-0x000000000764A000-memory.dmp

Download

memory/3972-140-0x0000000007C70000-0x00000000082EA000-memory.dmp

Download

memory/3972-142-0x0000000007680000-0x000000000768A000-memory.dmp

Download

memory/3972-143-0x0000000007730000-0x00000000077C6000-memory.dmp

Download

memory/3972-144-0x00000000076A0000-0x00000000076B1000-memory.dmp

Download

memory/3972-101-0x0000000004FE0000-0x0000000005002000-memory.dmp

Download

memory/3972-100-0x0000000005130000-0x0000000005758000-memory.dmp

Download

memory/3972-317-0x00000000077D0000-0x00000000077D8000-memory.dmp

Download

memory/3972-129-0x000000006FF00000-0x000000006FF4C000-memory.dmp

Download

memory/3972-308-0x00000000077F0000-0x000000000780A000-memory.dmp

Download

memory/3972-104-0x0000000005AE0000-0x0000000005E34000-memory.dmp

Download

memory/3972-130-0x0000000070710000-0x0000000070A64000-memory.dmp

Download

memory/3972-98-0x0000000004AC0000-0x0000000004AF6000-memory.dmp

Download

memory/3972-102-0x0000000005850000-0x00000000058B6000-memory.dmp

Download

memory/3972-119-0x0000000006610000-0x0000000006654000-memory.dmp

Download

memory/3972-113-0x00000000060A0000-0x00000000060BE000-memory.dmp

Download

memory/3972-307-0x00000000076E0000-0x00000000076F4000-memory.dmp

Download

memory/3972-114-0x00000000060E0000-0x000000000612C000-memory.dmp

Download

memory/3972-306-0x00000000076D0000-0x00000000076DE000-memory.dmp

Download

memory/4032-30-0x00000000000A0000-0x0000000000CF7000-memory.dmp

Download

memory/4032-22-0x00000000000A0000-0x0000000000CF7000-memory.dmp

Download

memory/4032-17-0x00000000000A0000-0x0000000000CF7000-memory.dmp

Download

memory/4032-10-0x00000000000A0000-0x0000000000CF7000-memory.dmp

Download

memory/4048-112-0x00000000007F0000-0x0000000001447000-memory.dmp

Download

memory/4048-99-0x00000000007F0000-0x0000000001447000-memory.dmp

Download

memory/4808-164-0x00007FF898D10000-0x00007FF898D11000-memory.dmp

Download

memory/4936-260-0x00007FF898D10000-0x00007FF898D11000-memory.dmp

Download