d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd

Resubmissions

27/06/2026, 19:46

260627-yg1b2sds217

27/06/2026, 19:09

260627-xt41bscy8x8

Analysis

user interaction
yes
max time kernel
677s
max time network
666s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jjsploit_8.17.9_x64_en-US.msi
Size 6.0MB
Sample260627-xt41bscy8x
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
207	3372	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
3420	jjsploit.exe
3216	RobloxPlayerInstaller.exe
5764	jjsploit.exe
1292	RobloxPlayerBeta.exe
404	RobloxPlayerBeta.exe

Loads dropped DLL 3 IoCs

pid	Process
1112	MsiExec.exe
1292	RobloxPlayerBeta.exe
404	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
99	raw.githubusercontent.com
101	raw.githubusercontent.com
105	raw.githubusercontent.com
248	raw.githubusercontent.com
254	raw.githubusercontent.com
93	raw.githubusercontent.com
94	raw.githubusercontent.com
103	raw.githubusercontent.com
245	raw.githubusercontent.com
246	raw.githubusercontent.com
251	raw.githubusercontent.com
256	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1292	RobloxPlayerBeta.exe
1292	RobloxPlayerBeta.exe
1292	RobloxPlayerBeta.exe
404	RobloxPlayerBeta.exe
404	RobloxPlayerBeta.exe
404	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\Controls\DesignSystem\DpadRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\fonts\families\Balthazar.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Settings\MenuBarAssets\MenuButtonSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-tip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Controls\DesignSystem\ButtonR2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Moments\Reactions\heart-small.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaApp\graphic\album_art_fallback_blue.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\AvatarEditorImages\AvatarEditor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Slider_dn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Controls\DesignSystem\ButtonX.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_3x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaApp\icons\ic-more-events.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\transformTwentyTwoDegrees.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\SearchIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\PlatformContent\pc\textures\ui\Shell\Icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_11.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\StudioSharedUI\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Controls\xboxRT.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Controls\DefaultController\ButtonR1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Settings\Radial\Chat.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_2x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\ButtonRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\scrollbuttonDown_ds.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\MicDark\Unmuted100.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\InGameMenu\game_tiles_background_desktop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Settings\Radial\EmptyTopLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\RedSpeakerLight\Unmuted20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\MenuBar\icon_home.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaApp\icons\ic-more-my-feed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaChat\icons\ic-remove.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\btn_redGlow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\TopBar\moreOff.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\ExtraContent\textures\ui\LuaChat\icons\ic-check.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\fonts\AmaticSC-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\AvatarEditorImages\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\ScreenshotHud\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\StudioSharedUI\close.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Input\IntroMove.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\Settings\Players\AddFriendIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\TopBar\coloredlogo.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\shaders\shaders_d3d11.pack	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\avatar\compositing\CompositExtraSlot0.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\content\avatar\scripts\humanoidAnimateR15Moods.rbxm	RobloxPlayerInstaller.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIDFBC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58deb5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58deb3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}	msiexec.exe
File created	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58deb3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00070000000246b8-769.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4860	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3372	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270610325149406"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductIcon = "C:\\Windows\\Installer\\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Version = "135331849"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-71452ee9293e4e08"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-1a951716f19e4638"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\PackageName = "jjsploit_8.17.9_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-1a951716f19e4638\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-1a951716f19e4638\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-1a951716f19e4638\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-1a951716f19e4638\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-1a951716f19e4638"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductName = "jjsploit"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\PackageCode = "9FC2B6F90A0842C469E6F4CAD3052A7D"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	jjsploit.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4348	msiexec.exe
4348	msiexec.exe
4792	chrome.exe
4792	chrome.exe
3216	RobloxPlayerInstaller.exe
3216	RobloxPlayerInstaller.exe
1292	RobloxPlayerBeta.exe
4792	chrome.exe
4792	chrome.exe
404	RobloxPlayerBeta.exe
5600	chrome.exe
5600	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2644	msedgewebview2.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
5532	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	4348	msiexec.exe
Token: SeCreateTokenPrivilege	4860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4860	msiexec.exe
Token: SeLockMemoryPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeMachineAccountPrivilege	4860	msiexec.exe
Token: SeTcbPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeLoadDriverPrivilege	4860	msiexec.exe
Token: SeSystemProfilePrivilege	4860	msiexec.exe
Token: SeSystemtimePrivilege	4860	msiexec.exe
Token: SeProfSingleProcessPrivilege	4860	msiexec.exe
Token: SeIncBasePriorityPrivilege	4860	msiexec.exe
Token: SeCreatePagefilePrivilege	4860	msiexec.exe
Token: SeCreatePermanentPrivilege	4860	msiexec.exe
Token: SeBackupPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeDebugPrivilege	4860	msiexec.exe
Token: SeAuditPrivilege	4860	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4860	msiexec.exe
Token: SeChangeNotifyPrivilege	4860	msiexec.exe
Token: SeRemoteShutdownPrivilege	4860	msiexec.exe
Token: SeUndockPrivilege	4860	msiexec.exe
Token: SeSyncAgentPrivilege	4860	msiexec.exe
Token: SeEnableDelegationPrivilege	4860	msiexec.exe
Token: SeManageVolumePrivilege	4860	msiexec.exe
Token: SeImpersonatePrivilege	4860	msiexec.exe
Token: SeCreateGlobalPrivilege	4860	msiexec.exe
Token: SeCreateTokenPrivilege	4860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4860	msiexec.exe
Token: SeLockMemoryPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeMachineAccountPrivilege	4860	msiexec.exe
Token: SeTcbPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeLoadDriverPrivilege	4860	msiexec.exe
Token: SeSystemProfilePrivilege	4860	msiexec.exe
Token: SeSystemtimePrivilege	4860	msiexec.exe
Token: SeProfSingleProcessPrivilege	4860	msiexec.exe
Token: SeIncBasePriorityPrivilege	4860	msiexec.exe
Token: SeCreatePagefilePrivilege	4860	msiexec.exe
Token: SeCreatePermanentPrivilege	4860	msiexec.exe
Token: SeBackupPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeDebugPrivilege	4860	msiexec.exe
Token: SeAuditPrivilege	4860	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4860	msiexec.exe
Token: SeChangeNotifyPrivilege	4860	msiexec.exe
Token: SeRemoteShutdownPrivilege	4860	msiexec.exe
Token: SeUndockPrivilege	4860	msiexec.exe
Token: SeSyncAgentPrivilege	4860	msiexec.exe
Token: SeEnableDelegationPrivilege	4860	msiexec.exe
Token: SeManageVolumePrivilege	4860	msiexec.exe
Token: SeImpersonatePrivilege	4860	msiexec.exe
Token: SeCreateGlobalPrivilege	4860	msiexec.exe
Token: SeCreateTokenPrivilege	4860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4860	msiexec.exe
Token: SeLockMemoryPrivilege	4860	msiexec.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4860	msiexec.exe
4860	msiexec.exe
3420	jjsploit.exe
3420	jjsploit.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
5764	jjsploit.exe
5764	jjsploit.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1112	4348	msiexec.exe	92
PID 4348 wrote to memory of 3948	4348	msiexec.exe	98
PID 4860 wrote to memory of 3420	4860	msiexec.exe	102
PID 3420 wrote to memory of 2644	3420	jjsploit.exe	104
PID 2644 wrote to memory of 3016	2644	msedgewebview2.exe	105
PID 2644 wrote to memory of 4532	2644	msedgewebview2.exe	106
PID 2644 wrote to memory of 4532	2644	msedgewebview2.exe	106
PID 2644 wrote to memory of 4532	2644	msedgewebview2.exe	106
PID 2644 wrote to memory of 4432	2644	msedgewebview2.exe	107
PID 2644 wrote to memory of 4332	2644	msedgewebview2.exe	108
PID 2644 wrote to memory of 4332	2644	msedgewebview2.exe	108
PID 2644 wrote to memory of 3156	2644	msedgewebview2.exe	109
PID 2644 wrote to memory of 3156	2644	msedgewebview2.exe	109
PID 2644 wrote to memory of 3156	2644	msedgewebview2.exe	109
PID 4792 wrote to memory of 4836	4792	chrome.exe	114
PID 4792 wrote to memory of 4684	4792	chrome.exe	115
PID 4792 wrote to memory of 4684	4792	chrome.exe	115
PID 4792 wrote to memory of 3372	4792	chrome.exe	116
PID 4792 wrote to memory of 4408	4792	chrome.exe	117
PID 4792 wrote to memory of 4408	4792	chrome.exe	117
PID 4792 wrote to memory of 3276	4792	chrome.exe	119
PID 4792 wrote to memory of 3276	4792	chrome.exe	119
PID 4792 wrote to memory of 516	4792	chrome.exe	120
PID 4792 wrote to memory of 516	4792	chrome.exe	120
PID 4792 wrote to memory of 4904	4792	chrome.exe	121
PID 4792 wrote to memory of 4904	4792	chrome.exe	121
PID 4792 wrote to memory of 3212	4792	chrome.exe	122
PID 4792 wrote to memory of 3212	4792	chrome.exe	122
PID 4792 wrote to memory of 5292	4792	chrome.exe	123
PID 4792 wrote to memory of 5292	4792	chrome.exe	123
PID 4792 wrote to memory of 5400	4792	chrome.exe	124
PID 4792 wrote to memory of 5400	4792	chrome.exe	124
PID 4792 wrote to memory of 5516	4792	chrome.exe	125
PID 4792 wrote to memory of 5516	4792	chrome.exe	125
PID 4792 wrote to memory of 5668	4792	chrome.exe	126
PID 4792 wrote to memory of 5936	4792	chrome.exe	129
PID 4792 wrote to memory of 5936	4792	chrome.exe	129
PID 4792 wrote to memory of 5404	4792	chrome.exe	130
PID 4792 wrote to memory of 5404	4792	chrome.exe	130
PID 4792 wrote to memory of 4856	4792	chrome.exe	131
PID 4792 wrote to memory of 4856	4792	chrome.exe	131
PID 4792 wrote to memory of 6128	4792	chrome.exe	132
PID 4792 wrote to memory of 3216	4792	chrome.exe	133
PID 4792 wrote to memory of 5552	4792	chrome.exe	134
PID 4792 wrote to memory of 5548	4792	chrome.exe	135
PID 4792 wrote to memory of 3612	4792	chrome.exe	136
PID 3420 wrote to memory of 5764	3420	jjsploit.exe	141
PID 3216 wrote to memory of 1292	3216	RobloxPlayerInstaller.exe	142
PID 5764 wrote to memory of 5532	5764	jjsploit.exe	143
PID 5532 wrote to memory of 5996	5532	msedgewebview2.exe	144
PID 5532 wrote to memory of 5376	5532	msedgewebview2.exe	145
PID 5532 wrote to memory of 5376	5532	msedgewebview2.exe	145
PID 5532 wrote to memory of 5376	5532	msedgewebview2.exe	145
PID 5532 wrote to memory of 5392	5532	msedgewebview2.exe	146
PID 5532 wrote to memory of 5168	5532	msedgewebview2.exe	147
PID 5532 wrote to memory of 5168	5532	msedgewebview2.exe	147
PID 5532 wrote to memory of 680	5532	msedgewebview2.exe	148
PID 5532 wrote to memory of 680	5532	msedgewebview2.exe	148
PID 5532 wrote to memory of 680	5532	msedgewebview2.exe	148
PID 4792 wrote to memory of 5600	4792	chrome.exe	160
PID 4792 wrote to memory of 4064	4792	chrome.exe	164
PID 4792 wrote to memory of 4064	4792	chrome.exe	164

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.9_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files\jjsploit\jjsploit.exe
  "C:\Program Files\jjsploit\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3420.2020.619411196297383219
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdfa9fb078,0x7ffdfa9fb084,0x7ffdfa9fb090
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,9631038466404963330,12891709041693988881,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,9631038466404963330,12891709041693988881,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,9631038466404963330,12891709041693988881,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3584,i,9631038466404963330,12891709041693988881,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:3156
- - C:\Program Files\jjsploit\jjsploit.exe
    "\\?\C:\Program Files\jjsploit\jjsploit.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5764.1892.11514147315898493678
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5532
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x164,0x194,0x7ffdfa9fb078,0x7ffdfa9fb084,0x7ffdfa9fb090
        5⤵
        
        PID:5996
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2052,i,1681052249106127928,17282369910189954949,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
        5⤵
        
        PID:5376
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1780,i,1681052249106127928,17282369910189954949,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
        5⤵
        
        PID:5392
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,1681052249106127928,17282369910189954949,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
        5⤵
        
        PID:5168
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3488,i,1681052249106127928,17282369910189954949,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:680

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6D901106E9BC25A5E08C187AC3B46CC7 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1112
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdfbb9c728,0x7ffdfbb9c734,0x7ffdfbb9c740
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2113039408902320316,2008373055398616284,262144 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,4678143065148831494,16536397258336967520,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,6217791399307062232,6679083408725019520,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2320 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,17970266810114262655,11079403165294688712,2097152 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,4880314345222122694,16240239465594749481,2097152 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,17307334011494194851,13677079159881488294,2097152 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,2104524366195968139,12143387305469804520,2097152 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,8982959244902361851,8362170268934962891,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4424,i,12699049273474711890,12727149175670546151,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4988,i,8009026521387700883,14374457411909163844,2097152 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,3766013922301935914,7072524046212029634,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,4609006585355401668,6883858535256295878,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5932,i,7042352364402285569,12113791907554264943,2097152 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6084,i,2110276488527592751,8821009314710369285,2097152 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,15466582836219442903,15707396549502944413,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:6128
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3216
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,8841648081015036640,3992236410133199339,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,6941282561248771442,14045771801168191210,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,3900696526946191413,14989630239261372501,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5268,i,13435223428812278615,752176658899232405,262144 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3240,i,6963589732555894413,2862202723168912460,524288 --field-trial-handle=1992,i,14508289786013847414,12103248758786403516,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:4064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5784

C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1288

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Outlook Logging\firstrun.log
1⤵
PID:4864

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Windows\Temp\EPSYDAFZ-20260514-0032.log
1⤵
PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58deb4.rbs

Path C:\Config.Msi\e58deb4.rbs
Size 21KB
SHA256 db185b671fccac8827602356581b12a566ebf2986d1ec4b7cd2e7a7277213b3b
MD5 218050fcd96b7890cf53a72c38f8cb28
SHA1 61b72716b6e405fb209782d52b5a408febdcc233
SHA512 b63b9fa3380d155ccbc92b84aae9422eb98c53dbb782248c9ac62210406475055cb53b9db37e8bf6bdce0e74725484475ff1782fdc52321a84108877680386d0
SSDEEP 384:s3ZAB7OTEXTIrY8nTZoWjdLRWixkt8t8t8t0tstststststststitztztyDGW/W6:s3ZAB7OTEXTIrY8nTZoWjdLRWixkt8tX
TLSH
T13EA212835A50C2E6E66B0774DB975B043B72C48E9358420746CCC27A9D877C83FF9A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 076142b2572c2ad93c530b4af725a91166cad4b0869491b31520a541e743cc30
MD5 d6dcb0a39aacf225422e1de4935eb706
SHA1 2f024fd7f8c4fdebb2c2ac7595c16426e8866807
SHA512 1c7879a5e4e6fa41c311bcf07d4e1837c82e93def4b21df439c123594d8194bbb32d140eb27580048d9de428ee44be32a9f36a532a9a122375fa04e12d47f087
SSDEEP 196608:630Fynya3KC2LSVugnumsxEyalMFyUzV9sBGbi:653KEumsxfayFyaV9Ze
TLSH
T1B9A6BF22B900C032E8D200B296BD9FBB997D5A344B3994E3A7D41DBD59305D33B39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-1a951716f19e4638\RobloxPlayerBeta.dll
Size 20.4MB
SHA256 65bd94d3ba9237393d639ffe289932e0881eb60c47793579a458849aba887f96
MD5 d5c28fd9ac5564234dfffb9c10cbeb17
SHA1 3f558aa2f92609babdea94b04eca542af169d5cc
SHA512 8695a34b0d38665568c312c921d1e623518c710da9b90f6778cdb2a5a550d5e5a50e80e86224862a8ac9c84442e54cfa3878630f76a16d3eab125ef9f576778f
SSDEEP 196608:R6htVkBIKk1cw3MdklcEr+wExO3+3EXJQYr19wSG:2TkBIKvw3MdkPr+wEm+0iI1G
TLSH
T1DF27C04EF9A602A4C5B154B0E16F43E7EB26308C17A82EF706E60260377368D5659F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
MD5 f5b2fd9a39c097322b6cb663cca5b4e8
SHA1 08c113bccec7d3cdf4f6a2b313d1b1421ad62f85
SHA512 490b5c18b55ca136782d2f25e8f8b86a3cc5ae0ad25fda274bfe1a3adc759cbbb8f11592f6e7ad3451b758199e90db482767f4ebae7d93db61d8b90b3f61aae8
SSDEEP 196608:h9Uzqh1cmdDOf+IHFLU/6NW+tiFZJXij:MzqoyS+IHFI/extiFZJXi
TLSH
T139070725BE8B996CD05FC474834B8A720A7570CB0B35B9FF448596392F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 bfff4375f491cb7232a712a4f6b4669672c3f9ab86df84480c0ccb6f1c14d8ec
MD5 488505cf02b709a8613c46c44c8b2661
SHA1 a63744232814350327dd0bf69cc7154b669542dc
SHA512 7cf3d08e180cafa2bc25020886fb75c41a61f3aca42950fa858abf61bbc207edf4fcf2ccb87189b749aca09aead2e301dd6197b871c38b711ce8ac080f4ac4e6
TLSH
T1A641DD4452E1472AE3B9C6347F624722DB3EBC12BDA46F7BC189418D4964100EA7DFBE
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe58e1df.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58e1df.TMP
Size 1KB
SHA256 895481ff451c1c881f7df597e4ac424718e8ceeffb65df8d9e022c247f47e331
MD5 c5c3d0afa084fd415a345f5a9b487651
SHA1 ee987ba0f96f04d92c771e1e685c780f805f85af
SHA512 97cacb920aec51f89fa403ac0191429f4d3834155df69be0f9200651d5f29275a782e4f0277bc668e23fe7ca2e10dfcfed83f47004393c3e11dfa46cfc92d0d5
TLSH
T1F641784452E1472AE3A9C6787E624721DA7EBC12BDA06F6BC189018D4964100EA6DFBE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 7d27e932fd93b5d32eb8bf7129311e900b6422a14712524e39d6b150f3be153a
MD5 b37e5219113bda6591eada279f5d3f10
SHA1 4a70158fef5d0095ab111a8e93a601c19fca6b39
SHA512 d6e17e4cb51fd28278d2ab96d709e8183e4293f751ef96ade100d283aa33804a56b6b35095be447a8cf94c03de5bfc726f23bad5e2018d1036c70d434d6054b2
TLSH
T1DC11474970DA8BC8CFA1CC73FAB40996672E4A3143524F5F12BCD1E1E9D72A185836A0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b8f2c8d464b449eb7a1b8a12794df4baaf29cfed6c6937eee3cc6426ffd1c797
MD5 3f447339b80addbef6eac0212c73c23e
SHA1 5082f7dcd7b59df1cb7402355461ba4f095dbe8e
SHA512 a85f18723015ad051da8086df4ae0e7016bb53dee351efa87cbc31f6585ebfc943f8763dd90a1a06d770b8fd4bc3e330b4b8d4731f7b90043cf30ef91aba79c1
SSDEEP 192:D0ujtqIhJJ5JV+wPaIYBEdlxSqTPtriQiIE0aP+vqfPiNPiNHhlHxcWK:D0ujtqIhJJ5JQwPaIYBEdlxSqTPtOBIJ
TLSH
T1A4E1BAFB83E5C62D891156F4AB15AF2FCE290628431C3C76C8D4BE1793E2472E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 799b6d993fbe45f7e906ac893b55795088578303d6618db8ca50f303072d4347
MD5 c70c6397b1e4484bc4ce1411b1acb36b
SHA1 7d18cd6c6883359200713e19edc78f8b4b1e2e6b
SHA512 c8d62e261ffc4e55e29c0b701b22151978e75e0ae3b5584b72b813671351be2bab08b16c9c12fa27ca4ae9c31888aa36dedefb7de2b3bbd1b391f65ed8899187
SSDEEP 192:DLeOjbOgkJ4J1+EPaIYB3/lxVOTPDLIFiQiIE0aP+vHfP4NPDNHhwHxX8W:DLeOjbOgkJ4JwEPaIYB3/lxVOTPDLI0m
TLSH
T171028DFBC3D9C52D895156F4AB15AF2ECE1D1A28831C3C26C8D8BF0B93E2871D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 974bac0c9afb725349420e26495a7bb2db71dc5f4c7613e850870a364d9b350b
MD5 3c5b2be3af43154d7fb7a918fe8d9370
SHA1 51a2552cc7b6553bcc66b94c56f387b1219ede4e
SHA512 2b514b1b79c4b4b51c27b88bfedb8777d24c4885671aabf6b07c6be301d04195c4827a94c937f83ab5d6784d279ed27fafbd1dbe13dac48747b721f5c70d6481
SSDEEP 192:DLeOjbOgkJ4J1+waIYB3/lxVOTPDLIFiQiIE0aP+vHfP4NPDNHhwHx4K:DLeOjbOgkJ4JwwaIYB3/lxVOTPDLI0BM
TLSH
T1EC028DFBC3D9C52E895156F4AB15AF2ECE1D1A28831C3C26C8D4BF0B93E2871D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 773a189dccd9c1078bb5fa3506bc731ef21e5679ba4aa1d84b649a40c04b687f
MD5 3d6ab9a21951668b1c2188c7d361cf2f
SHA1 4b316271d1e2dc9a3a0796fabc69c35373ffe577
SHA512 c66c2571feca153fb8958eba2eb37e434241487e7340ac1a69665e77164aa217702f32c3a61327be4cd72c87d942bd30a15e0a05e070f7b9a7a80fa8d7f0170c
TLSH
T1A8218F6BD6BFB837102C45BB5D04FC0A9DB2A83942826CF8DE67912EF0858E31717472
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d162a26228d42935ae2653e44ed30ab2778c0a115af3782d4c2671241b151850
MD5 df10c8629a2bc6855933b4b6b79b6ff6
SHA1 0d2e93841e49154661da0820c36a6de35b8a639a
SHA512 13aa34491bf6a7370050ec733e412c1b7394aa70e8f3173685d711a0a538b07797d77ec254d77454a6d7c325843b48d91d5ffdd6430a21e4e31754e36541a850
SSDEEP 192:vR9cBzzHrw9sIv70pAPRp2dAG7B9+Hsb+WNT0JX47Z2ISCxjraYAVyIsnAUgtaJ:vR9mzzjUgUXm8wqK2IxxPaX8
TLSH
T12952C72EAA10697BACDED32AF9617727D3F6102125D51E84E7FC8B1C06D75CC221705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e7431c4c8e64ad4d39e4d246c88f9163cd5e2e6b02bf0c43c9299083600e3fba
MD5 172ebfda74ba28f74c92594d4875d1e5
SHA1 572df382e50116db787c25bee48622a21b3b0869
SHA512 dee7188b08ea8f99809d1d57828bcba67eb7c998a01d2706ed47423d35b1d9f641dc03f87ac56cbbc1b28cf01d9818789f4769d7c8e2a1e4699e540a1578773c
SSDEEP 192:vR9cBzzHrw9sHv70pAPRp2dAG7B9+Hsb+WNT0JX47Z2HSCxjraYAVyIsnAUgtaJ:vR9mzzjPgUXm8wqK2HxxPaX8
TLSH
T14B52D72EAA106A7BACDED326F9617723D3F6102125D51E44E7FC8B1C06D79CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a54fad04a1ddf3aeee922f35a637aca1c11a38c26fa7c602cdf86c55743afee9
MD5 11b06d93766498db365bdd8ca344ecde
SHA1 49ec312a76ee95a083338e5a8bf53ddcf187d150
SHA512 d723dd0ca3e9eac05f176555f247379f5fba7d8ac8d537583c2739eb8aa08f26c2aa94802c28ef11bcbe0df0f787e0ebb2e4d61f8c32eef278f52bf677ebee23
SSDEEP 192:vR9cBzzHrw9sAv70ppPRpmdAG7B9+Hsb+WNT0JX47Z2JSCxjraYgVyIsnAUgraJ:vR9mzzjcgLXW8wqK2JxxPaFe
TLSH
T10A52C72EA9106A7BACDED32AF9617B23D3F5102125D11E44E7FC8B1C16E7ACC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c356b360128ef0f1515a9eb764c17cfbd92e54d403c2e8f72cc9777d5393b44f
MD5 eb1dcbd41a8b36102b467e82cd66b8d3
SHA1 b49289b24a2e41aaee3e428d954bfe440921ee00
SHA512 87bc11125deafaaaec352338993d5e31f6ec58c8e67841e922caecba495ef3ad4083651816a567f9dbe0c855fc42e0dba30a4b14ba2790a1c41c47d49326f622
SSDEEP 192:vR9cBzzHrw9syv70ppPRpmdAG7B9+Hsb+WNT0JX47ZDEE2ASCxjraYgVyIsnAUge:vR9mzzjegLXW8wqK72AxxPaFe
TLSH
T10752C62EA9105A7BACDED32AF9617727D3F5102225D11E84E7FC8B1C16E7ACC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2345e8b390849383f760838cfcb64c9344a6fa35930a183e0afd4abe2702ced3
MD5 e4cf8252004cc88472a7d8e0ee20b1fa
SHA1 47bf1aba612b18a9ff57f3bf67eff7804d70cd86
SHA512 63cbafc43a595cb13d6ff7c444e64c15ffbec4d8ebc91acf581538015f1dd4d59c018934e16312539eb8b32e5e63b40832cb8c34dcd11232817f647be63c208e
SSDEEP 192:vR9cBzzxrw9syv70ppPRpmdAG7B9+Hsb+WNT0JX47ZDEE2ASCxjraYgVyIsnAUge:vR9mzz5egLXW8wqK72AxxPaFe
TLSH
T1D262C72EA9105A7BACDED32AF9617727D3F5102125D11E84E7FC8B1C16E7ACC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eda9f5824c80a216b5526fb1226e2a70bee20c3dddcf70901902a1867bd921ee
MD5 0626281922b7762d201a8b5f810d6ad1
SHA1 b6c85b5f6f3e56bbafa66da4a1913277e3e51f86
SHA512 d98f783e2e1977556d654116be15e10a6a7b1668e1ab68e3adc098ca6157ac791666931107721aa239dc018e62d064e65826c176cb3f9345a723298db43e1b48
SSDEEP 192:vR9cBzPHrw9sIv70pAPRp2dAGU9+Hsb+WNnJX47Z2ISCxjraYAVyIsnAUgtaJ:vR9mzPjUgUXD8wlK2IxxPaX8
TLSH
T14F52C72EAA10697BACDED32AFD617723D3F6102125D51E84E7FC8A1C06E75CC222705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6d5188ff99d750a7ccbc7ddc689b4c74a668e79804eff89f18b392f816f3f3f4
MD5 588f1dc17a045c61defcc6c1b0f6e560
SHA1 7fc9971635aa1161cb9681241581e0f26169eda8
SHA512 cbcb3df33601ea77093fad5a532b796ae738763e103adc85e59b883db853e4761899176396d43b87578b84a38dea4e482b45cb1046838c4383ab3bf57bb0922a
TLSH
T121B012018041A152C44202B011D224AC725C6F20970A2701C3E46A23CC365618015090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ed73.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ed73.TMP
Size 96B
SHA256 38f3f4a1123380b6042d290b54a494c06bf926eb99e78397871b0d6174a18929
MD5 80c25727f0f25af31e1a59f42d4d0688
SHA1 7d25a7b3a39515406d81cf8bd657fc1c7e52d65c
SHA512 4bf33ae394caeb9f3ee06b11c9687d02b26f74022eb429d0e2f41c336b37e3b5021cf62b5bb2ab9294ad6e787c1ae6d9df88513511c6cca656c355bfb7120972
TLSH
T10CB00265C102A352C44347B025BA96DC7160EF3DC603535292F11AB6ECE6AF28929164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 13ab923b4bd69edcc6d0e04d2b302e2bea53799c4a119c481db828cd0db6dbcc
MD5 99ba9d05d2e939c75d03382b370c69d6
SHA1 aad3d1576808ab2bc5f660e13502034a1cdfa0e1
SHA512 5293c2cc444ebfd705f393abbf8dea0a34dc3f61f92a74393b25905f5809e252e583156784f3f7b1b168335e741b9c88a5253bda7869ebcf9a2b1ee58dafca0e
TLSH
T1AAA0021035C00949C88002F0169211C52720686317078A174691525899A32434941201
MD5 SHA1 SHA512 TLSH

Submit Download

b21dda80-db8d-43d5-9678-50d135de28bf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b21dda80-db8d-43d5-9678-50d135de28bf.tmp
Size 414B
SHA256 54c4a89656fb37b431adb0362d3425366cfa3f95e3976d29c58f24227ee23e87
MD5 7e903cc862602db90e3fd536451ec545
SHA1 0d0e7f12ef08eedd6207bdee83baa8ca633130eb
SHA512 4ca613ce86b5f3d41b94c50a3a9b14dd80282bdb390a11ad61aa91553eaddf096cac8b577c440411856fbb69fbbc2b3cf8d871118597e548e62e45d3c3a92237
TLSH
T1A3E02B65C861ED3718FD0719A0601786D764135B3A44895FBB3CC10C8FB1A3B89D6C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 eec88ff0d60e444b8269f920b50389e0245bb9f519f6f6a7cde6c1d71301a372
MD5 5f4c988fe8bd04fb5829d493ad4890fb
SHA1 1a9d30b200832ebaa7952997b17df19e1467dce5
SHA512 7907418c4c0f5f9510779a82e1eb564c46c50058c8d11d2428c02733fc323f465b6d14b7bf80e4f99d1073f3040c0572e0a4b5c9ea8c77979641af012ce25c4a
SSDEEP 3072:1z1Y9+3TL3EykL7LLsOEupeJj0ZUly+ZaHCiFqfd7NtZL8cHQRZEQ6Spse:nY2WL7LAd0ZqyPvFqZ/ZLW3Exe
TLSH
T17D341233EBD61D3A5867CF3479420ECA4EF6489184BCC385BBA43FDBB8874513982569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 4fe385ff728452b5807e7c754e036de2992274e20d48a9c241e14526167b0ab4
MD5 ffa59745f086ea5cb2b1531236e35ac1
SHA1 20d753f351bd520a896317c8785d611ede266b89
SHA512 ec97ff9f0d0438c84ee7ee3038ab6a95f9246d5fe92a608cc7498c4cecb246c078bf1752c65374e57e4c378cf7f067aa5dd8d3ab4eca2c7d0803b31612aaf081
SSDEEP 3072:az1Y9+3TL3EykL7LLsOEupeJj0ZUly+ZaHCiFqfd7NtZL8cHQRZEQ6Spse:WY2WL7LAd0ZqyPvFqZ/ZLW3Exe
TLSH
T14B341233EBD61D3A5867CF3479421ECA4EF6489184BCC385BBA43FDBB8874413982569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a7f98095f2bcae8555eea4af622e74410d32e7d4eb065eedbbdfda96b08c0688
MD5 5d39b0c28dfb06e3083c3bd10fd71e73
SHA1 a939b8ddd3d53241db08e09aca19121951a130eb
SHA512 c6c0cc16e42200744120ecbfb56cec5d62c33271218730e3ca3d4e915484225c82ffffc4f359b3b50648268c79daf7f5a81d41162376982d4cdd24f0e6d0ee7a
SSDEEP 3072:981Y9+3TL3EykL7LLsOEupeJj0ZUly+ZaHCiFqfd7NtZL8cHQRZEQ6Spse:9qY2WL7LAd0ZqyPvFqZ/ZLW3Exe
TLSH
T1E8341233EBD1183A1867CF6479421ECA4EF64892C978D789BFA43FCB78874507D82469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e02417706530f62ecd5fdd9f54f78fa12f31e8f96f5d1e1f83e0977517cd0e88
MD5 0dacc70036d45d4d217d70f05f892d9b
SHA1 c127067b03e5a404614dcba05d89ac182b7a74a7
SHA512 25250e3be8395b87c2aa098b1eee3b5c73d69833dd891d3b4d976dc7870c554d248ef080847f9008620e2cd1f052783281ce26e3d405ae43d3cea7baedc99bd9
SSDEEP 1536:bSLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:+qfd7NtZL8cHQRZEQ6Sps3
TLSH
T1BBC30237EBC21F339D92CF64B9530FD6A7B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 493491bc67d08aaa9d082ed2c6d21d1f682937af6e3fd9c0ef6f35a093f6cc81
MD5 df12b292c48a6ec7cf43b2cf7e9e9f90
SHA1 57307253066e77bfcd66c2ab00b8b4a8032eb277
SHA512 6acc12bfd7db89217cf188c1998fc8e5096f4f6454ed8c48db9ca2063bd81f2be2dc841aec7fea00ec1ab27389c2dcb4b041542604cc53e94aafdf7cf7476bd3
SSDEEP 3072:mm1Y9+3TL3EykL7LLsOEupeJj0ZUly+ZaHCiFqfd7NtZL8cHQRZEQ6Spse:mIY2WL7LAd0ZqyPvFqZ/ZLW3Exe
TLSH
T120341233ABD1183A1867CF6079421ECA4EF64892C978D789BFA43FCB78874503D82469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 9ff943692a4504626eefb1499a79ea8fbd24b63afae60be82b501972ab90bc62
MD5 06e7468efcfc551279da5b60f5a6a8e0
SHA1 9121e92a7063d41dae7dafd030853c746b1c4d8b
SHA512 e7352cbb93a3755b267600e758872e9c5b4a46d454065bacde025cf0750914e0edade9b352a2b742a66023bc881df8d7f868b8e56a9fa5d08063cc608a0e6146
SSDEEP 3072:x81Y9+3TL3EykL7LLsOEupeJj0ZUly+ZaHCiFqfd7NtZL8cHQRZEQ6Spse:xqY2WL7LAd0ZqyPvFqZ/ZLW3Exe
TLSH
T10D341233EBD1183A1867CF6079421ECA4EF64892C978D789BFA43FCB78874507D82469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9E10.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9E10.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 00689d7f7ad6d38127b1ed3e422358a62d442a38218fd572be44c835e2d486f8
MD5 ba95cb6ac29ec773b4b1e353634b6669
SHA1 451e42fadfd56b5d682b524d582feac877fac355
SHA512 87878d83262d3cf9ebd83571ef5790e659f6a1eff37c5ffbdf8c60714ad093db09b027c51a62bcb5f5e5a633de19393e494429c37abaa084b6b83f60f4b67e5a
TLSH
T17FD012123702C134C03121331103710C1840D10F800980009438D57D5B4C07C1A02451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 288aed161e6de5874d3784c70e8fd166b8cf8a51d25245ea593045de87784fa2
MD5 bb26b1562fa3c612f290bdeab15d56ba
SHA1 c79b866ef97b38ad8dc4288b2f350dca04a7302e
SHA512 0ec90981a1ef5f3ddfac93ec24ec43ab0d31c5f2766181cfbf863f04448965ad54e534edf998abdbb46f72dbf416cda1e952778f9ba05dae19cd59989e832f6b
TLSH
T177D004505701D000D17351311115711455405445540551004070507447CC13C1101014
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b7b876bf5a1304cc5260ae0537529c80ba5e0df76f90dddd019af486e4f14aa2
MD5 cef8c7f19513650c47eec2ed0f11cfd0
SHA1 45a7e48fe627e6681eef111a458892d6fffa73de
SHA512 dcfe79ce21b11dbec1fc43b49ad94b2acee0a3a01085893467c6af14797a34fe20bc7ab88c24a39203dc6c04c6a82bc96bc2ba87c8f7c7e6b1aff9dbc8fc31da
TLSH
T160D08C12A3118229D02070720242F1282A01B20F600680159438866C9B4C0AE0B818A1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5aa62207fd930e3033d5720dddb4daa9059782a1b6bcdc7bf1564297eef41540
MD5 34bc73d88a295da38c04888820ba8e96
SHA1 2e34e9ddfb065280792ab46a537fe9450bf970c8
SHA512 cc64f6e86a9afc2f776dcd55157cd2d4e3379b9668850f20ad2a5e1258b0f3811344cdef1c8db9f5722e72238005ea69ab1ab04b697c300d69c4fec38def2012
TLSH
T10FD012A6B711963AD26034721182E5292A41620B3496812A983886BC5AAC89F57954E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 88fd680d3e9679c49c2221f357c0ae784c09069e7fd46ae15f2658e8e8593cca
MD5 d9b069590c96479134b12c95a6d163f4
SHA1 ac6a45496362b2ab16c4dbf9f9d87b93fb8bfb96
SHA512 aa008ca22ec1e0856af51462152d40912fc76019d0042b823af062867f1e36e11229d9ea93c9bd22812f5f3baa729f7fc38c91bb0a928b5c1f802883b78570cf
TLSH
T12FD012A6B711A63AD26034711141E5292B41610A3496812A983886BC5EAD89F57954E5
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d868cf40f7735c0bdc3e7c225a0d2f5644458deb35988474591501f7f8691767
MD5 bf28a98c05fed198cfeeb44a94e682ab
SHA1 778739012c1d6ddcc02d8e630e2bc5610108e597
SHA512 4bce71f0bd95e40d53b4fb1b6f472b6616063a913ebf7989b07762f62bb9671cd2a2122a6577259c1c74b7ab75d1eb2567a16a84dff4e31f7dca791ab6a5c907
SSDEEP 12:d8Fkq9NolGxenCemdOwTw/FePSnQYrj/bKNE:dYK+enQdOt/uSQYrj/bKN
TLSH
T1D41326FE9094EED9E5E0027C000B43B00371CB82EA1287370A78709510E978A641CC0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ec9d3ff1ef654edf35cdcbf028e1e9a5b0d463cd67a1f1129c2d4e8b69641efa
MD5 c8e98832f576beb94e483e384944aa24
SHA1 13cdda54c1f9e6a4f645171cedde689a0bbb5155
SHA512 58401c62a49cc571503efa7d4d365bea006b551d4734bf4418f88f181b03063255209a5946c125422af60e6649712c783755d6860afb8dbd9f57fa1dda3d963c
SSDEEP 48:0LBOl2ugs+1aIoSJwwNJ2IUuLCvLju534Go:aY8wIoSJjUuLe
TLSH
T169449BFF1B02D055CB5446F1488D6D3E963B41ACBCFDF6A6FDA488A484E32DC126121C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 27534b30ae0d4eb8a45f29f76906ef8f23478f80d185c64f6babd9dddae93d17
MD5 6fe90fe44587a0b055799ef57fe47159
SHA1 a5bb9107b78aea147d8c57888bff394924d1b30a
SHA512 6df6a132ee71ea20e07b921071fe2a45420e9369c8997082fa7c806d8e41edc9068ca45914815c48298968e997bebd21bf99aec9fa58b450cf8bbc6cec9c616a
SSDEEP 24:WTNvAfMAM50rCnPs/EWsoAh59Q7hMrXvjVYPB4OSGOq/wzzlGgp7Znc:MV5Ps/OoKP7vjVJoq57Znc
TLSH
T10325E92017901F13E154E47217C7CF0E59497D48394631A1A84000B8D89F58D9BB071C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4e5eb470d126f855b87bf98b71120e05fcbfcbf8d267bb5f7d5478d25be3f760
MD5 375b2281c6391fc7ce086c2f5618bf1e
SHA1 d70e4574f4c690a95051fdaac345c4106206f29e
SHA512 d81c89613e506b89950060675a013bef0415c8653f418bfa2d8eed74df642a32da9958ef8629e48e2b1295eb933f193bc8845affa6798d2db595f3d8ec589f92
SSDEEP 768:/JBggiIKN7gpgLXBvLG9zAAUgz6R7g66TuGeT7gZd9Jo3VN7g:xB1iICykKnrz6R7l6A76y
TLSH
T1E116AEE74F3CB942E952DEB07BD9FD2D3D714742B88698D3A50782E868D4BC05AC240E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\f_000001
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\f_000002
Size 150KB
SHA256 fd6e8c368e2e4b7dd1c577c569f2bb46018e820d5becb78eb7310195b831d4f5
MD5 5ecd16a4f348633788b83818a3c8dfc6
SHA1 f85393037579ce195708ea7366d29048bd5592bd
SHA512 8cea5141296400126c07c5b59a40fe730ddeba4cff75019d64dd070b2dc94d40591f14e8e635f4c507ae119c7a9b691c97837361fc8d2476c2c1a04b15608ace
SSDEEP 3072:LuxLunRbQ/c+++j7azB1v6tb5r9U9PKyBAkkO6H2dH1tCmJC9A1S:6xLunRbkV+Gazf6BA9PKyI4HrCmJC9A8
TLSH
T1F2E3127ACBEB909926E3BD14B10C24EE115104BF5C7D0CCD430B1E15B96BBA8E69A1CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 e770adbb77d59741930d4719c86638f0e64192944b12aec1e2b0a127f1b27871
MD5 fad3e9591b75954537ad2e286cb160a4
SHA1 94947e8170d6a0aeeef8ecfba17127e12a6cf569
SHA512 7938984a3bb3e130b7c2058437895e26d7c25abe6d383041815c14cb65698716364e7644cc700a97861436fd531ff32ae0849acb1b9dcb82d7a8d32c8417207f
SSDEEP 3:LsPlklNllkll/lHWUTm/W11nvlXlJlWNtl3Nl/lAle/laNtlIlXlvl//l:Lsy3lEtHWU+NHmN4
TLSH
T17C44112A23880C2AC8C082BF808383232338E880C20F8B032B0A02002CC2B282E8C280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 cad8d0b2bcd170ffb614d1913579160323d40a73f6bcef075dacb671ea0e7ee5
MD5 4e631f2e3afbbde79a7cc9b524a63b9f
SHA1 e1a79ccdb4bbf9af58f1c8d6a3c1ee964981bf29
SHA512 8370b2bd172b4f5d0b18bf79691ea6f3c4f12224c76f7d6b41d4ab9d910f448f461fc1495e25a65cfb9000c1c5d69780137b8171ba6460845e05a9fbc24bc7de
TLSH
T111C09B51C5495FE4C7055673F5D264447F7728A922430D7973B8449560F1255414A114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 68098fe4faf2f2b3d8261c824224e2aa69344f2add726fe2fd8b69599f2f78a4
MD5 d8b3eb4ba0cde2c5e32ab2fea49ba2ed
SHA1 c6ad7e05716a95e104552a077dd7803c9bdcbe76
SHA512 da29faa2ffe78608c0261a6518b86a8060176994c4a3ed0a9cd3748cff0c9e79ef9d42bb599d0f90bf1eb4eea28c6d9ff6692def7aed94fd38d2509f96bb51bf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 972add6c6ff4122489869395ed6229ab60f396b3d603b042cecd6858b0dd9c03
MD5 f083342fb062bcfa79913cea659f3c02
SHA1 9e34776e842a010939726cc23c0bae139e27d8f1
SHA512 598e9e6321e0acd337340e0894fc94d8a5a58c689e745618596895f07d261a5673ea3c55aa0f58c093eab337ab2c9a64905fcb8191b868cdef29209663c3f863
TLSH
T1BAD01290D381A7E0CB0D4D7565801064BBFD64E055C71E65E2790C6468F13555107665
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 1c3574bc6f39fc37f53dd222da29713b9d715d2410c92d993516001dbdb53216
MD5 d1c46855b7c5a10c339790c8b6456d8d
SHA1 7562b29a012eb3d84e825d2bf4f10d193d029c4a
SHA512 2502dc6e5e3b5e9928630891d7d0ff45823cdf1a3f00299e8353caacad23a9a05440bb43ef89fdc1a7754a27660853a8c585ab2ef8c95d4e8fa3b2d5d3effb84
SSDEEP 3:LstlNllkll/lGQl/:LsX3lEtGQl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\History
Size 184KB
SHA256 83c035064713d370fdfff53a1800efd9c9bb59f2f21d019b7f97585777dc6882
MD5 9566263baf849442fd7b1e1a4d640a12
SHA1 52ea2d39283db3aabef5004eea0e95f3ddb906c9
SHA512 810ec08966f30ec2f24be07cfb4779dfccc05939b678caae110a3732eac60900535150cd16d149ff73e328d18cf4088a1133ae0e1e01ab6e10a6f9e901e92733
SSDEEP 96:Bk6gU2gejzH+bF+UIYysX0fxQp97+EHt/DfLjLqL/JribgI4VgNr2jWRk/E0M:Bk3PH+bF+UI3iWGV+WN3qL/nVgZQW3N
TLSH
T1E4040C5E5F243612CDBD517B68E645B3587DF03F8B236AC66C6204B1CEE2652B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22073c41-348c-4029-ae69-80963a3c8b7e.tmp

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\22073c41-348c-4029-ae69-80963a3c8b7e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 14f52fcba76e2aad8b1eeb7aa0d08ed4161fdd7fc310e98d73416ab57292f032
MD5 cc9e3398d487a065d29635c16f1adeb7
SHA1 bd2ad3370be4b23ab6f152027e667ad963bd00ac
SHA512 90a5fbdb4a33edc6cfdf831741637d6dd610111b8573217eab602fe9042ccd37b5038305265bbcca97c9eef2049977bde7fb7884784d6eedbec3d7c866bd2d54
TLSH
T17D518ABB86E486AEC95152F96A203D1ACF1D091C8BB83D6EC9D5EF8B63D1470D30424E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 45a59eee87482869a44eb62d64a56f21cdb7a26232ecb809c427c03d5c8cb228
MD5 dc1a001411025fb24cf3658c06f9f75c
SHA1 3b87c96b527fc0d33ec08a98c145c3825915e3a1
SHA512 a1382197be84c89e1cf388d1cce948ce973a2b4fc7c2d335b128123b298882ea21833954068aed19f07ab87bd83c6b23a6888304b0cb98cc5c4c29505f5b68bb
TLSH
T15B5189BB86E485ADC96152F96A203D1BCF1D091C86BC3D6D89D5EFCB63D1470D30424E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a31df.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5a31df.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity
Size 1024B
SHA256 d1a1b068def20b52fe6e14034955e2526dfedd43fbffb85a149b4bdcddc23284
MD5 a8ccb1a5d76d38414003e0ecdc2c9133
SHA1 c277a7558ca77eebc04aa9abf3e20ff6d356ebfc
SHA512 c62fe8edca56cc62d4856a7f958c5d2290388fbe58e2c0a86929264020d36647f5692a682545051fa00d7c1cb356b1dd5458349aa95c51dc60d0623dc246f9e4
TLSH
T101115C97917EF93B20181D7B0D84BC1599BEB039025358FCED66C13CB0A59B71616032
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 7KB
SHA256 45f763bb8324bc8d9516f0c51f3fb453f5929f8e9cb220699be7bf8c2deece7a
MD5 e1307df43be9533758f7f15d43b83681
SHA1 d9db7c899748cddb4e7146e4143805feca5ff9b5
SHA512 ac450134e370a5fd7420db5acfca27cbf510a5295ac0801520aa51f6bc6ab80251e2a41a501764fb7f1d4f2ff69610bedbd1502bdd0c17f6319bcb31fd444a36
SSDEEP 192:stD00BfmZ8paox/S+Wi7w/UgWYc9LRasvRKC:stI0BZb/VAW5YC
TLSH
T198F1B753AE24A9775CC7F6197A75BB12E2F6102262D10E54EBFC8B0C05D7ADC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 7KB
SHA256 cffb9c77a10ece27d275a0d82ff587ac57b22e52b979e635af06f51be73026e3
MD5 fdae88d8cad7773c2ff9efcfb1c2888c
SHA1 052159c8233a16cd828daa6742dbc57e63ac940e
SHA512 ecd08d5deb0acc39408bbb5842e8ed1295e568f66f7943f9207be3a5d3169962b0fc8923257afe67fb3b37714c30560c6ab4f7a0a311269ce0c4f9e3e5d196ec
SSDEEP 192:stD00kfmZ8paVh/S+Wi72P8IYVBWeRxv8MC:stI0kZc/VNIwjlC
TLSH
T14EF1B9539E24A97B5CC7F7197A75BB22D2F6102266D10E44EBFC8B0C05D7ADC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 6KB
SHA256 1632c850b31c7000926e38fdc31eef97568924a9a306c773a4d53c0cb37e9b04
MD5 2188a2f4a12f4156a868437ca57a7b56
SHA1 2ddbf65f436ad416b20f5b9299742b788222ed55
SHA512 63a626d0cff70b5272fa899570ffcb87bf75614c491f365257b221d6b36c35ddf9f0b579685e10edb1cdb5277e63b9cff8a3596e2f16300022d4164aebf9eab9
SSDEEP 96:stD05Se7Bb9YffJZ8i0vhEakU4m/7qx+WVHMSm+uecpr2SMFHYzG/AG/LQjk+gUj:stD00BfhZ8paox/S+Wi7rhqYc9LRQBMC
TLSH
T104E1B8139E286D775CC7F7197A39BB12E2F6102261D50E54EBFC8B0C05D6ADC624780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 7KB
SHA256 b334e7973dc600aab2cc5300ff008ad4c86cdbde446dc8f93a9c269d61bb8b2d
MD5 472f3c3da98300f96bf94eb3c94b7222
SHA1 ef59d25645aa4fafee807ac51c52cdeda7b530fb
SHA512 e3d7396ed13051bb3fbaa148224fdee711227b749d2b6d2e11d0d31a9977f35de041f51378f937e2cbd5389989527de196a32b03047c69bb5f9901f56929002e
SSDEEP 192:stD00kfjZ8paVh/S+Wi7RO8oYVBWeR0T7KC:stI0kic/VZowqSC
TLSH
T131F1A8579E24A97B4CC7E71DBA75BB22D2FA102265D11E44EBFC8B0C05D76DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe599ed6.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences~RFe599ed6.TMP
Size 6KB
SHA256 647d206a50866c5f3f59dd1a56e2f459887060bd3b818d85f9c33af830cabdd7
MD5 c74e63f02a76be8ed09c27a2d4f50292
SHA1 98534062fbb75822970c32ba48bdbbbc7ceba3c8
SHA512 fa6c5d5e9d1b46e12f34dde8ebf080428d0d3a4993cae758312db3df60f7fd29201ec2821ce4015ff164b8b8290481e643ccf49cbbee66d0f3f3a178b953e4e2
SSDEEP 96:stD05Se7Bb9AffJZ8i0vhEakU4m/7qx+WVHMSm+uecpNkS1iYzG/AG/LQjk+gFBx:stD00pfhZ8paox/S+Wi7NLwYc9LRPBM8
TLSH
T12DE1B713AE34A9774CC7F3197A79FB16D2F6102265D50E94EBFC860C05D6ADC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 902733163f76b9e8047797814f780135f4267d69665611bd8a9cb5330a72ca24
MD5 040ed3ec4f7f0853b29d90cd58bde68c
SHA1 cea7e2cf2a53190b5e278de0e4b1a04a86863b81
SHA512 f9ca81fcd0f0bd1bae85c7f56df7ed0df761f0c14f7f6616bf7599ff21cfd76cf2b9ab123ec63d60e126d676a4f8409b36d1a62a59dd3e61c1c6ca84bf7010de
SSDEEP 96:Hl8iMPlf/ROoKOpkF5d18i57sMaTEv9V5h5pg5+eeCKQrZOuOYHB0CC+j0YT:Hb4WGYp9lmlJOU0CjJ
TLSH
T12DD1C8A7456DC538AF449AEEEC397ECAC9B600CF99D64C1597E2C5480BC2FFC20D9485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 df7e83703a6f0cc643f391c30babab304f2016f9a713d3033f8c4a38751dd2c9
MD5 67783ca80d93426129c4cae8c056e7ec
SHA1 f43ba4ccdc0eef185253c9e7f7441e5b7ebd32a6
SHA512 47d164fb5dccc4f1d57a3aa749c7acffeb735441a1743ee1c068233228d8e596a3615a15428a19120df36be65ed219aa9386280608540fdccfcc943cdee90cf0
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 1KB
SHA256 589d2433361ea62a14d5cddcbfe342a74d3e14498b7ba4a29ef564ebed982ed0
MD5 2695562bffc4226757f559b25e409527
SHA1 20b9f02cc3fe580820e05f9a37255358290ff7ae
SHA512 0a7b77e84514af8b4d20f335b5ac35d50467c56d70f7efbd9020f804cd2cbd5c1c4c97f73fb9c2b35b43694c57e8a77184b98463393621fc94b0843568d14952
TLSH
T1EE3142B3D8955B377C82A64AB1996A572E306179C2118E4451DD4B1C02E76CCB7BBC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 ad77ae5f24cdeb91318cb0f0d87c4be6b5a87ba2a44babcbee7c25fc4c99bddd
MD5 a2b1e50491e10f9ca9458d1b9842442c
SHA1 f8b26fe9071f98c8667b786f3dc53132671072e8
SHA512 fe4055de567631df4c5adcac399f6df566a65b7bcaf03e74181aa3c487811b11adaba16a1bc5e10e0c88ffd9d9899b9d82f37da7333dfdfdff4c9a221c4421d2
TLSH
T1EF519473E8449A379DD39A48B59A3F139E3161B5DA621F5095DC0B0C02DBA8C3397C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 7bfef3d32984ae7c89f99063f9eccf6ca33739b2864ba4272bb0e5d8994316b4
MD5 a13c0fdee5664975f0c45f09f9ca99b0
SHA1 87a6a427a9a78f4b69754f72eda005612761d82b
SHA512 52a199e1f5de2225b73a7097bc6854294294ab4e1ae02b81d3aeb59fa19b325ef7a43ec4f1340da4101518ac90219a6a38c43bba823085597a7171d976642638
SSDEEP 384:z8srv+89zHqlDNP9oidzNblEMp3uLjALUNh:7rv+4UNbdFYLjAwNh
TLSH
T190729D33E57897376DF2E948B08A2A0B7F7461A691C20BA4D9D90F8E42DF4CD2346D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 5ca3224956020ba8834f0002e96e9085eeafb2e172e31598d490f978232a74ef
MD5 a8e7da5a688f0bb628af2637e3ebc96d
SHA1 57c4632bc0ada5409cd8bfa6d389a6fb89e8762b
SHA512 3d2209b6593101622da02a9dfb23875b73314809732a419ae14043967b3d2a2cc97257f5f12e1794a2b1c9160bde5f59efbf7371000aa78048570be3149eee99
SSDEEP 384:zzsrv+89zHqlDNP9oidENbUEMp3uLjALUNh:0rv+4UNbdhYLjAwNh
TLSH
T121729D33E56897336CF3E548B08A2A077F7461AA91C20BA4D5D90F8D42DF5CD2346D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 17KB
SHA256 7791addbbbe3e1dae1cb490a3a5ec14fc27e1ae4f344cf9fb97aacafbe09d2b0
MD5 534988bf9399bb8b59993138ae7a4c51
SHA1 3ab9f94a9f7f21e6d6ff06f39fc3497ecc43eb7b
SHA512 4808ddd045245329502040ee44b197b6cf3f2dfae20a0d04fb6fcb6d809ea2466c4b287ad3571790a04b9b9613effe16a9385c4088935377722b50ef4d8869b1
SSDEEP 384:zZsrv+89zHqlDNP9oidENgUEMp30znVaLjALUNh:Srv+4UNbd0GjVaLjAwNh
TLSH
T127828D32E468D7376CF39684B14B7A0BBBB0615696C60BD4C9D91F8D42CB5CE270BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 033c050e8b014506a78fbffef89fc715209e73da87c1b60b57c2ff1e70485fa3
MD5 ad31fd586caf7a446ddc22c1f86541bf
SHA1 373876b6528e7bdaba95a010b3eef6ef87f6255a
SHA512 147512c2c3e76be391b50fad99523efb61f6c5490ea1734d4bbfa41f51fe49176acbdf34a0dedbe8f63c23fbd7af6950803eceec3f6a592276c58512224c6127
TLSH
T101719577A9A4D9375DE3DA08B4C92B16BAA15136D6952FA4C5EC0F0C02DB7CC2392C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 17KB
SHA256 8b5be1c2aaed96d30ad79a70d74de6f35190535651ef73cf6e019a19719dac27
MD5 ea94cca6e0c8188a42cc7b2e892820d4
SHA1 cc33ccaf3a7da1b5ad8f716c549060736e8011ec
SHA512 21dd83f06d0fd40e04a66820b70dd4c059976cad844bed033333def373e622f8a89197bc7812f0c5a0d7872d665e9227d373ab98dba4ea57045ae010b972128f
SSDEEP 384:zjsrv+89zHqlDNP9oidZ3NgUEcp30znVaNjALUNh:crv+4UNbdZDGjVaNjAwNh
TLSH
T1B0827C32E868D7336CF3D684B14A7A0BBBB0615652C60BD4C8D91F8D428B5CE270BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 18KB
SHA256 da0910fc392eb1938f613a0a56ea58d207924b81e74c34c708db80d6d9702fb2
MD5 7344a992c3a7a19f4900a1cb58d9e12f
SHA1 5186e92f23febae89115f2af1e0e12c238686276
SHA512 abe41dc1a960d5ad66ac5ca3f1601044801bc946b96dab1f91006d2f46da67ec31ad08676a9252e88949d01ca61af3364337621bdbaa05963f11cc7079785a15
SSDEEP 384:zBsrv+89zHqlDNP9oidbNgU9fp30znVL1jAL4ukDzUNu:irv+4UNbdtGjVL1jA7Nu
TLSH
T103828D36E868D7336CF39584B15A7A0B7FB4525296C60EE4C8D81F8E42CB5CE274BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58fff6.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe58fff6.TMP
Size 1KB
SHA256 910b691164bef4ca573af52d54f02e984e2da74fa36169029e6966f2b93165b2
MD5 1ffe68fc4ecc706beca773fffc4c23cf
SHA1 b01e7894e625d03e08639a822ebd774fcb4e3673
SHA512 ea6bd8ae4dbe070318e009cc4c51d80c6f193cf5c3296add6584f231a1cabf463c1bfaf78f9bc2e5e48095775668fcd9b459f3f34d8df416718ba560c879d3a8
TLSH
T15C2162B3C8D51A37BC82994DF1967A872E606279C2258F0891DD071C02E79CCA7B7C33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 0197ffcdc9e1c49fff83dc61d37b6b282814839ec1fae08e71b80b1a1903727e
MD5 9139447dde587f8534cf1a15f8fe4e71
SHA1 3dd09ec1f5dc8227c4c592a24daab4fac09c5331
SHA512 77dc6f88698b3908a160524bc63c6620dcde871e711f69efed4f3a2d6294adf07e6531b84a32f5ce8f22c8e7483ecbbfb74c72429afff4e3c5db034a2878bacc
SSDEEP 3:MsEllllkEthXllkl2zElNX:/M/xT02zWX
TLSH
T1434404047FC00DC5CD0010304011C3500371D7100511F743357154135CCF5C40C00050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\ShaderCache\index
Size 256KB
SHA256 13ad6a4f432052d4ff5f7bd1768cc8b7032178e22087fc678de97b40e2ede52c
MD5 8d75e88d250dd064d346ed519059fe82
SHA1 c20e7d0f3b967c023874acbc5cae3778bd2fa806
SHA512 49cdab8867c50557c2e69f29a6efe5d7c5aa747706a0a93f43e7feff119cf66192e2b8ca34fd2aec7e06d8ed92119c02666621d559a62fc579d745324dbc4f77
SSDEEP 3:LsOllllklkXlGI3t:LsUlPGId
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

WRD.dll

Path C:\Users\Admin\Documents\jjsploit\WRD.dll
Size 2.2MB
SHA256 ee838bf97d5f2557941c16694f6448fe9482a58ff7da5654994e08800c274059
MD5 8fc6d54a5d4d724a1a083c65b2129e9c
SHA1 783af49914a011f4361bb42f14871081c18641ef
SHA512 0ba5742eb8c9026f0903f55f1b2d2c90e9d06336cd6096b3ff9bd595d701c6a6c83cc182f4394c013ab52a20b269d6e2171a02a92fb90aaf7c98a1adf592ee29
SSDEEP 24576:peJ5Nt7euWZ1/gKRU91YP6scBL3aSyPeo6nbJ4StFGDyhOoFifv+5Oj5wzAie7jw:YtyuWoKq1YP6R+b2o6t5AfW5c2wY
TLSH
T101B59F56B65500F8C16BD1F8CA5B9503F7B278190320A7FB12E1A6652F13BF28EBE711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.json

Path C:\Users\Admin\Documents\jjsploit\db.json
Size 442B
SHA256 b213fa16d40c78541c3306b91e498bbb60e4736617bc6ac5f0a25cf82ca765eb
MD5 ecea9765c9e049ba23623d53feab7eca
SHA1 2f02bb662c17ba16baf597f724a03d6b4bc18d67
SHA512 47f00cbc1bb8ab544096c958f4c7f01a3aad7e05d8996e43c213c7d71486b6b7bec1de4e6cf5cba4b9d11be60a95120d2e3b73fb02395ead4cabde9ba824bdf3
TLSH
T121F01CE24143189C4F1039F2D5B81C4C53E245A6CC96AE6B06E7650EC6598F321CA244
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\Documents\jjsploit\libcrypto-3-x64.dll
Size 4.5MB
SHA256 03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
MD5 a9c1f7ca15c65c139bc9d4bf57df2e1e
SHA1 1b1377139a6b289d43a6b1161cd1089ffc817cf9
SHA512 97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
SSDEEP 98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC
TLSH
T112269DA9A5BC0056E86A91BCC3876227D371B51657F057CF2E688AF90F23FD1227B740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\Documents\jjsploit\libssl-3-x64.dll
Size 802KB
SHA256 0bda7daeb4040c722b8c287dfd2307c9b8228576db1dbbbaac901c35cc8dc62b
MD5 51b0d5f42a82f6fa8739b403e9b8b81c
SHA1 75968c157628bb7aca9b5f2331f7a0c9a1d28865
SHA512 94fba90ad7bcf190079089dcc3af97c598c016eb359fe4d2ea439b5fbcd4a5489ab4422652223926aae64002beef1368d5b95874f68a2e5bc4971b4f9604d814
SSDEEP 12288:Mzjte0Fevo3VS1npHEDHLqjRmqWSTzt7opiTdEVB3S:M9e5o3VVZVSPtopwdEVB3S
TLSH
T189053B69BBB8059CD876C13986934213E6F6B4563370EBDB0B648A790F23BD4273E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxhash.dll

Path C:\Users\Admin\Documents\jjsploit\xxhash.dll
Size 46KB
SHA256 2828e3014c3283caeb1b00d14145a42f4e347e7f547b40634540394892265671
MD5 249a5f6ca047df2a2f802782696c7f80
SHA1 6a1d96be0f497d689fb55de70284af83cac61f52
SHA512 d2d0b6ba2ec95c33609d98788e5a4cce382d93721ea5dea61cde3f4c065b06530a0b01ae4909f7883a81d55529a36cb6a5820aa2afc320b5761f6f59a3a45f1f
SSDEEP 768:zziPp7yW4k3QDn24NuDUSu0MKQVMNKuxYAuogba4Mk3QimeSyygGz1K:zziR74kgDn2rDRuIrN5mAvgbTgi3SylI
TLSH
T19E234B47ECC98ACDE927EB7CC77B49C7E5D9362827114AE3C6E614A110A37C06737682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zstd.dll

Path C:\Users\Admin\Documents\jjsploit\zstd.dll
Size 638KB
SHA256 2a2d63c48b6b3ac7768231ade30122c94a0a33e62e5d2725e11c95b3194aa997
MD5 21dfe873f6ed38f2f713ecd43ad1ba41
SHA1 7648cb043587da0e85743f9da8dca8be621ccdf0
SHA512 67b4f976f3511387ce2a4743e2281ac88533bd204d4e07a5c6751f0ec30a3463dfabcda18103a632541ec2a8b7b937806121e21e44959411c39106e22b739919
SSDEEP 6144:XbauYl+rrR8uT4uB5uWYfO16oMynnjDHMkYHbpk5tRCEybNFZemMBLx4eTTzp:XbauYGT5BYMxjDHMk0petRCEyb9emHW
TLSH
T1E2D49E83F69542EEC07BC079C6564327EBB2380613146AEB83A4DF652F17EE55B38391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 46237.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 46237.crdownload
Size 9.6MB
SHA256 ff390fdfd02b4481f1aeb9212daebfb12a13e2403dc4ee67d976790fd285d924
MD5 752ddebfaf29d732af2b0413fdc7cd86
SHA1 31c644afafd3c5385664141b6ea82c8a62f3f60d
SHA512 f4d87133c681f7f1ec7ef991fd329450fc59211e4886dac4c2b42a60cc7d11c9d272c7cf69cc4cc88b48172dfae69cea11178ee1ded70f90af9e0b96351395b4
SSDEEP 196608:5sN+zrJKVLEqqTLcYmsxGeQYo00u83ZBCv5BYQynJA:5VKUsYmsxRjolu83ZBCvgQcJA
TLSH
T165A6AF22B901C032F8D100B296BD5FFA993D9A341B3954D3A7D45ABE5A305D33B39B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58deb3.msi

Path C:\Windows\Installer\e58deb3.msi
Size 6.0MB
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 fa31fa2064444103608be7532fcd6abcc21ef0ceb1d5835415f61babf6ff9535
MD5 6d5b248b8f1aec5b1ba7f39eb04c5f64
SHA1 1a43ff51e2f61faea7faf145798fe1a8931770e1
SHA512 9d44c57a28ce89fadf178e22bc8172b9704c9f7a1db7cbcf0b7510548d4dd4b0d9c5ea3668f852b42b7012ab1113034f1d66a7f446d509ac5e4ad57dd9c1ccdf
SSDEEP 24576:Tu8m+1zSdoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:a
TLSH
T18847E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0be12067-a751-4599-81b3-ce67bf5d56f1}_OnDiskSnapshotProp

Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0be12067-a751-4599-81b3-ce67bf5d56f1}_OnDiskSnapshotProp
Size 6KB
SHA256 2e24f33f92f21d2683cb0790016b342f0efb821850003de15fa17008e588938a
MD5 23db2a1198912e22961a0f131f75a580
SHA1 46072bb0de9c6fdddbbece8df135655f65cda545
SHA512 a091d4cd09f7de9d8460d48ffaf1ff735b9ba8e2f8d33797eb2e7888f6821ab27f9d13ba0cc2b098dd2eb21352ec64431dbf34c95f8a21e0df6aa64924893836
SSDEEP 96:FG3QecADVvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:s3Qwfb++ZVmN
TLSH
T171D18A0C5AF54711E2B3AB3129F18557A877B911EF33CB8E0298238E2671910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3156-205-0x00007FFE1ABE0000-0x00007FFE1ABE1000-memory.dmp

Download

memory/4332-99-0x00007FFE1A920000-0x00007FFE1A921000-memory.dmp

Download

memory/4332-98-0x00007FFE19800000-0x00007FFE19801000-memory.dmp

Download

memory/4532-87-0x00007FFE1ABE0000-0x00007FFE1ABE1000-memory.dmp

Download