d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd

Resubmissions

27/06/2026, 19:46

260627-yg1b2sds217

27/06/2026, 19:09

260627-xt41bscy8x8

Analysis

user interaction
yes
max time kernel
199s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jjsploit_8.17.9_x64_en-US.msi
Size 6.0MB
Sample260627-yg1b2sds21
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4756	jjsploit.exe
3752	jjsploit.exe

Loads dropped DLL 1 IoCs

pid	Process
860	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
123	raw.githubusercontent.com
124	raw.githubusercontent.com
128	raw.githubusercontent.com
130	raw.githubusercontent.com
132	raw.githubusercontent.com
134	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1536_877661418\manifest.json	msedgewebview2.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1536_877661418\protocols.json	msedgewebview2.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1536_866580131\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1536_877661418\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1536_866580131\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1536_866580131\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e598591.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI867C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e598593.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e598591.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}	msiexec.exe
File created	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2772	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270632550350879"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\PackageName = "jjsploit_8.17.9_x64_en-US.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\PackageCode = "9FC2B6F90A0842C469E6F4CAD3052A7D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Version = "135331849"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductIcon = "C:\\Windows\\Installer\\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductName = "jjsploit"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Language = "0"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4236	msiexec.exe
4236	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4480	msedgewebview2.exe
1536	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2772	msiexec.exe
Token: SeSecurityPrivilege	4236	msiexec.exe
Token: SeCreateTokenPrivilege	2772	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2772	msiexec.exe
Token: SeLockMemoryPrivilege	2772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2772	msiexec.exe
Token: SeMachineAccountPrivilege	2772	msiexec.exe
Token: SeTcbPrivilege	2772	msiexec.exe
Token: SeSecurityPrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe
Token: SeLoadDriverPrivilege	2772	msiexec.exe
Token: SeSystemProfilePrivilege	2772	msiexec.exe
Token: SeSystemtimePrivilege	2772	msiexec.exe
Token: SeProfSingleProcessPrivilege	2772	msiexec.exe
Token: SeIncBasePriorityPrivilege	2772	msiexec.exe
Token: SeCreatePagefilePrivilege	2772	msiexec.exe
Token: SeCreatePermanentPrivilege	2772	msiexec.exe
Token: SeBackupPrivilege	2772	msiexec.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeShutdownPrivilege	2772	msiexec.exe
Token: SeDebugPrivilege	2772	msiexec.exe
Token: SeAuditPrivilege	2772	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2772	msiexec.exe
Token: SeChangeNotifyPrivilege	2772	msiexec.exe
Token: SeRemoteShutdownPrivilege	2772	msiexec.exe
Token: SeUndockPrivilege	2772	msiexec.exe
Token: SeSyncAgentPrivilege	2772	msiexec.exe
Token: SeEnableDelegationPrivilege	2772	msiexec.exe
Token: SeManageVolumePrivilege	2772	msiexec.exe
Token: SeImpersonatePrivilege	2772	msiexec.exe
Token: SeCreateGlobalPrivilege	2772	msiexec.exe
Token: SeCreateTokenPrivilege	2772	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2772	msiexec.exe
Token: SeLockMemoryPrivilege	2772	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2772	msiexec.exe
Token: SeMachineAccountPrivilege	2772	msiexec.exe
Token: SeTcbPrivilege	2772	msiexec.exe
Token: SeSecurityPrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe
Token: SeLoadDriverPrivilege	2772	msiexec.exe
Token: SeSystemProfilePrivilege	2772	msiexec.exe
Token: SeSystemtimePrivilege	2772	msiexec.exe
Token: SeProfSingleProcessPrivilege	2772	msiexec.exe
Token: SeIncBasePriorityPrivilege	2772	msiexec.exe
Token: SeCreatePagefilePrivilege	2772	msiexec.exe
Token: SeCreatePermanentPrivilege	2772	msiexec.exe
Token: SeBackupPrivilege	2772	msiexec.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeShutdownPrivilege	2772	msiexec.exe
Token: SeDebugPrivilege	2772	msiexec.exe
Token: SeAuditPrivilege	2772	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2772	msiexec.exe
Token: SeChangeNotifyPrivilege	2772	msiexec.exe
Token: SeRemoteShutdownPrivilege	2772	msiexec.exe
Token: SeUndockPrivilege	2772	msiexec.exe
Token: SeSyncAgentPrivilege	2772	msiexec.exe
Token: SeEnableDelegationPrivilege	2772	msiexec.exe
Token: SeManageVolumePrivilege	2772	msiexec.exe
Token: SeImpersonatePrivilege	2772	msiexec.exe
Token: SeCreateGlobalPrivilege	2772	msiexec.exe
Token: SeCreateTokenPrivilege	2772	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2772	msiexec.exe
Token: SeLockMemoryPrivilege	2772	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2772	msiexec.exe
2772	msiexec.exe
4756	jjsploit.exe
3752	jjsploit.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 860	4236	msiexec.exe	94
PID 4236 wrote to memory of 1672	4236	msiexec.exe	101
PID 4756 wrote to memory of 4480	4756	jjsploit.exe	106
PID 4480 wrote to memory of 2056	4480	msedgewebview2.exe	107
PID 4480 wrote to memory of 2428	4480	msedgewebview2.exe	108
PID 4480 wrote to memory of 2428	4480	msedgewebview2.exe	108
PID 4480 wrote to memory of 2428	4480	msedgewebview2.exe	108
PID 4480 wrote to memory of 1684	4480	msedgewebview2.exe	109
PID 4480 wrote to memory of 2932	4480	msedgewebview2.exe	110
PID 4480 wrote to memory of 2932	4480	msedgewebview2.exe	110
PID 4480 wrote to memory of 1708	4480	msedgewebview2.exe	111
PID 4480 wrote to memory of 1708	4480	msedgewebview2.exe	111
PID 4480 wrote to memory of 1708	4480	msedgewebview2.exe	111
PID 4756 wrote to memory of 3752	4756	jjsploit.exe	114
PID 3752 wrote to memory of 1536	3752	jjsploit.exe	115
PID 1536 wrote to memory of 2424	1536	msedgewebview2.exe	116
PID 1536 wrote to memory of 1060	1536	msedgewebview2.exe	117
PID 1536 wrote to memory of 1060	1536	msedgewebview2.exe	117
PID 1536 wrote to memory of 1060	1536	msedgewebview2.exe	117
PID 1536 wrote to memory of 1132	1536	msedgewebview2.exe	118
PID 1536 wrote to memory of 3244	1536	msedgewebview2.exe	119
PID 1536 wrote to memory of 3244	1536	msedgewebview2.exe	119
PID 1536 wrote to memory of 5116	1536	msedgewebview2.exe	120
PID 1536 wrote to memory of 5116	1536	msedgewebview2.exe	120
PID 1536 wrote to memory of 5116	1536	msedgewebview2.exe	120
PID 1536 wrote to memory of 1432	1536	msedgewebview2.exe	122
PID 1536 wrote to memory of 1432	1536	msedgewebview2.exe	122
PID 1536 wrote to memory of 4680	1536	msedgewebview2.exe	123
PID 1536 wrote to memory of 4680	1536	msedgewebview2.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.9_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2772

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7DF1E2B82F2ACF1EAD3CBE46D72B1FC8 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:860
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4712

C:\Program Files\jjsploit\jjsploit.exe
"C:\Program Files\jjsploit\jjsploit.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4756.180.10654585532338052578
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff83a06b078,0x7ff83a06b084,0x7ff83a06b090
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,2245410974901438641,17879593413393643204,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,2245410974901438641,17879593413393643204,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2388,i,2245410974901438641,17879593413393643204,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:8
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3652,i,2245410974901438641,17879593413393643204,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:1708
- C:\Program Files\jjsploit\jjsploit.exe
  "\\?\C:\Program Files\jjsploit\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3752.4692.580226931202731707
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x1b0,0x7ff83a06b078,0x7ff83a06b084,0x7ff83a06b090
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1840,i,18324554968977629509,10826216668844498651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2088,i,18324554968977629509,10826216668844498651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2404,i,18324554968977629509,10826216668844498651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3564,i,18324554968977629509,10826216668844498651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2148,i,18324554968977629509,10826216668844498651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3900,i,18324554968977629509,10826216668844498651,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
      4⤵
      PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598592.rbs

Path C:\Config.Msi\e598592.rbs
Size 21KB
SHA256 3de05988e8a4f3d47fc58bd2f76b5b999ee4d81c79364754043d69819b5142d2
MD5 146173187da900077a4e9465e08c0b95
SHA1 0f11c9d0f8507553b4bd1eca921c8b9b49fe95f5
SHA512 42c0eee032cf394cb7d3607a99236cf9185260fa8ab73cf733832ce55f46d9fb75dc111bc38b8c9fe10917b584d9dde55134ee30111764c3bf5a21cf33f560f8
SSDEEP 384:n3ZAB7OTEXTIrY8nTZoWjdLRWixkt8t8t8t0tstststststststitztztCJGW/W6:n3ZAB7OTEXTIrY8nTZoWjdLRWixkt8tZ
TLSH
T1C3A211835A50C2E6E66B0774DB975B043B72C58E9358424B46CCC27A9C877C83FF9A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1536_866580131\manifest.fingerprint
Size 66B
SHA256 22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
MD5 5bbd09242392aacbb5fac763f9e3bd4e
SHA1 14bb7b23b459ce30193742ed1901a17b4dcf9645
SHA512 541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670
TLSH
T1CEA0026342648D9FBC1C042BD478A69DCD9115B088492445A925C75BB14203389F49A1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1536_866580131\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1536_877661418\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
MD5 f5b2fd9a39c097322b6cb663cca5b4e8
SHA1 08c113bccec7d3cdf4f6a2b313d1b1421ad62f85
SHA512 490b5c18b55ca136782d2f25e8f8b86a3cc5ae0ad25fda274bfe1a3adc759cbbb8f11592f6e7ad3451b758199e90db482767f4ebae7d93db61d8b90b3f61aae8
SSDEEP 196608:h9Uzqh1cmdDOf+IHFLU/6NW+tiFZJXij:MzqoyS+IHFI/extiFZJXi
TLSH
T139070725BE8B996CD05FC474834B8A720A7570CB0B35B9FF448596392F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 3001ff05c0c36555dccdb3b3a0ec64ed701b5965ca9be0b0c4fd23aa9cfd1896
MD5 5b60eed2286ecdf0c0753ce029a08db2
SHA1 343aa06c094c13ecab55158c4fe7a8429c2b81ad
SHA512 ef5505d4e1f47909514fe7935a6b8463a0c17e0acecfedf43691a6511b5136159fd9efdb4bf6678ef0ec33c85ef5c50e199ef2c2008a515ccc20f780d1c817c7
TLSH
T19141F00006E1133AE3A687386EA603229A7EFC16AEA45F67818500CE0824100DDBCFFF
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe59887f.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe59887f.TMP
Size 1KB
SHA256 37487c04dbee6c00e96647357d0b29f9e2bec7358723e0ea1958084e67fa2c70
MD5 e03757a3960076f17989f444e8025d3b
SHA1 93d45e1dae67e0457c59bef5ad8f2ef253bf5ec1
SHA512 6043cb1e29f7696826e3756904f9c6ef7e6db0b8c29299e393e0b6d9262d4336ae3610692d3f2703aca4214a92952ce6b4121b70da8cc4e548837464c788b09e
TLSH
T1BD41DF0406F1177AE3E686782EA203619B7EFC159EA46F63818600CE4864500DDBCFFF
MD5 SHA1 SHA512 TLSH

Submit Download

MSI455C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI455C.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0d349ff3451f2c1888b7ad38d4cd50410362df380712d18b85df1b55275ce59b
MD5 d8babf5072b3b843b6449812f1aeffee
SHA1 1073c93dee6e98ef37e973e24a7e7e7230c182f3
SHA512 bc736f52c6d12949ea81bb3b8316ff3228214eece4eee3495dd9e63bbf5ecf4d349e0ca82030f3b1959e2f055f22b7c848a0b27a3c75b4727e50f7980de05e0b
TLSH
T11FD0122B3311053CC01030370002B7481502D71F411641045828CA9E2E040950E428C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bc3268dcd6a1930f0b287976a128fad4c5c85e2383fe4d47fc7ce495fa18dfc6
MD5 5e44a07ad6762469a2c4c22e3e3537bd
SHA1 8de62a4a58811960b6c938471520eb475e1518ef
SHA512 796ddf304e1f928407b7b5e3955cdb4b925af5e7e4bab2adceca2ccfb00862c5dd9433b82de61631fb7c1eb8229805c7c5b21455977bb924fb3125c70999fc3b
TLSH
T127D02B2BF320063DC01030730141F7282B03B30F10134019982CCB9D6D090DB0FC1CE1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 02a6f4dbd1b5f9627b6b6b8d5642120404402cbda8dc839ce84473d96e783d9e
MD5 ddd0cb3dbcf9f9fef3a0486983509a6b
SHA1 9cd926379966c91a311b97dd6ffe188deb3e17d6
SHA512 c2a99a12567114b7e8177c3f47a9b838948f8147691d8b3bb4a9ee2b96d8fab9aeb063a56edf126a0bb8bc40bd64e1bdceb0443fe2f4c744b7491da38b14cd15
TLSH
T13CD0126AB3155A3EC12034720181E6552B42630A20A6422E98288AAD6D698A75BD58E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e39421a90e1bad1eb9fbb62b4f14db887726df0432fcde1aec74e261d1660a9b
MD5 023867167fa5d478d66da7b043cb8a1a
SHA1 6fc02e7d6f68a1226f851570cdfde9ef3a48fc08
SHA512 4ec9f66d3c6c6a5d3300b3c8b5909add2df3bc0934e0ab22e6c070919d24e2543d2f96bfe3afa9710c4bb3669d965c10ea01e16b46b1d7c45b2154b80ee3c200
TLSH
T12ED0126AB715563EC12034720181E6552B42620A21A6422E98288ABD6D6A8A75BD58E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 59a4432d90a3f476aa61b89b1301ed95e60691d874485cbc7113c5fd351d6542
MD5 0d90f7146f6f238ad927acd6f7738300
SHA1 a2e970239d65cb8dee2965a883d1524a697804db
SHA512 d1151f65efc7dd2e63d73266d472de62ad78e50f9e38d5fbfb8601e19402ce0f7066240b6852949239d4c92b1de26eb1ed5528a7aa568effdd4878b7f65d5b70
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 40dc0b7a41e8c7d2d5a3e88ea531ac841bf40c7609f13b680329963a84301cce
MD5 4b08a23e19582c41d1413d9f37626475
SHA1 fef06946448b1e898f8e7317a1603a3268598b4b
SHA512 a27030781e7b4931055ac02a435073e5ac2c96c01f65f7669fa377f5d6fb2ff93c5b4ee855f85ffcfa4678b1e5b9950206855361853ec035efb2b791b508a927
SSDEEP 6:/FSLmw+J+tUkNM6W+J+t0bZwtdBidOF9tg9N47R8hZp+T+gARkF49jh3bR1TQWwl:dM0q9NM65qiKtdBi69S3QySF4LL8
TLSH
T1ED138C3D48E20FE1EFE41BBC24EF1370833A4719C296420F0234B21234E4719A7CD1A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 a2823c9e8bb00dbfeb7cae22bf05a3b77cfa0e053fff741576c27ebe24df0a70
MD5 d8f68ff6fe615b673be654308d91be47
SHA1 5450b7c72898b016603be0749dcacd7b89562262
SHA512 b724616e9eb2c0b1c2ae3b2224b6279635dfab58a464a4281d65eb983a0f640031523b72e7888e422a788f47dc9def4ff3a9fd900e8424c0a3012d60fc669c15
SSDEEP 48:0dOlhJgs+1aIoSJwwNTYIUlRLzLjs3Zk7:2YuwIoSJHUlRLB
TLSH
T1A344BDFF1B02E058CB5442F1498D6E3ED63B41ADBCF9F596FDA098A484E32D917A121C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 27534b30ae0d4eb8a45f29f76906ef8f23478f80d185c64f6babd9dddae93d17
MD5 6fe90fe44587a0b055799ef57fe47159
SHA1 a5bb9107b78aea147d8c57888bff394924d1b30a
SHA512 6df6a132ee71ea20e07b921071fe2a45420e9369c8997082fa7c806d8e41edc9068ca45914815c48298968e997bebd21bf99aec9fa58b450cf8bbc6cec9c616a
SSDEEP 24:WTNvAfMAM50rCnPs/EWsoAh59Q7hMrXvjVYPB4OSGOq/wzzlGgp7Znc:MV5Ps/OoKP7vjVJoq57Znc
TLSH
T10325E92017901F13E154E47217C7CF0E59497D48394631A1A84000B8D89F58D9BB071C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 b0a1dfebe0472e8feafd9abc2ca31ed8e4a22e6e8f3fe3e98c91b8b98ab6ecab
MD5 a18bf98f4def990f29d1495a50da8925
SHA1 1d02072f99c003a52c8a204993c7e4549d131468
SHA512 b4456e7c6f2b43b339aff4230b5496d29f8bac6a6c9032b4eaa80b2c0e69c51d289bfc94a9a5e00b616b06ebecca4ea51cf4002346f2c49f5f1335a0448d44c0
SSDEEP 768:a7BgtvPfgLXBvLG9zAAUgz6Rrg66TuGeT9gZd9Jo3bN7grN7g:SBUvPfkKnrz6Rrl6A964i
TLSH
T1A8169EE74F78B942E952DEB07BDDFD2D3E7146427886A8D3E50782A828D47C05BC640E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\f_000001
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\f_000002
Size 150KB
SHA256 ac15324cd4add69c2b89df2ad3f730eb01df3d153b7f6cc2338047229094588a
MD5 1b66b6eb75c664e5870f1385700c31f1
SHA1 9cf713bd976b7cdd30ede72c8b9ef3b5c695a8de
SHA512 a9c535647a20aef5e589e99c24d0186b990b00c3343b5e2e4b70f4d70b0e809d7f695c318aefb8e5bf827916abf0c6de8139f35f67411e1330e034d7f4ed3b3d
SSDEEP 3072:0Md6n1jftr38yj+++j7AdBf5Ziyp3hKuELLOA/ZVUmm/Oi4C/Evu6c:xd6n1R38t+GKp3hKuEmgZ2POi4Csvu6c
TLSH
T1DAE313869CDA837D78FCED5AF46A287101958EF693CE17F2291807F898437434FA61B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 69376da41cdc8514d38f13ff686e95b90a5b3cd4dac70e64955e6286e1b15d82
MD5 5f83f7906075ce91b5cc59f9bb505da6
SHA1 5e600447b7d241e65981c887716a160d5251de25
SHA512 6e4cb554f36d0343120c11bd494d3e9f7f6c048880999194f21a12bb041210ef752087bd82ad9024e6422882ad70b78909bec388714bbc26b71250b2d46c6c41
SSDEEP 3:LsPlklNllkll/ltdil+11nvlXlJlWNtl3Nl/lAle/laNtlIlXlvl//l:Lsy3lEttMRNHmN4
TLSH
T13744121903441D1BC8D0413F848783212330E444C11F4F031B4941001CC17142E5C248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 2d872ba105b7760b35887346cbb52d910fb9c638fc9de2ed4c7af743181ddc4b
MD5 8955f093030fd4304c31bd4628d0215a
SHA1 e22a745fda8c6d7ea81fff131b3d8d63b64d345d
SHA512 074e4f90e4fcf73ec0fe310f6b46b576dacbcb8f3cf1ccb4f27e467233ca20e0e8127def365be16e1ee625ba2bc38d60104c6e1277892f35c857b4307d0f89f6
TLSH
T1D3C0920081401BEFC20DD2B0A8CE8385B7723A0121878CA112B006BEE0E232492C3C58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 364bdee140d0da44bfc945a28722e9b906ebd95ef7855ee6b6feff3196ece059
MD5 f87c05c441fd233e9a5affbdc736a1c9
SHA1 c859b46ad3fe535850f2c678658240fa17ac6204
SHA512 b78231cd9b2ea7b5df0918129d8004ec15ec1593908ab68c1d7650fef83c828d322de4e68d4bbcc3f2bf2d666fc8de92b0ba6f0a3a13d2adac273c358f2d77d3
TLSH
T125D01254C0400BEEC305C5F194C88140A771374AB7875D925174499ED6E759466D3C74
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 12ae6f75f6f289a294ec6e57a33970f4b9d2b26e496c05cf41a31288300a2af9
MD5 048c39db048b296728349accca122daf
SHA1 0c2d99b86cc0cdf7a11e259774e533d22af6a463
SHA512 d783e82d60b9426709f348a83b9ccce51945c04b88c882c84be602463abf02ace5238f3f2dcb51b6e1a109940a8e4a8813dcb7f85629d96f1f64b3d83eace511
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 5ec3d54ef646bdb18ccf861eee007d609547136292be16707642a3da671d8bc5
MD5 9575a7fc90195a23ad0f22b4b03bb393
SHA1 b48521be804f450f79907acbeda5e9c3b15bf245
SHA512 843bec7dec1f32c0aa96e50391cff328ac4c580e46d25121d925a1dd0cb045ad57c7d4658744f0ab0f66781385af79302f6a1123deaf2241298ab2ffd418beaa
SSDEEP 3:LstlNllkll/l5w:LsX3lEt5w
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\History
Size 184KB
SHA256 376b85f249e1806881000f156c178e135ae8748f50ec7f9c0a8774c8f124917b
MD5 2b6227464d49aa7fb699740f33d29ad8
SHA1 dbdd665f06bb1b067d45ee8f38388e68010b9929
SHA512 c7c85a6b16f8a1d82a3dbcca2500f8a75e2eb5cf9ff2fe8b9c9e8957eee3626b1dee90ed14e5c20f18fd3cab2db80739bf8366aeb43da9ee0ba24d75c29b1d2e
SSDEEP 96:HBIl2gejzH+bF+UIYysX0fxQp97+EHt/DfLjLqL/LibgI4VgNr2jWRk/E0M:HBXPH+bF+UI3iWGV+WN3qL/JVgZQW3N
TLSH
T1CA04FD5E5F343612CDBD913668E645B3597DF03F8B236AC66C6204B1CEE2652B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 910a86195ded0c9088a9906e6d3a473eca42329bb2f2733fa380c54cce3f6838
MD5 e6b2a6c1a4ab9655f76bfddd5a8a3b2e
SHA1 17e63bc339d3f6559a9987483d8e5ee293019d70
SHA512 714903f197e38f61d91479c872f7a6c20976e8ae070def5e0f9a01760222e3c20be65b89c7750a1634d21b7587bc9b4b1547fd4ba7416af426109265367a2d4a
SSDEEP 48:T9LopFMatSaw/auUOt8BKPSevqZ3Nc+jrFTxyW:NeMatUaAKGvqp/VlyW
TLSH
T18992540F1F306154C0F54A3ADDC5496B2E3E001CD3671E48490E54B68DE256FF29B76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 d8ec3ff262b876391b6290eab3d6262abf74618450d53a264775c6bfeb10bde8
MD5 c00da06ba4cde5c61445b2a7f62d26e7
SHA1 2a7db6a7c7fd3d2d3b0265e0d276e8f430e68b37
SHA512 426b78fcc5b85d3e8ccccb04666976003d5ca9cd977ebb92a49326ed8ec3ac1c6863897ffdd5ddfa669180aa01151c41f92439aad31c1fdc38f3c25b42c8260e
TLSH
T11F519ABB87E4866DC95152F926243D2BCF1D091847B83D6DC8D5EFCBA7D1470E20464E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 1967760780c58b83f80909f506c4ccf1d8053e335673062255114f9de3bca561
MD5 5bdc5817bd96313dc7059b268d33bff7
SHA1 d1740a3dfbe7ad5252f12ff04c1528cca496fea5
SHA512 75e5cd6eb255739d1aaaf304bd5dd1bd5f7111c12487d0e62c3d09ef35f682b765e6e2f0d38e5e2c366118877418de9e4a0cb7d68a0cb70a447532c7d84ed9f9
TLSH
T12951B8BBC6E4866DC95152F926643D2BCF1D091847B83D2E88D5EFCBA7D0470E20464E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4279.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5a4279.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 569b244cb9e2d039e7972ab1e42c99cca61152f7486e5011ba72b529fd670f5d
MD5 2a4953e74ab3b43ee6d355facc4874f6
SHA1 f0591de041446bf5cb716a413a8bf5426838ccb8
SHA512 a70c4c8d43b4acf0346fb257307820b51a707eba070b71257916f33ca9e5332762fc7ed83f31d5a540d33ecef03276275e4907c924b39eaed0beaeb4663fc45b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBZ3G:uIEumQv8m1ccnvS67b8ubph5H2w+
TLSH
T101F2D0BF0BE9B245C4B094B995801C8AFF5A041C4FFDAED995E599D3FB410A2E528604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity
Size 1016B
SHA256 b7cc1a866a37070befbb0f4730d8d92cf406bf41d2155bc35565950639378be1
MD5 5f19418f30d1435538b43ebc47439a44
SHA1 e09736fc00f146cdc51a964dfd4cd9dd4397f87a
SHA512 d3171875749a1905b544325c662a67d7e483b8570f759695818da59760b2c74b3a66774dfaab9c3cba610fb58165be08e9c02c365f4f6e87d10d313c602fe9a7
TLSH
T1DF113693957EF06F50181D6F1D88BC22597AB431424234FCEA96916CF0955FB6B0A432
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity
Size 1012B
SHA256 6e1631316d7aab3c40e82b886ccea04fb7d70875c43c8b56908773901e5c68bc
MD5 a79f53933afb92406f73fa865efaea8e
SHA1 aa4bf5be3b21c479c29738a375fb77c98ba613de
SHA512 f546bf19c9a8c1c211836dfbbe2c3dcb1a1b65de992f7b5be2432b6a48a44f352d5e485bd0b805ee7798984a41cfcb1cd06937f3f90c896f2d4339875e71d929
TLSH
T107113893557FF56B50280D6F1D84BC269D3AB032429338F8EAA7916CF0959FB5B0A432
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 7KB
SHA256 7b9e84569ff450404b1354b64496d315ee9e9805b257f95e993defbadbdce8a1
MD5 d942445323ede4b0ba81801f67758e66
SHA1 c973c186f62c3ff6ae848d4d9325b78160326e06
SHA512 370a58df371cdbab0158450d3e392d8042d6dab3aeeb0d0935ca6c01180f7bd619a75549bd78bfc92f97b569b15bcba3c806ada039253fd7aef93f6af0d0719c
SSDEEP 192:st5r00opRfz+4Z8paWB/S+Wi75yV8/iYgKZHn3RM8:st5g0opRC3n/VFS8q4e8
TLSH
T17BE1D8139E285A7B4CC7E619BA35FB1AD2F6102276D00E88EBFC870C05D76DD620784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 7KB
SHA256 6b7d01327a1d21f647c0f439da85056160ea75d5537bb1ef90a301c3a1654f97
MD5 bcb71f81cb11740fc586ffde70c985ff
SHA1 a635f5ab81a391418548b9b4d1a1956aa7bf49e7
SHA512 80dd0ddbc72d7a2718cbe6cec22bb7fa0aeb1f55db5bf923fbc1d259325357c180a13c57dd97271c8875f63509c9d8770bd03bd1ec1c6d92521f27b83f8ce593
SSDEEP 192:st5r00opsfz+4Z8paWB/S+Wi7ucIYgKZHBRMC:st5g0opsC3n/VVILC
TLSH
T154F1B9139E245A7B4CC7E619BA75BB16E2F6102275D00E58EBFD870C05E76CD620784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 6KB
SHA256 180f45920e7cf9659285070f61ecca913ca47c08613b93d5e1890be365b5a3a3
MD5 f89a97df102789c259ad2bd00a895a15
SHA1 e30b1ba3d1ad8ccedd755303f7791b6d238fb81e
SHA512 5ed7d652a8dba7084f9b29693c7df709cf166d08b75d5ce04e96bf0da66479e8dc38161a6ff416a25f4fc1788771efc24a239a96b2acb0eeb7555ef9676cb394
SSDEEP 192:st5r00op/cfz+4Z8pa9M/S+Wi7rUqY3p5HmFK8:st5g0op/cC3r/VcqQ8
TLSH
T11FE1C9139E346A7B4CC7E619BA35BB16D2F6102275D40E88EBFD8B0C05D76DD620784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a425a.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences~RFe5a425a.TMP
Size 6KB
SHA256 28de7f6f7f75d98247f943585a17c759648233dc1cb36c782d62322dfb569b5b
MD5 54b600b39129277495add3d7e000ae01
SHA1 be2f7bc4f933d536df42157c21dccc2ad03bfe25
SHA512 eb75242560af1fc72c959e8945fa07cd3dc6bb1d8e484fe4d6eda11b41901030a5b7985aa357aef65b2053eab8ab7badee4e6fb22b665d31c317f3ca834134f8
SSDEEP 192:st5r00op/cfL4Z8pa9M/S+Wi7hOwY3p5HU3M8:st5g0op/cT3r/VEwc8
TLSH
T136E196135E246A774CC7E719BA35BB1AD2F6102176D40E98ABFD8B0C04E76DD720784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 f644f40b420dd2599bc0d5a5a5065b70605aedd26e729715bd0956656536405e
MD5 f599a2a4a292139c4e3a8832ff3c4e89
SHA1 02f9182c79777af77dd173cced5fd415e33d7ea7
SHA512 76e208569e989b341dbfa9734d67e3839382bcc4a9f5d1d2bf952041d2925705a2b3b1d872570c337e3b7bd47c8d0923b25c07f6a49f234620119efd4b166b09
SSDEEP 96:HlDiNPlf/ROoKOpkF5d1DiA7sMaTEv9V5h5pg5+eewDxKmEVl36YdZD:HktWGTk9lQQ6Y7D
TLSH
T17CD1D6A70669C434AF449FEBDC287ECB89B641AF99D54C0A87E2C54C07C2AFD20DA4C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 2b27b0354daca6e1efd8c360031bbbf6d22ae0bd9637f1d27130e3e4a70591cf
MD5 459bf50db3a8b676f502bf6becdeddd1
SHA1 d6ca145bf1623d547e3d16fb0feea1df18ed30a5
SHA512 2d83b7c7df5769e77bef7857271fe510e2b87d04e0bef7c3351c910c73d3f0362a8c71253ddea2c7a58160170d7ecace2d80e9e37e473d8a246a19f0c16a2a8c
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\SharedStorage
Size 4KB
SHA256 1fe8f6113488865c546d2faa55b21482662ce4be19d4f505eeefa09bc3131489
MD5 b9263bbf24428aaca95d04d04f3aeb6f
SHA1 5346015345f6df766df4bc9b42da076f6fdd440f
SHA512 5bc2978bc96e1347500db552e2a2dfd9e5df25c8e16d3ab57e5519de43cb9c08f5aeefd1a6f6947d7fa253505918763b932f622636fc2a7a429fa72a5b49c7cc
TLSH
T1EE810440534000F1D05407F755D1130C0F07D3D4D5410F0355010041CC51D445C70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 1f88bbac5bb7342e990097a0b831cc262213212a25dcee703a1bccf994f20de7
MD5 74ec59443f3ad87a3443731690804fc5
SHA1 ceeff686e71627f7fc80bb2a2ffb0be2722d449f
SHA512 d8bb2dbf0569abc27492d32391d9ddaa65b3f0f5bd835994fd313e94b2ce06f93d21d6800bf4feae6f9da142bdef21df622b112af35195ad8d45d480ce1958bb
TLSH
T1ABB012847B089A37C0D80F3D07A4C7B067A1F203A9205503D884DF210EA63F82E058D8
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\LOG
Size 305B
SHA256 9519d5cbc5b60aaaaa2c78d5aed5de93ae71fc46f93df3eec2e5a11b0587cd0d
MD5 e27d0afbd0b4f60469b3ecc0ed4b1f0a
SHA1 ffaf75bf10c044bc0d05809713aaee73a15804ff
SHA512 e5287f5637820f1cc14ecd7f527b4b0751f5eb646b800088af02ca2f718f8e33f0f2ae6a629e5963ad234e14f583016a5efbc05c13eb4c4da0687dae60927100
TLSH
T147E02621A6CBC77B0A4904EB65329309D7A2F449E6DE26E60F24D9402507808B142711
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\LOG
Size 281B
SHA256 7a4987dbf9a076bf3c7516dd16eaaf9032b69c3e4cd8c987327debcfa159bca2
MD5 7a8368a9954110bd927961c52a3171c7
SHA1 da157908f6a98b0ab0583263f767fb637b51a7d8
SHA512 365cc64a2815b13ffca30c08034fb0062b449c1d0a7954c56cc21f6320ba770dd46c6022cbe6a45a2500611841d0d6bcecbb668cb7dbf6c00b80bcc2caa5cae5
TLSH
T1ADD0C271E6CAC7BA0D5486D78675974AE7B0B849A7CE3BCA8B08D8442843908B160652
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Visited Links
Size 128KB
SHA256 d6d529dc3588f2e8950f8af47eab44284036024064dde2adfd4049ea7199655d
MD5 7c43d0671e592d979ef46589b6de2310
SHA1 881c11b5f2a4bbea8c282275807d9b3e740ae9bf
SHA512 c208d9dd3e624afe648e0a99df9f759b0a3bac8e23002b84fcc0e92c23d6176139ca678c7191748e77c727dbcb01d6d02421a592bc5509953cc21659c01c7ce4
SSDEEP 3:ImtVuIelllllHv:IiVuIe/l
TLSH
T17AD3045C13430C40C50450375400CF554130CD00D077CC4507340F51C444035C343450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\shared_proto_db\metadata\LOG
Size 295B
SHA256 9a3354fa1a8d0f9ecb23887077252f44408d43116c3a423dd99897153f3e82a2
MD5 9af40514d5ecbea391254d20edd93ccc
SHA1 ef4a7ad43586c7951f2e027b3c55028e81610491
SHA512 b0a4b11eec34ca6e8c2c406f404ee4d1157510fe711ef316b292025abeae3976c0b841228b4928160b956a061979d72533b1b77f2c701994afbb5c8f59b1003f
TLSH
T16FE08C11F88A87EF096549A750724389EB56788BBAA92FCA4F00CD88580390CB569612
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 145d05e643e10316d4e7fec6cc8c3a8eac784ef6c38fef8f6a04b3082846c6f8
MD5 b769c9a2e50308fff2737fe962655edf
SHA1 25595e0c32e7e1b058402819416ccf358b8168c9
SHA512 091ee1d04b190cc3801bc5c69bd5747ab9574d603600da61a3f6c5d59827173190129058ba5f196ff3a2039940e332d188fc5f7ff6cb8b7c4695ae7b505c44de
SSDEEP 384:zRsrv+89zHqlDNP9oid43Nbbc7UNjAbuukDzuNX:qrv+4UNbd4KYNjAbVNX
TLSH
T17972AE33A86C97335DF2D844F59A5E0BBBB860A395C10BA4E9D91F4E029F1DE2307C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 441893c25e92248ef735a45dead0858c0543766440ea5ff0808cd5456365abbe
MD5 1987b4b7e5f5d96b747b5b00e4ee058a
SHA1 5c2a1e8bbbae7493987c5237dace0008252bf044
SHA512 c188c06ee484c06590e20a439f56b3a2f61e03af3d713197319fc3ec95ff5500f7e5fee1ea3c9602dad46ed7bea098a6671bf2bc0e54338ae11d22fd8ac4f948
SSDEEP 384:zrsrv+89zHqlDNP9oid43NbPs71ojAb0NQ:0rv+4UNbd4KJojAb0NQ
TLSH
T15072AE33A87C97339DF2D805F48A6A0BBB74609692C20BA4D9DA0F4D429F1DD2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 ae4be0e3283ae599406e4777bd3940be819fd0688fc2f9ae3c35637ddab11246
MD5 bea8f4e5e16bd3cabea023f531af75cd
SHA1 0a2668acc05cda1152b950501438c0a5b484ca0b
SHA512 18560092e2b7e4a2d29c1343e7991722c91af290d12d6b119ad379414cd1a2ee8400d368974ff35794d53abcd280a7e10ad1db19341e06adf599968405ffecec
TLSH
T192517873BC589B778DE39A44BD957F17DA3510A6AB911F90A6DE0B0C01DB65C3302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 f5402f89400d43e3944bbbaf5e187a496ca9fbad2d8fd20664c4bf329a2dd287
MD5 ad2bba4cdf4555d4344ef738440ae049
SHA1 2525d44ebe91b060b875d64b9a97ff80f9809d24
SHA512 6746cd5f36c62753a29e68b7721ae82e655b4a1a051e74c41fde7f96d6f01148ed2813f7296ed83321879fca2adbb45d41940d8ec75250b3c44bc9fc92fe1dff
TLSH
T140719573A9689A374DE39A04B9C52B16B6751077E6D53F94DAED0F0C02DB39C2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 3746277f76cabee1ba3daca1c7366b90fd802df96b9452470b6852aeb65f36b8
MD5 0f477443c436ca1943c2a23101d00135
SHA1 dc249c5a8cdaf9f4a98e30e2857e6d69c80f3978
SHA512 bde9558a72f2a7c16dbf0827b86b0cd651a7f741342ec3569c83e561411a3668d8a7c36f9c0a21ed4dae3dc1f08b761ee6ea137449bcfecceea262cbabf5f47e
SSDEEP 384:zUsrv+89zHqlDNP9oid6NbPI271+jAb0NQ:zrv+4UNbdt2J+jAb0NQ
TLSH
T11C72AE33A57C97339DF2E944B48A6A0BBB74609691C20BE4D9DA1B8D429F0DD2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 1KB
SHA256 d7f21e090c0628924e5a7bfe130c0fdaeb53d20e4f75c48f5c6dd41cb947c14c
MD5 ae35c55d1015d683176c595a047a64d0
SHA1 21d2aacdce9486591e05a116d1d60c07ef620ede
SHA512 047e7113adcee8e2c2a9bfcb77ea478f5ec751cb196af2d293fe7089a130da6a545d7447d4e92c30af053f1c7a395ce63b2ebbe9b29afe002ab69fdc74b03c73
TLSH
T1D731A9B3E8A81B725D815749B691EA576E3110F7E6914F44B2DF4B0C02D729C7116C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59ea56.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe59ea56.TMP
Size 1KB
SHA256 147824f3f5eb937b24ac3734d2d1306c89ed7784e32bf2d81723a99c96db7930
MD5 6265c2c4ccde709eded8b98ec24b35e1
SHA1 6e8e90dd98a8f4a24d5002c50b559b50b28f6e0b
SHA512 ef05477854c646fabed95a547a2025d65564d4d470e6f14ce96889e9bb46406dd04420862ad58c7da100d47e52b831d974a4cad4aac7e9ce021b5ee10e327bb1
TLSH
T1462165B3D8AC5B72AD815A48B692EA4B6D2010FBA2904F08B1DF470D129759C6216C32
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\ShaderCache\index
Size 256KB
SHA256 4a8846de3a30c71f65c191ab322c509e302ea75ac0ff063614b51c5fdf9451b3
MD5 e48480be5555b138d181da2c6cebac8b
SHA1 f9098ba9a32539cdba80b8aa53fb7ce6b0016c72
SHA512 50aac9863ff43b364ae173096ecdd2a47c05d15005a5c94cf746d9bf46ee3bde7ae3ed2c35fad1cbc891589bdce2bbeaebc5314f586267f8d023bd6d8c1440fe
SSDEEP 3:LsOllllklkXl6Ql/:LsUlP6w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

e598591.msi

Path C:\Windows\Installer\e598591.msi
Size 6.0MB
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 f8c4952631d79b987866257a78923ef0e990eb0ac79a1acd5bba684b2f65957e
MD5 c039bb3bedb5edbd743c256597881c71
SHA1 09d141a66759444390eaf98a9beba45dd5fe8cf5
SHA512 9ab3bdfaf2c0fcc2c6b96b09ad6af55a4319ee0ebae342f3dcb465faee3ae1c1d34670efa990c64ae98c762230efab827db698d889e0b829edf58d93434d2b64
SSDEEP 24576:hu8m+1zIdoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:W
TLSH
T17F47B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{449444c0-cced-457c-88c4-b11ab47bc2bd}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{449444c0-cced-457c-88c4-b11ab47bc2bd}_OnDiskSnapshotProp
Size 6KB
SHA256 405bae79bab359994bf466915b26b0b38b3467c6369ef32cb2a21081cfb3367f
MD5 bc8b54a0f01915907269a219ad72d562
SHA1 ac44dd18899612758146f1ffab7f2df6bbc79d94
SHA512 99c3f92ac83631e5d576ca958819d23f0529a83fe7d5442d43be3089aa9d70cd6a15a3c0069c2a5704147b3abf61c3d6a0245797ccf25abd0dd05cf1ecbba18d
SSDEEP 96:FXUQeJmGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:6QjGPGnb++ZVmN
TLSH
T188D199085AF54711E2F3AB7229F14553A877B811EF33CB8E0198638E6670910F835F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-590-0x000001E4E5E10000-0x000001E4E5FB1000-memory.dmp

Download

memory/1708-209-0x00007FF858950000-0x00007FF858951000-memory.dmp

Download

memory/2428-444-0x000001A430180000-0x000001A430321000-memory.dmp

Download

memory/2428-296-0x000001A430180000-0x000001A430321000-memory.dmp

Download

memory/2428-88-0x00007FF858950000-0x00007FF858951000-memory.dmp

Download

memory/2932-139-0x00007FF858B00000-0x00007FF858B01000-memory.dmp

Download

memory/2932-140-0x00007FF858B10000-0x00007FF858B11000-memory.dmp

Download