Analysis
- max time kernel
148s - max time network
159s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 04:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjsploit_8.17.9_x64_en-US (1).msi
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
jjsploit_8.17.9_x64_en-US (1).msi
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target jjsploit_8.17.9_x64_en-US (1).msi
- Size 6.0MB
- Sample260706-flcsfadx2r
- SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
- MD5 11554209ebea8dd6a79759b131da131f
- SHA1 5a9a794e5b18389c31b00ce714111d0107061055
- SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
- SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
- TLSH T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3880 jjsploit.exe - Loads dropped DLL 1 IoCs
pid Process 4576 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jjsploit.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua msiexec.exe File created C:\Program Files\jjsploit\jjsploit.exe msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\god.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\fly.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua msiexec.exe File created C:\Program Files\jjsploit\Uninstall jjsploit.lnk msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua msiexec.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFB326B6A771E1AD53.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\ranked_dicts msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\test.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\Installer\e58da5d.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462} msiexec.exe File opened for modification C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon msiexec.exe File created C:\Windows\Installer\e58da5f.msi msiexec.exe File created C:\Windows\SystemTemp\~DF94458527C1846ACB.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\female_names.txt msedgewebview2.exe File created C:\Windows\Installer\e58da5d.msi msiexec.exe File created C:\Windows\SystemTemp\~DFBA1716FEA1B31B7D.TMP msiexec.exe File opened for modification C:\Windows\SystemTemp msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\male_names.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\passwords.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\surnames.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\us_tv_and_film.txt msedgewebview2.exe File opened for modification C:\Windows\Installer\MSIDDD8.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\english_wikipedia.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2112_1740952093\model.markov msedgewebview2.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF956B915B0F325EA2.TMP msiexec.exe File created C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000defd50087e4d8ef30000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801defd50080000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101defd5008000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3defd500800000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6defd500800000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\MainProgram msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductName = "jjsploit" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\PackageCode = "9FC2B6F90A0842C469E6F4CAD3052A7D" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Version = "135331849" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductIcon = "C:\\Windows\\Installer\\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\4AE2EEAC5F7A551409844DBE6BAF4F26 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\PackageName = "jjsploit_8.17.9_x64_en-US (1).msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\External msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\DeploymentFlags = "3" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5964 msiexec.exe 5964 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 2112 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4180 msiexec.exe Token: SeIncreaseQuotaPrivilege 4180 msiexec.exe Token: SeSecurityPrivilege 5964 msiexec.exe Token: SeCreateTokenPrivilege 4180 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4180 msiexec.exe Token: SeLockMemoryPrivilege 4180 msiexec.exe Token: SeIncreaseQuotaPrivilege 4180 msiexec.exe Token: SeMachineAccountPrivilege 4180 msiexec.exe Token: SeTcbPrivilege 4180 msiexec.exe Token: SeSecurityPrivilege 4180 msiexec.exe Token: SeTakeOwnershipPrivilege 4180 msiexec.exe Token: SeLoadDriverPrivilege 4180 msiexec.exe Token: SeSystemProfilePrivilege 4180 msiexec.exe Token: SeSystemtimePrivilege 4180 msiexec.exe Token: SeProfSingleProcessPrivilege 4180 msiexec.exe Token: SeIncBasePriorityPrivilege 4180 msiexec.exe Token: SeCreatePagefilePrivilege 4180 msiexec.exe Token: SeCreatePermanentPrivilege 4180 msiexec.exe Token: SeBackupPrivilege 4180 msiexec.exe Token: SeRestorePrivilege 4180 msiexec.exe Token: SeShutdownPrivilege 4180 msiexec.exe Token: SeDebugPrivilege 4180 msiexec.exe Token: SeAuditPrivilege 4180 msiexec.exe Token: SeSystemEnvironmentPrivilege 4180 msiexec.exe Token: SeChangeNotifyPrivilege 4180 msiexec.exe Token: SeRemoteShutdownPrivilege 4180 msiexec.exe Token: SeUndockPrivilege 4180 msiexec.exe Token: SeSyncAgentPrivilege 4180 msiexec.exe Token: SeEnableDelegationPrivilege 4180 msiexec.exe Token: SeManageVolumePrivilege 4180 msiexec.exe Token: SeImpersonatePrivilege 4180 msiexec.exe Token: SeCreateGlobalPrivilege 4180 msiexec.exe Token: SeCreateTokenPrivilege 4180 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4180 msiexec.exe Token: SeLockMemoryPrivilege 4180 msiexec.exe Token: SeIncreaseQuotaPrivilege 4180 msiexec.exe Token: SeMachineAccountPrivilege 4180 msiexec.exe Token: SeTcbPrivilege 4180 msiexec.exe Token: SeSecurityPrivilege 4180 msiexec.exe Token: SeTakeOwnershipPrivilege 4180 msiexec.exe Token: SeLoadDriverPrivilege 4180 msiexec.exe Token: SeSystemProfilePrivilege 4180 msiexec.exe Token: SeSystemtimePrivilege 4180 msiexec.exe Token: SeProfSingleProcessPrivilege 4180 msiexec.exe Token: SeIncBasePriorityPrivilege 4180 msiexec.exe Token: SeCreatePagefilePrivilege 4180 msiexec.exe Token: SeCreatePermanentPrivilege 4180 msiexec.exe Token: SeBackupPrivilege 4180 msiexec.exe Token: SeRestorePrivilege 4180 msiexec.exe Token: SeShutdownPrivilege 4180 msiexec.exe Token: SeDebugPrivilege 4180 msiexec.exe Token: SeAuditPrivilege 4180 msiexec.exe Token: SeSystemEnvironmentPrivilege 4180 msiexec.exe Token: SeChangeNotifyPrivilege 4180 msiexec.exe Token: SeRemoteShutdownPrivilege 4180 msiexec.exe Token: SeUndockPrivilege 4180 msiexec.exe Token: SeSyncAgentPrivilege 4180 msiexec.exe Token: SeEnableDelegationPrivilege 4180 msiexec.exe Token: SeManageVolumePrivilege 4180 msiexec.exe Token: SeImpersonatePrivilege 4180 msiexec.exe Token: SeCreateGlobalPrivilege 4180 msiexec.exe Token: SeCreateTokenPrivilege 4180 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4180 msiexec.exe Token: SeLockMemoryPrivilege 4180 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4180 msiexec.exe 3880 jjsploit.exe 4180 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4180 msiexec.exe 5964 msiexec.exe 4576 MsiExec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5964 wrote to memory of 4576 5964 msiexec.exe 89 PID 5964 wrote to memory of 2176 5964 msiexec.exe 94 PID 4180 wrote to memory of 3880 4180 msiexec.exe 97 PID 3880 wrote to memory of 2112 3880 jjsploit.exe 98 PID 2112 wrote to memory of 932 2112 msedgewebview2.exe 99 PID 2112 wrote to memory of 1356 2112 msedgewebview2.exe 100 PID 2112 wrote to memory of 1356 2112 msedgewebview2.exe 100 PID 2112 wrote to memory of 1356 2112 msedgewebview2.exe 100 PID 2112 wrote to memory of 1356 2112 msedgewebview2.exe 100 PID 2112 wrote to memory of 5144 2112 msedgewebview2.exe 101 PID 2112 wrote to memory of 472 2112 msedgewebview2.exe 102 PID 2112 wrote to memory of 472 2112 msedgewebview2.exe 102 PID 2112 wrote to memory of 472 2112 msedgewebview2.exe 102 PID 2112 wrote to memory of 5172 2112 msedgewebview2.exe 103 PID 2112 wrote to memory of 5172 2112 msedgewebview2.exe 103 PID 2112 wrote to memory of 5172 2112 msedgewebview2.exe 103 PID 2112 wrote to memory of 5172 2112 msedgewebview2.exe 103 PID 2112 wrote to memory of 5172 2112 msedgewebview2.exe 103 PID 2112 wrote to memory of 3620 2112 msedgewebview2.exe 107 PID 2112 wrote to memory of 3620 2112 msedgewebview2.exe 107 PID 2112 wrote to memory of 3620 2112 msedgewebview2.exe 107 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.9_x64_en-US (1).msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Program Files\jjsploit\jjsploit.exe"C:\Program Files\jjsploit\jjsploit.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3880.5720.2741054477221538059 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff800e05fd8,0x7ff800e05fe4,0x7ff800e05ff04⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1780,i,10016196353514597103,8753271380398904772,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1780,i,10016196353514597103,8753271380398904772,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:5144
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=1780,i,10016196353514597103,8753271380398904772,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:472
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3312 --field-trial-handle=1780,i,10016196353514597103,8753271380398904772,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f /prefetch:14⤵PID:5172
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4620 --field-trial-handle=1780,i,10016196353514597103,8753271380398904772,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:3620
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 54848499B88B50C36DD112AEDBEFC646 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4576
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2176
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1120
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58da5e.rbs
- Size 21KB
- SHA256 6707cd9bff2eaa91e08901abd26604768301f847c64b9da39789eee14adaf3aa
- MD5 7f73ff341097517546156d9361dfdf5b
- SHA1 d12f829d8371280cf8f409ce632d7ff080c7d8ee
- SHA512 def5e1400619ec1f518a887bfa4f0fdb422f73bb132d65155a671fd5109f5b7ffecf87af1dc69bdb30fc0ea62d01f71f297fd384c9935a2fbdf1acc74294cf34
- SSDEEP 384:XEZAB7OTEXTIrY8nTZoWjdLRWixst8t8t8t0tstststststststitztzt+VGw/wW:XEZAB7OTEXTIrY8nTZoWjdLRWixst8tv
- TLSH T1A4A201835A50C2E6E66B0774DB975B043B72C58E9358420B46CC827A9D877C83FF9A8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\jjsploit\jjsploit.exe
- Size 17.6MB
- SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
- MD5 f5b2fd9a39c097322b6cb663cca5b4e8
- SHA1 08c113bccec7d3cdf4f6a2b313d1b1421ad62f85
- SHA512 490b5c18b55ca136782d2f25e8f8b86a3cc5ae0ad25fda274bfe1a3adc759cbbb8f11592f6e7ad3451b758199e90db482767f4ebae7d93db61d8b90b3f61aae8
- SSDEEP 196608:h9Uzqh1cmdDOf+IHFLU/6NW+tiFZJXij:MzqoyS+IHFI/extiFZJXi
- TLSH T139070725BE8B996CD05FC474834B8A720A7570CB0B35B9FF448596392F6ABF41F38219
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
- Size 1KB
- SHA256 c7ac8bfde51e77fe8c08420441f0f07ac9b90b06f84f87dd3938c75a558905e6
- MD5 ebddef6fca24d94d3bd06ab1db3ef1b1
- SHA1 14699d9a711373726046e829c5dc837ec95d3b14
- SHA512 1d3fa4ea5a8bbdf8445a4c9f544dbb4ff0410193191863e31d75c90a207ac38bdd6c9d3981a420810845824d193e0863e242d754c18489bc247f33cd1b1e602d
- TLSH T10F41A00052F11337F3A685796F614361877AFC266DE49F6BC185418E4C74000DAADF7E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58e24d.TMP
- Size 1KB
- SHA256 40f62ce1b2731f03205fbc599dcc0c88032efd69b233bc88f41043302a4c5c69
- MD5 e53e0db18d30f6c753491c0b1b35b8a1
- SHA1 5d8c5f1b375f6bebc1b595e81aa779cd7d534dd3
- SHA512 422aae7ea563b4dc3fc3f2b42b6f1a1961d3a362c02533e35d65ff1f7f01cf73b7580d405b27cefb6bcd74d68cec1048569bd4d20dbeee25dc36c98b95857957
- TLSH T151419D0452F11737E3A685B96EA243618B7AF8255DE49F67C185018E4CB4000DEADF7E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8C6C.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 a27c4d839328cd3174c496d750ad2c6610a7f9a21712c1f096f928b831c68363
- MD5 62a70d6c86a79c0c489ac3e6add76390
- SHA1 33e4aeded91bbbb8b2023c622316bab20a463cbc
- SHA512 970540a71e8b8dbbd41e8188320647f90730d7ca61c802185a7630ba61ff562d516e701a65a7f54c2cc21fefc296cf6af629706b425eec12401333c6828afd33
- TLSH T187D0243733110534CC103C7315C3775D0511D11F4345C0005C3CD75D1F350511D03441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 7cada74d176387582ac8004e54d3605856534452374fde026330b4c62cb06c62
- MD5 c0b23d6537ae63c44c195c53cd49a824
- SHA1 d123a1de6f0f8049933875829c9e046eed3707f8
- SHA512 d46d34faae3eabc30b1d94fe460aa7fabb172632d9e042986973a66fdca70d729df47e9a78fbc05ffc848b6bad9f4f94bf9e40a671e447e680f22ec0073c93ee
- TLSH T1DDD0043451100401DD015C7515D047754335D414035141100470D14405730035403000
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\7f382390-ecd0-4648-ad48-e14a981d709c.tmp
- Size 6KB
- SHA256 eff6c7d9eeb3c28578f3c5a945cc7e8b54cc476fbcc7797c53ec4b38796ab9a9
- MD5 409c4bfd03100c7e6c9a3599fd18d681
- SHA1 7d90c6d703cbb33edefc1ddb9c9e4a9af37858c1
- SHA512 db71ea2764a45f8d63c4e7cf401105a2cbf18d5adba9598722c80c2a9a8872875be8afe60eabf6ecb77aedd5045529ab038778a8bcdecb8a3766f2c832e9e827
- SSDEEP 96:stZ/dcLclRb9dk7o5h16ZPBs7/x+6MhmuecplC1enG/8G/0eQK+gJF28XM1C7K:st9mLiQo+BsV+FNlCQox0QzFG6K
- TLSH T197D1C4025F686A7B4CC6E249FA28FB17E2F5643261D55E48EBF8860C04DB6DD2303C0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 b9750ef53aaefe2f0cdfc88feb48357ad6c8c780e60990a2dd6e31572152d77d
- MD5 3ac104fa3f34fdfdfeff0f8c030057cd
- SHA1 a344171283a10d75ed5086205966639290dbfed3
- SHA512 6adc016a1d9e52b733c13232c0916e9d56b5b60b852966cfb2a5e62ebacfbf56c51f00cdd6f986668f0ebced12d79c3f75934aa474ad492af9773c0ea4c8faee
- TLSH T147C09210C304DAF8C385A6F1A4CB14F838B96A5E42874F6812C69CF0A421399930E982
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe595402.TMP
- Size 48B
- SHA256 a90266f68ca0a6f6b3a3f7d53969c749ee5d8421af57b7ad644099bf58134345
- MD5 771da8e629d5bf010b0faa9519c36495
- SHA1 b10424cabde91ce9aab7acf10e30cb03f3af3e17
- SHA512 691701e901574a092de2ca71dcb819a96298274e878a235acdbea7331b9c5e6cc361d7beb49ab5f8aa834f97a1b009624dec404958541ba2ccd811513fdd6086
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
- Size 2KB
- SHA256 dbb068850493ab2c47a8260b75a005f25f0d0a8bde16a7f351c098a63035284b
- MD5 0a55970485e9253cfa1a7f81cfa34ea2
- SHA1 ddfb395aefb06ac083699f378d37c35a6ccc2285
- SHA512 19ee8825cb96be90fabc0e995bfe081982316130038f5cf88b6089b1aeb8a0b525a717aeac115f2f4eec520e666a95f42b44211a7bedd4aa924ad27965e31230
- TLSH T1345198B7C6E886ADC82192FA1A243D1BCF5D091C06B83D6E89E5EFCB57D1470D21064F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5a11b4.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 3KB
- SHA256 24f4e1cd9f9269fb55fafe59e791be8e62b1c72d2644c0ee0a1bf2c036f552b1
- MD5 c18fb7c46220f4c16644ab0796c071a6
- SHA1 290aefd28b5cfd86b6ff98fad34905b8d996c3b9
- SHA512 d2ad6f80327d5c75dbb70219b74a3772ebf4b3e59a5fbe94210787e2c10eea57bfa4e7cbf1bb334626148ca6a8c8e688481212c2f09fc8db1781cffb8dc0e9e7
- TLSH T1C6716376A9649A374DA2DA48B9866F26EBA44067EA967F94E5EC0F0C01C739C1343C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 15KB
- SHA256 61b820bc93468efe6fbecccf2d03941f0c05f3fca686296f3bc8e83a8ca76ca6
- MD5 1d60024bec68d644e3a8a052cd7351d0
- SHA1 c6d4059ed73127b4d6fde099005bad8de11a8ae5
- SHA512 94ffa0050fe1777e4b2238c8ed74499c2b3eb1fdda983ad2f14551510eb90a90346895133b1c74277883690d4f4f9c933317fa60f3419cab6ace94e0f7df0049
- SSDEEP 384:bsrv+89zHqlDNP9oiddNBSxqgOOyOaMNj:wrv+4UNbd+XLQMNj
- TLSH T1E472AE33A63CA7375DF3C548F486BE177FB8649796C20AA0E5995B8D028B0C92303E53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 2KB
- SHA256 130ce16dd6de81c65bac03bdbe9ce33d82a3cc9153bd0159502823daed604971
- MD5 469915de8b8fb07b228f037ee04a31a9
- SHA1 f03dc5888f99e5c6e416b4598fb2b9966a2233dd
- SHA512 f2bdc33612e90f87898e523a76273fd11b556abde01bc0bc30924e2ccac0937dcc874fc5935142391486d58a61e98cb6a437bbaaec739212c3574333d864a9c1
- TLSH T10C51B573A9185B3789E28748B906BF73DE7440A6AB522F90A6DC4B0801C729C6343C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe58fd95.TMP
- Size 1KB
- SHA256 6518fe39668fd18bfc08f87d37bf041f5e67b49cf9aeb078e34b8bd388e1e271
- MD5 7426ac0b438cffb3ab2a697d854ffef8
- SHA1 075074b6458fbb95794e0e27e4d4c0810792f1e2
- SHA512 a4afb4872eb2a74dd1b01ca5c8a677606cd12bafb30492283de039b8ce6b533fd0626834a937fab2429c0021458fdc35da9f375675e57119dd538d4cfc1182f7
- TLSH T1243157F1D5540B33AC81A6497511FEE7EE7000BBA6119F4071DD870911D728DE66BC33
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e58da5d.msi
- Size 6.0MB
- SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
- MD5 11554209ebea8dd6a79759b131da131f
- SHA1 5a9a794e5b18389c31b00ce714111d0107061055
- SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
- SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
- TLSH T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 1183829ae0ec03ebb49e59efa7566557d6e979f36b2769ac0f34eae728b46d99
- MD5 a60e10faa72a8631d583da9befe0f320
- SHA1 ac77003d3f220648f8ae85464815dcc682cc4093
- SHA512 e9d0972be8508568e50ede162592f064ecce597e5279f0c6cc64f99dcd60e9fde53d383934fb6cc8220b39118572d652e338d5f8a27331661842a8a1d509ea60
- SSDEEP 24576:nFo3DMPDdoO/vvTL/yAcMilQ/b+23rLvERaeNRi06ZyapL98sYxGMVG9o+2:BHY
- TLSH T1C757A12437F92240E7F79E3DA8F06A23493A7D5B9C15DE8D45411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0850fdde-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a69e13ac-1982-436c-b29c-74fd3cb23e77}_OnDiskSnapshotProp
- Size 6KB
- SHA256 59c1f27730defb89ba6ff4f0c6e8af61159afdcce47bc36691b78199c9f6e423
- MD5 c411fe3802219a302c162b40e1ac5a03
- SHA1 2d8f947d843c0cc5ba6980cc81ccba56f484f58b
- SHA512 4340bbb5e3ddf8236538002edff6ad9e8a48819f278f6d712a4503d029f1605e7d0cda03bab6448fac13a0d1d1cdb6c75635c7054706163b1e94b6fd7eccc7d3
- SSDEEP 96:FeERhedavc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:9h5b++uVmN
- TLSH T107D189185AE54711E2B3AB3229F18557A477B911EF33CB8E0198238E6670A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH