Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjsploit_8.17.6_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
jjsploit_8.17.6_x64_en-US.msi
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target jjsploit_8.17.6_x64_en-US.msi
- Size 6.1MB
- Sample260701-be78jsby4j
- SHA256 a8a547cf25bc242a551238e557e24b4edb9af153ec27da2830e096e3c064dc43
- MD5 51c312bba8c70cfbec72f41eef975c04
- SHA1 621fc67cd19f1f963e73c268b0a851e9a7538d0b
- SHA512 27930d55c34a5351fcd2ebe20dc359700d62d411dc9cd195298a8992e7ca5a6826020be607c20485e3a2e14e990061464885bf1ec318d913b142f8f7f2f18577
- SSDEEP 196608:aZTuReE1Wse6573++uQoyYsGKWpizgm1j9wtV:w0/1Wsei32JLKWpqHQ
- TLSH T18A563357BD41C9A2DA2A1D35083E87A11739BC155FAA1D1337A4728DDEF23C08FB29D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1392 jjsploit.exe - Loads dropped DLL 1 IoCs
pid Process 4248 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jjsploit.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua msiexec.exe File created C:\Program Files\jjsploit\Uninstall jjsploit.lnk msiexec.exe File created C:\Program Files\jjsploit\jjsploit.exe msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\fly.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\god.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFA06805ACCED0D48F.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-ml.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-tk.hyb msedgewebview2.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-sv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\~DF6857BA4D260A4ABA.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\Installer\e58db1b.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-lv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-pt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-ta.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-hu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-cu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-cy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Windows\Installer\SourceHash{FFDBDCFE-0F22-4352-8044-DF9A5EF27006} msiexec.exe File opened for modification C:\Windows\Installer\{FFDBDCFE-0F22-4352-8044-DF9A5EF27006}\ProductIcon msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_131135551\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-as.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-en-us.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-or.hyb msedgewebview2.exe File opened for modification C:\Windows\SystemTemp msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_131135551\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-ga.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-nb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-te.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\~DF20B28BDFC7D0507D.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-af.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-da.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-lt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-ru.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-sq.hyb msedgewebview2.exe File opened for modification C:\Windows\Installer\MSIDCCE.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-de-1996.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-gl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-hy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\manifest.json msedgewebview2.exe File opened for modification C:\Windows\Installer\e58db19.msi msiexec.exe File created C:\Windows\SystemTemp\~DFD38439C9BAACB53E.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_131135551\metadata.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-sk.hyb msedgewebview2.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 6088 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\ProductIcon = "C:\\Windows\\Installer\\{FFDBDCFE-0F22-4352-8044-DF9A5EF27006}\\ProductIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760\ShortcutsFeature = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\Version = "135331846" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\EFCDBDFF22F025340844FDA9E52F0760 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\PackageName = "jjsploit_8.17.6_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760\External msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EFCDBDFF22F025340844FDA9E52F0760\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\ProductName = "jjsploit" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\PackageCode = "A5B5E9EE8D918414C97AAFB4BF7E622F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EFCDBDFF22F025340844FDA9E52F0760\AdvertiseFlags = "388" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1196 msiexec.exe 1196 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4996 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 6088 msiexec.exe Token: SeIncreaseQuotaPrivilege 6088 msiexec.exe Token: SeSecurityPrivilege 1196 msiexec.exe Token: SeCreateTokenPrivilege 6088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6088 msiexec.exe Token: SeLockMemoryPrivilege 6088 msiexec.exe Token: SeIncreaseQuotaPrivilege 6088 msiexec.exe Token: SeMachineAccountPrivilege 6088 msiexec.exe Token: SeTcbPrivilege 6088 msiexec.exe Token: SeSecurityPrivilege 6088 msiexec.exe Token: SeTakeOwnershipPrivilege 6088 msiexec.exe Token: SeLoadDriverPrivilege 6088 msiexec.exe Token: SeSystemProfilePrivilege 6088 msiexec.exe Token: SeSystemtimePrivilege 6088 msiexec.exe Token: SeProfSingleProcessPrivilege 6088 msiexec.exe Token: SeIncBasePriorityPrivilege 6088 msiexec.exe Token: SeCreatePagefilePrivilege 6088 msiexec.exe Token: SeCreatePermanentPrivilege 6088 msiexec.exe Token: SeBackupPrivilege 6088 msiexec.exe Token: SeRestorePrivilege 6088 msiexec.exe Token: SeShutdownPrivilege 6088 msiexec.exe Token: SeDebugPrivilege 6088 msiexec.exe Token: SeAuditPrivilege 6088 msiexec.exe Token: SeSystemEnvironmentPrivilege 6088 msiexec.exe Token: SeChangeNotifyPrivilege 6088 msiexec.exe Token: SeRemoteShutdownPrivilege 6088 msiexec.exe Token: SeUndockPrivilege 6088 msiexec.exe Token: SeSyncAgentPrivilege 6088 msiexec.exe Token: SeEnableDelegationPrivilege 6088 msiexec.exe Token: SeManageVolumePrivilege 6088 msiexec.exe Token: SeImpersonatePrivilege 6088 msiexec.exe Token: SeCreateGlobalPrivilege 6088 msiexec.exe Token: SeCreateTokenPrivilege 6088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6088 msiexec.exe Token: SeLockMemoryPrivilege 6088 msiexec.exe Token: SeIncreaseQuotaPrivilege 6088 msiexec.exe Token: SeMachineAccountPrivilege 6088 msiexec.exe Token: SeTcbPrivilege 6088 msiexec.exe Token: SeSecurityPrivilege 6088 msiexec.exe Token: SeTakeOwnershipPrivilege 6088 msiexec.exe Token: SeLoadDriverPrivilege 6088 msiexec.exe Token: SeSystemProfilePrivilege 6088 msiexec.exe Token: SeSystemtimePrivilege 6088 msiexec.exe Token: SeProfSingleProcessPrivilege 6088 msiexec.exe Token: SeIncBasePriorityPrivilege 6088 msiexec.exe Token: SeCreatePagefilePrivilege 6088 msiexec.exe Token: SeCreatePermanentPrivilege 6088 msiexec.exe Token: SeBackupPrivilege 6088 msiexec.exe Token: SeRestorePrivilege 6088 msiexec.exe Token: SeShutdownPrivilege 6088 msiexec.exe Token: SeDebugPrivilege 6088 msiexec.exe Token: SeAuditPrivilege 6088 msiexec.exe Token: SeSystemEnvironmentPrivilege 6088 msiexec.exe Token: SeChangeNotifyPrivilege 6088 msiexec.exe Token: SeRemoteShutdownPrivilege 6088 msiexec.exe Token: SeUndockPrivilege 6088 msiexec.exe Token: SeSyncAgentPrivilege 6088 msiexec.exe Token: SeEnableDelegationPrivilege 6088 msiexec.exe Token: SeManageVolumePrivilege 6088 msiexec.exe Token: SeImpersonatePrivilege 6088 msiexec.exe Token: SeCreateGlobalPrivilege 6088 msiexec.exe Token: SeCreateTokenPrivilege 6088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6088 msiexec.exe Token: SeLockMemoryPrivilege 6088 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 6088 msiexec.exe 6088 msiexec.exe 1392 jjsploit.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 6088 msiexec.exe 1196 msiexec.exe 4248 MsiExec.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1196 wrote to memory of 4248 1196 msiexec.exe 89 PID 6088 wrote to memory of 1392 6088 msiexec.exe 93 PID 1392 wrote to memory of 4996 1392 jjsploit.exe 94 PID 4996 wrote to memory of 6900 4996 msedgewebview2.exe 95 PID 4996 wrote to memory of 6168 4996 msedgewebview2.exe 96 PID 4996 wrote to memory of 6168 4996 msedgewebview2.exe 96 PID 4996 wrote to memory of 6168 4996 msedgewebview2.exe 96 PID 4996 wrote to memory of 6168 4996 msedgewebview2.exe 96 PID 4996 wrote to memory of 5996 4996 msedgewebview2.exe 97 PID 4996 wrote to memory of 3200 4996 msedgewebview2.exe 98 PID 4996 wrote to memory of 3200 4996 msedgewebview2.exe 98 PID 4996 wrote to memory of 3200 4996 msedgewebview2.exe 98 PID 4996 wrote to memory of 6444 4996 msedgewebview2.exe 99 PID 4996 wrote to memory of 6444 4996 msedgewebview2.exe 99 PID 4996 wrote to memory of 6444 4996 msedgewebview2.exe 99 PID 4996 wrote to memory of 6444 4996 msedgewebview2.exe 99 PID 4996 wrote to memory of 6444 4996 msedgewebview2.exe 99 PID 4996 wrote to memory of 4664 4996 msedgewebview2.exe 101 PID 4996 wrote to memory of 4664 4996 msedgewebview2.exe 101 PID 4996 wrote to memory of 4664 4996 msedgewebview2.exe 101 PID 4996 wrote to memory of 5528 4996 msedgewebview2.exe 102 PID 4996 wrote to memory of 5528 4996 msedgewebview2.exe 102 PID 4996 wrote to memory of 5528 4996 msedgewebview2.exe 102 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.6_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Program Files\jjsploit\jjsploit.exe"C:\Program Files\jjsploit\jjsploit.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1392.3796.17745082384850165263 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbc21a5fd8,0x7ffbc21a5fe4,0x7ffbc21a5ff04⤵PID:6900
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1704 --field-trial-handle=1712,i,7108748714407855782,4663968314474866843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:6168
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2008 --field-trial-handle=1712,i,7108748714407855782,4663968314474866843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:5996
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=1712,i,7108748714407855782,4663968314474866843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3444 --field-trial-handle=1712,i,7108748714407855782,4663968314474866843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f /prefetch:14⤵PID:6444
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4584 --field-trial-handle=1712,i,7108748714407855782,4663968314474866843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4584 --field-trial-handle=1712,i,7108748714407855782,4663968314474866843,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:5528
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 38792C49CD5E3AE4D7331FD685BF8C1E C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4248
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:6840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58db1a.rbs
- Size 21KB
- SHA256 92bfc662468f2b2d5c43eb1157f571f71692a990e8f3d53562a6ecc5eb99f18b
- MD5 b12cf4a0c024927f7cfe0fb6418b4663
- SHA1 edff7b929324020ee266e0a382139b3d60ee6044
- SHA512 9e65f4ae582dfd4d13f32e7214afd8a9ba5d74624413ca27b9a46e9e2e4e3b65d9d474db4281c72155e7c6ad60700b5f38acd0a0d1b2ef25c2a13b04091d33b4
- SSDEEP 384:ReTKsnkLZWdVtgGEADq5iSz2WkLst8t8t8t0tstststststststitztzty5L5Us:ReTKsnkLYdVtgGEADq5iSz2WkLst8t8U
- TLSH T139A23282AB50C2A2D19B07B4EF9B57413B71C8CEA349420B46DC527A8DD73903FF999D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\jjsploit\jjsploit.exe
- Size 17.8MB
- SHA256 324e940b37f08ba22399e9bddf5fb500ff2391e46317c1439b71d07ecabd419c
- MD5 5ae6a31cd8167d216b8b96e937abcdf6
- SHA1 5ede9de8b330d9d4b5220f50144b485aef77c6ee
- SHA512 ad8d67474f94aa248e36bbafaf7305d23bc1ce6c108adb46af1c31748a867b54f97dcb6fb9fd390f06b537238ca35d560ea8005cff0938e1806cc55771b66059
- SSDEEP 98304:Klu18o6AJASq4d1DbDTAb8T7wB7yOGHZESVvI6iOSfat5IgqkZvuid3L5HQi1+Zf:Khoq0bDT2EGGUa5Hw6yZ1OtWKO9
- TLSH T1A217F820BF9B59ACD05EC470834B8A724A7570CB0B35B9BF888555392F6EBF41F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
- Size 1KB
- SHA256 e169322869f1917ff519191916c49332c778b61d6332ea715ebacdc5a7264d5d
- MD5 8de5e9f40206ba4d05807518eeebfec8
- SHA1 8c1da4b4a40d64cc692b805aa755a3a986428ab3
- SHA512 f2b47c898ed9b7a63f6fee60dd47c4c7a92cfb48dd1d2e73865de61efbc9e11eaeb4b6135e987a232eefd6db17909eaca877bea061a127018e66f040befce8b3
- TLSH T13341A31456F50329E3E1CA3D6D621751C97BFC35A9A49F9680C5428E08A4600D9BDF3A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58ded2.TMP
- Size 1KB
- SHA256 bc996d598a49465a427f68f6f43a6affb4d5e0805e8889f11127d34e198c24bc
- MD5 6d38233a537eb5bbd04a95ea9aea17a1
- SHA1 9921c25d03ad31fb19fe835d0d0752fe35c89e1e
- SHA512 81767de39fab226e2087a3f6bf877c20b5425776de9b4c68bdafa99a818ff240202dc8bcdb536b2da1721a1b8f67e102faf0b66b1f29961ff63287f69f9d1a6f
- TLSH T1A741A21456F50629E3E1CA3D2D921751CA7BF835A9A05F9680C5028E48A4600E97DF3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC06D.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 3951add06f9af9e84c78b31502ec8577da2e909612f4b346437ae1830fea8e36
- MD5 7cb2b0b06699770fae1e221abf70edda
- SHA1 723ecab47f7b79a8f22d5816e02d700a1bf622dd
- SHA512 e8f9c5af682956233499c535e9cfd3a7db185d4b80f505720af61eec0f69460634368d4246975c1fb52337571dd8c8d17bb4d083e0849f0ce9112ed8ad3eb11e
- TLSH T1C5D004D15705004CC0C755F14431C110315544100C01151451345114DDC00013303510
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 cbb69c7287485934c55155a0928638ea01ed8095f08cc49b99c60bd611b855e0
- MD5 94f645acc2b6869265685ffd0218558c
- SHA1 8431c7722d2ac674d9141766bfbd5e03aee180d7
- SHA512 1365e9eb35712d4ec53ba214e018580177514db385f38f385abed46e9a9cae4c3beae8b1b18b5ce0a27c453023234fcb1af37b40f8251b8781c18585fd8fca66
- TLSH T1E9D012533702017CC05225B30423A1082441C11B44054004A43CD62DAF840502B03851
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\0db0b756-e7e0-4991-866f-a5fa043d01d5.tmp
- Size 6KB
- SHA256 8d2c733497b663337002f818ab904b5d5d321e6977ca64b630a2f215d9ed06b6
- MD5 32d2ed66c16da02d21d5b455f91a99d5
- SHA1 953be93d8019cc803420d5119d9ce7086731ce0f
- SHA512 80c8f7cb195cc44f12640554d516ecddc408238c0b1ca39b3a9a014a2ec8059d683050080e042dfc161a1143d9c3ad6c5c94f09e26b63b49a3ff75b1b8d20e79
- SSDEEP 192:stVfmY7PPUOo+VQsV+FNVW7QoVvV4J90lB+G6K:st9msOsGmQhK
- TLSH T113D195436E28697B4CCAE149BA39FA1BE2F9603261D11E58EBF8471C05DB6DC2307C07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 4a801fb3e0f8d7b08ddf203e8e14beeec90b7437943cd38888f5a0cf67a60d5f
- MD5 bf92c70fcd49794823d01eac5bb577d7
- SHA1 4c824982919e99ec069ee22f1c287820e8b9d2e0
- SHA512 cf92da2c2c85b885d3c2990b84ab06f2ae6c3a24ac0fca7d1f5575bcd9eaeb95ae2c1c34920dae3282062a317631583824e612200f2d4a0f17b412ef5cee4b73
- TLSH T12FC01212D31008D8EBF316F150C39C18323E1D2501430F8213F404B4A437756C123048
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5953a4.TMP
- Size 48B
- SHA256 0b979b084c8819ef414cf65e4e4cfc398d7813d704ca9bc345f4d72516dbcb2f
- MD5 202b06c6cd32db2a6c7afcb2bb533fb3
- SHA1 476fd80a492c4a327ae6f01518d5097a56833f2e
- SHA512 93463a0fd75bb1dff079b56e4d3d964ac00a923d0b6543fc85a9aba0c8335dd982c0466091f23cd138ea941252ca5307a574b4c9665ee5960ed3232ca9b4fe0b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
- Size 2KB
- SHA256 7e7c3c1224bd9589b05d69c28be96e19c3f0140ad137160504a86f62c5dcd869
- MD5 c4caccb93c4b7f6c2687e87b5e9b51f3
- SHA1 6c508c0c0f0ceeebee8abf36efc8c33f4e83467f
- SHA512 54700beec2b4f8be3fdd045b2100693fd7a0f5c8fb6e1ab0821c0dffe5ad907a9a8e2c4a1eca28ec6ab2ea53a36f83f53515db1734bd39952815e269905dfd28
- TLSH T1DB5188BBCBE4865EC85196FA26243D1BCF1D081C46B83D6D89D5EF8B63E1071D30564E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5a13d7.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 2KB
- SHA256 32991b6b60a5f02de886653d19f5043ee178979aa84c8ff9f7d7a228de221706
- MD5 523d2df066679ef87ee37758a59389b0
- SHA1 1302197b1de2cdac20958450716b1251db3e0da5
- SHA512 40ee0410377d7069634972bd7d56a01799e57ac5ddb02fe7626a5e7ce86e8e002b4df66d90994c070dc738a564ec54422de1e767479f91d751962a36615b9487
- TLSH T1DF51D6736D149E3788A6CA88BE867F57DE3550A5BB522F54A6DD0B0C01C754C170BC3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 3KB
- SHA256 fcc83229064392d4ec8050d35cd020098fca354302a6a50da4fb73960dbcfbeb
- MD5 12f1b3dab71a252f4a2d9049a30c0f9e
- SHA1 3fb986f972efbd1855a58ace66511af96dc69164
- SHA512 e28c44136f2c363a9f2414e9ba385faec598530a5370d292b3249c296eeed0e5c1787452109399ee3db166c4dbbf3295a93c2eaa055a59f19007ddafdf20da83
- TLSH T11671B57B5E64DD374DA7CA49BD862F0AABA55027A6913F98D6EC0F0C02C728C1357C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 15KB
- SHA256 16647f233f0a4cbb1aafe27b50333f32bb2cdde3758931bed970256945d16b36
- MD5 037489134a71b138a997353580ddbdb8
- SHA1 55c4557e33ee73c051dbc152790e23b337fb2a97
- SHA512 57e688571abe1d3a4a7c984d39402c5521c8dde67831c4d1c1892fe65381a112b1257d707e0114de3e3f13224619848b7e79ee3362b7416765ff16c5cd8244b3
- SSDEEP 192:8bZsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7viHNBSGjb2eou:Gsrv+89zHqlDNP9oidBNBShGTpvIO9Nd
- TLSH T1C872AF73D93CAA339DB6D949F48A7F0B7F78609652C24BA4D99D0B4D428B0C92307D53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe58ffc7.TMP
- Size 1KB
- SHA256 5099adc3ce00ba4357c4952f32235260764cb0ced1ce75ad3d999db8cb5e8587
- MD5 842825c2f206e6d471e5b17e065a96e6
- SHA1 3239b5cc8204502104488cff054663242b3788f6
- SHA512 ca46c952b88c26ab11b80d8b37861be02536b71a974e63e418ec24d565ea2f07a375a2097ac1738879407fb3d1d7f4f1e059f93d165305a27ae47a35031c6789
- TLSH T10B3174F38A648E32AC56D58A7642AF9B6E3110AA63114F0871DE070C02D744C9A3FC35
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e58db19.msi
- Size 6.1MB
- SHA256 a8a547cf25bc242a551238e557e24b4edb9af153ec27da2830e096e3c064dc43
- MD5 51c312bba8c70cfbec72f41eef975c04
- SHA1 621fc67cd19f1f963e73c268b0a851e9a7538d0b
- SHA512 27930d55c34a5351fcd2ebe20dc359700d62d411dc9cd195298a8992e7ca5a6826020be607c20485e3a2e14e990061464885bf1ec318d913b142f8f7f2f18577
- SSDEEP 196608:aZTuReE1Wse6573++uQoyYsGKWpizgm1j9wtV:w0/1Wsei32JLKWpqHQ
- TLSH T18A563357BD41C9A2DA2A1D35083E87A11739BC155FAA1D1337A4728DDEF23C08FB29D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-bn.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-mr.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4996_1085018986\hyph-nn.hyb
- Size 141KB
- SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
- MD5 f2d8fe158d5361fc1d4b794a7255835a
- SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
- SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
- TLSH T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH