hxxp://Google[.]com

Resubmissions

06/07/2026, 14:04

260706-rdjfssbz2j7

15/06/2024, 00:12

15/06/2024, 00:10

15/06/2024, 00:08

15/06/2024, 00:04

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
06/07/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Google.com
Sample260706-rdjfssbz2j

Score

7^/10

defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5260	jjsploit.exe
4480	jjsploit.exe

Loads dropped DLL 1 IoCs

pid	Process
1212	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
263	raw.githubusercontent.com
274	raw.githubusercontent.com
276	raw.githubusercontent.com
254	raw.githubusercontent.com
255	raw.githubusercontent.com
261	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Installer\e598ca6.msi	msiexec.exe
File created	C:\Windows\Installer\{DB57A607-BCE3-4609-9E06-7FC77899C403}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{DB57A607-BCE3-4609-9E06-7FC77899C403}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e598ca6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DB57A607-BCE3-4609-9E06-7FC77899C403}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E1D.tmp	msiexec.exe
File created	C:\Windows\Installer\e598ca8.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4152	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009f4cc38cfb5b1d5f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838019f4cc38c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e841019f4cc38c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f9f4cc38c00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea719f4cc38c00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278202917330902"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{F7F42D17-D6A5-4004-9BDB-E9AABE3D1D31}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\ProductIcon = "C:\\Windows\\Installer\\{DB57A607-BCE3-4609-9E06-7FC77899C403}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{FFBEB45D-A5DF-4CCE-9D73-BFEE5470650A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\PackageCode = "B88BD9D59AB4B1A46A412BBAA3D0B3D9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\Version = "135331848"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\PackageName = "jjsploit.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\ProductName = "jjsploit"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\706A75BD3ECB9064E960F77C87994C30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5356	msiexec.exe
5356	msiexec.exe
5608	msedge.exe
5608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
228	msedgewebview2.exe
6544	msedgewebview2.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4312	msiexec.exe
Token: SeSecurityPrivilege	5356	msiexec.exe
Token: SeCreateTokenPrivilege	4312	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4312	msiexec.exe
Token: SeLockMemoryPrivilege	4312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4312	msiexec.exe
Token: SeMachineAccountPrivilege	4312	msiexec.exe
Token: SeTcbPrivilege	4312	msiexec.exe
Token: SeSecurityPrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeLoadDriverPrivilege	4312	msiexec.exe
Token: SeSystemProfilePrivilege	4312	msiexec.exe
Token: SeSystemtimePrivilege	4312	msiexec.exe
Token: SeProfSingleProcessPrivilege	4312	msiexec.exe
Token: SeIncBasePriorityPrivilege	4312	msiexec.exe
Token: SeCreatePagefilePrivilege	4312	msiexec.exe
Token: SeCreatePermanentPrivilege	4312	msiexec.exe
Token: SeBackupPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeShutdownPrivilege	4312	msiexec.exe
Token: SeDebugPrivilege	4312	msiexec.exe
Token: SeAuditPrivilege	4312	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4312	msiexec.exe
Token: SeChangeNotifyPrivilege	4312	msiexec.exe
Token: SeRemoteShutdownPrivilege	4312	msiexec.exe
Token: SeUndockPrivilege	4312	msiexec.exe
Token: SeSyncAgentPrivilege	4312	msiexec.exe
Token: SeEnableDelegationPrivilege	4312	msiexec.exe
Token: SeManageVolumePrivilege	4312	msiexec.exe
Token: SeImpersonatePrivilege	4312	msiexec.exe
Token: SeCreateGlobalPrivilege	4312	msiexec.exe
Token: SeCreateTokenPrivilege	4312	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4312	msiexec.exe
Token: SeLockMemoryPrivilege	4312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4312	msiexec.exe
Token: SeMachineAccountPrivilege	4312	msiexec.exe
Token: SeTcbPrivilege	4312	msiexec.exe
Token: SeSecurityPrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeLoadDriverPrivilege	4312	msiexec.exe
Token: SeSystemProfilePrivilege	4312	msiexec.exe
Token: SeSystemtimePrivilege	4312	msiexec.exe
Token: SeProfSingleProcessPrivilege	4312	msiexec.exe
Token: SeIncBasePriorityPrivilege	4312	msiexec.exe
Token: SeCreatePagefilePrivilege	4312	msiexec.exe
Token: SeCreatePermanentPrivilege	4312	msiexec.exe
Token: SeBackupPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeShutdownPrivilege	4312	msiexec.exe
Token: SeDebugPrivilege	4312	msiexec.exe
Token: SeAuditPrivilege	4312	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4312	msiexec.exe
Token: SeChangeNotifyPrivilege	4312	msiexec.exe
Token: SeRemoteShutdownPrivilege	4312	msiexec.exe
Token: SeUndockPrivilege	4312	msiexec.exe
Token: SeSyncAgentPrivilege	4312	msiexec.exe
Token: SeEnableDelegationPrivilege	4312	msiexec.exe
Token: SeManageVolumePrivilege	4312	msiexec.exe
Token: SeImpersonatePrivilege	4312	msiexec.exe
Token: SeCreateGlobalPrivilege	4312	msiexec.exe
Token: SeCreateTokenPrivilege	4312	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4312	msiexec.exe
Token: SeLockMemoryPrivilege	4312	msiexec.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4312	msiexec.exe
4312	msiexec.exe
5260	jjsploit.exe
4480	jjsploit.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4736	4672	msedge.exe	82
PID 4672 wrote to memory of 4152	4672	msedge.exe	84
PID 4672 wrote to memory of 4160	4672	msedge.exe	83
PID 4672 wrote to memory of 4160	4672	msedge.exe	83
PID 4672 wrote to memory of 4160	4672	msedge.exe	83
PID 4672 wrote to memory of 4224	4672	msedge.exe	85
PID 4672 wrote to memory of 4224	4672	msedge.exe	85
PID 4672 wrote to memory of 4080	4672	msedge.exe	87
PID 4672 wrote to memory of 4856	4672	msedge.exe	88
PID 4672 wrote to memory of 4080	4672	msedge.exe	87
PID 4672 wrote to memory of 4080	4672	msedge.exe	87
PID 4672 wrote to memory of 4856	4672	msedge.exe	88
PID 4672 wrote to memory of 4856	4672	msedge.exe	88
PID 4672 wrote to memory of 396	4672	msedge.exe	92
PID 4672 wrote to memory of 396	4672	msedge.exe	92
PID 4672 wrote to memory of 396	4672	msedge.exe	92
PID 4672 wrote to memory of 476	4672	msedge.exe	93
PID 4672 wrote to memory of 3124	4672	msedge.exe	94
PID 4672 wrote to memory of 476	4672	msedge.exe	93
PID 4672 wrote to memory of 3124	4672	msedge.exe	94
PID 4672 wrote to memory of 6036	4672	msedge.exe	96
PID 4672 wrote to memory of 2624	4672	msedge.exe	99
PID 4672 wrote to memory of 2624	4672	msedge.exe	99
PID 4672 wrote to memory of 768	4672	msedge.exe	100
PID 4672 wrote to memory of 768	4672	msedge.exe	100
PID 4672 wrote to memory of 768	4672	msedge.exe	100
PID 4672 wrote to memory of 3564	4672	msedge.exe	104
PID 4672 wrote to memory of 3564	4672	msedge.exe	104
PID 4672 wrote to memory of 3564	4672	msedge.exe	104
PID 4672 wrote to memory of 4324	4672	msedge.exe	107
PID 4672 wrote to memory of 4324	4672	msedge.exe	107
PID 4672 wrote to memory of 4324	4672	msedge.exe	107
PID 4672 wrote to memory of 2236	4672	msedge.exe	109
PID 4672 wrote to memory of 2236	4672	msedge.exe	109
PID 4672 wrote to memory of 2236	4672	msedge.exe	109
PID 4672 wrote to memory of 4480	4672	msedge.exe	113
PID 4672 wrote to memory of 4500	4672	msedge.exe	114
PID 4672 wrote to memory of 3604	4672	msedge.exe	115
PID 4672 wrote to memory of 5384	4672	msedge.exe	116
PID 4672 wrote to memory of 1060	4672	msedge.exe	117
PID 4672 wrote to memory of 5384	4672	msedge.exe	116
PID 4672 wrote to memory of 1060	4672	msedge.exe	117
PID 4672 wrote to memory of 1060	4672	msedge.exe	117
PID 4672 wrote to memory of 5920	4672	msedge.exe	118
PID 4672 wrote to memory of 4312	4672	msedge.exe	119
PID 4672 wrote to memory of 2116	4672	msedge.exe	122
PID 4672 wrote to memory of 2116	4672	msedge.exe	122
PID 5356 wrote to memory of 1212	5356	msiexec.exe	125
PID 5356 wrote to memory of 1784	5356	msiexec.exe	129
PID 4312 wrote to memory of 5260	4312	msiexec.exe	132
PID 5260 wrote to memory of 228	5260	jjsploit.exe	133
PID 228 wrote to memory of 464	228	msedgewebview2.exe	134
PID 228 wrote to memory of 4556	228	msedgewebview2.exe	135
PID 228 wrote to memory of 4556	228	msedgewebview2.exe	135
PID 228 wrote to memory of 4556	228	msedgewebview2.exe	135
PID 228 wrote to memory of 5300	228	msedgewebview2.exe	136
PID 228 wrote to memory of 5432	228	msedgewebview2.exe	137
PID 228 wrote to memory of 5432	228	msedgewebview2.exe	137
PID 228 wrote to memory of 1056	228	msedgewebview2.exe	138
PID 228 wrote to memory of 1056	228	msedgewebview2.exe	138
PID 228 wrote to memory of 1056	228	msedgewebview2.exe	138
PID 5260 wrote to memory of 4480	5260	jjsploit.exe	139
PID 4480 wrote to memory of 6544	4480	jjsploit.exe	140
PID 6544 wrote to memory of 6572	6544	msedgewebview2.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8651ec188,0x7ff8651ec194,0x7ff8651ec1a0
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,15487252148548603035,7807822510342440396,262144 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,4707679806975047602,4570418771446616754,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,1528030810023499041,11914944267366386326,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,15038867951198039172,6367209779990455999,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,8479702568248843147,9760003311596733727,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5024,i,1502662684555643337,5172854261069912360,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,11377675708815207426,12103331454717218706,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,11901347422143946280,11486015937173691949,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,3671460589805150162,17907850222281062671,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,3671460589805150162,17907850222281062671,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,16323380411136585440,15234606982282924309,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6264,i,15734789419615372650,1969280039486615285,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6492,i,10322622970242740562,7959576482781976140,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6196,i,15812403256682686431,11306456231285202560,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6728,i,1827315515095725656,10218633578810725077,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,17078218333907854332,12135222481038876131,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,4303979359881117336,3109921606195105073,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,7734241776615204506,18370161763274642101,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,6213920647800617250,4225009011758739070,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7108,i,15963823343733467873,14324692997630418346,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,1518273889223127085,6703795390863113012,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:8
  2⤵
  PID:5920
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\jjsploit.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Program Files\jjsploit\jjsploit.exe
    "C:\Program Files\jjsploit\jjsploit.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5260.4932.6054319702213468919
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x18c,0x160,0x194,0x7ff842c1b078,0x7ff842c1b084,0x7ff842c1b090
        5⤵
        
        PID:464
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1812,i,237999399419348989,12650829233099093162,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
        5⤵
        
        PID:4556
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1880,i,237999399419348989,12650829233099093162,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
        5⤵
        
        PID:5300
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,237999399419348989,12650829233099093162,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3068,i,237999399419348989,12650829233099093162,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:1
        5⤵
        
        PID:1056
  - - C:\Program Files\jjsploit\jjsploit.exe
      "\\?\C:\Program Files\jjsploit\jjsploit.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies trusted root certificate store through registry
      Modifies system certificate store
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4480.6540.13653274053917255298
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:6544
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c0,0x7ff842c1b078,0x7ff842c1b084,0x7ff842c1b090
        6⤵
        
        PID:6572
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1832,i,13070018707947469123,4325805070752786210,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
        6⤵
        
        PID:6804
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1932,i,13070018707947469123,4325805070752786210,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
        6⤵
        
        PID:6828
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2328,i,13070018707947469123,4325805070752786210,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
        6⤵
        
        PID:6876
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3476,i,13070018707947469123,4325805070752786210,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        6⤵
        
        PID:7124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UC3YNONzSHPW12m3AT48fMHw
        5⤵
        
        PID:5768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.youtube.com/channel/UC3YNONzSHPW12m3AT48fMHw
        6⤵
        
        PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7488,i,1908873964065743177,14949306399219028998,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5776,i,9318797077106521700,13228796888777006948,262144 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5524,i,2095311722083363318,15858140896778518221,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:6428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6716,i,6669917645721991419,6459829989701999667,2097152 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:6500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,18237702023774848288,2889472387405490666,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:6772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,17130668452156403127,5668938911565555450,524288 --field-trial-handle=2364,i,10358314934061305164,4773040120278192570,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  - Modifies registry class
  PID:6856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:324

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5356
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 80588A882A5663B523843104F7CAD611 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1212
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598ca7.rbs

Path C:\Config.Msi\e598ca7.rbs
Size 20KB
SHA256 1f4d31bbcfd4f0de8518005c6743346ba3a2485f6a5e8f63e1db2b25f5c3c724
MD5 36c89b6a15e394342ba4ff0534d5fe07
SHA1 a90b9bbe355631e9c394135e7f4aefc6b02270ea
SHA512 4deb7af3653d270301a1163f509c2106d6a830fa7504cc27a86015e3609e6f97b94d521daa52d940c22a46b2d499d2a193b258385bcf865b3266df5a8ad7fa76
SSDEEP 384:8zi3A2zoGymjVA1+AIhWZ/oAWVqkt8t8t8t0tstststststststitztztNE8Exzp:8zi3A2zoGymjVW+AIhWZ/oAWVqkt8t8S
TLSH
T18CA220429F00C792E26B53B4EA9767153771D8CEA358820B468C433ADD973812FF6E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 a0d82c2d365045d1f2fc0e488fa1bdfccd43e3ddc130792a33e3727015f1b7a7
MD5 8a5526391fd33cb9b95b1d5ea2139990
SHA1 039f817b301f3386d3755f483831d171ed65bbab
SHA512 d32f486aea88569453d04e61327eb9f6c39a5635b90ef0248fe9320b35337dd2c650798284b2cad15d39c216fc0b80b323b485f266177e8386f5eecfd79cc075
SSDEEP 196608:++8tPU28DotIl6NxJ/LAF7OsvWquL41Z:R8tMBD7yxJ/LI71puLAZ
TLSH
T17307F821BE8B996CD05FC474834B8A724A7570CB0B35B9FF448596382F6ABF45F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 b453bf6cc796785d6c06577d97cecd13ee1f9cd6670c415e5418e228e442f511
MD5 563a309d6a72c1d244a0d462aa213f6a
SHA1 c8842781c1461a2b1d88855eb439892cc5c6b382
SHA512 88b44818e1dd8f252ddfe4e576f2ba65eda73af388bb3f56001a1b7d9914f70b25d50d5f46fa392bd79e45c21d92e8fd7139d8af773562d33573f6af6d970846
TLSH
T13E41F02026E54734E3B607797E7113229A7EFC26AE648F7F814402881854200D5BDF3A
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe599001.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe599001.TMP
Size 1KB
SHA256 22e1ff80af094da67be232e9d6ca631336bb80c109324e45a998b9d83d2c263d
MD5 63da4989bb2d507cd70003beb95f6673
SHA1 7c60ef8b8b26d63cdd3b90db2eb11f6b6f391cd4
SHA512 34b9934ab1799313fe628992262869525b8427397617aa5f3fc72388dc919d6966e0e290c766a900ee0332ac434dc5d5fc47747caa343b8da7d088bf7da89acd
TLSH
T16C410F2026B54734E3B647787EA20321AA7EFC26AE648F7B818402884454200D9B9F3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0d2007f7acf061ff8f1274dd3a5ec608936a9b3925b1eb7db6bf03ff814b10bf
MD5 6ec6d43d1fa2bf5442d81e7726d8c7f4
SHA1 45221784f4965f3075c7143a106d5aa176c03b28
SHA512 b143cf20de04fe9e03a253988873911a2446f8022b528a9c3ca965f9175ca5e25e2656890ccfcbe0c72cdaaf59138c3b2db92e2e82ad2902adbb027b50a94b7f
TLSH
T132E02BAAD831AC3708FA0B5820900B47EA5013172751850B7F3D82098FB533702828AC
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 0e82c9bb9f5915b7620073bc5ecf339048e5c30a35f158838276dd347ef7c9ce
MD5 abc2117c52a55a84569a66ac3fbc9602
SHA1 9ba5dbe24b417d5aa573847e992c2a722313f43f
SHA512 e7079b0a60b607f545a88bec352ecac178b927e5fd1145d3091e620000461887af0b763207a2716cb6283b146a84af363bcb1ef7c459815511890a637911787d
SSDEEP 48:y2ksdMkw2AlnIBaVwINRDp/3vW/ek7m4AdozLSx/ZgmS/mRvpk4FfoxaDDATo7zb:/HdRpRIB/0KRdK2pSyvAxaDDATq9YKh
TLSH
T1A0C1915452C21DA8E799C0329DF4CB947EF38354F5134F2BE1686BBE29023E94D3549C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 191KB
SHA256 a0eca02a47dbc77735e63d4b6b964b1705a3f75baee6d85757314cd88c504289
MD5 0bb79084ecf80dc76b9f420a65e9efad
SHA1 b4a8c7d9250459a7fd7be145b31e2f2df9c7f95e
SHA512 358fa39b14232a59c1fd6bab0c46dbfe3a7fc7c42e09ea5415914d0a4f500858722e022ec2a2d73854647af3d846070f10d625cc6009d2c12a3f6743c7d8f9b9
SSDEEP 3072:70LLMV+Hz6rhdF17MXhS+Ps1ETfQVoS+28lSfrmM/S+JN1ETfQ54fFTFOJErDpkL:Wz6UDh2meoA
TLSH
T17114E71863E693C9E53F837603065D26D339ADC4D59E7069FAB13A0D26B7B003F6076A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 3f71a4dfc7a911d71bb4971517ec9101b2e6991aa652d98aba5aa55df52c1fdb
MD5 24627df12ace46f8823b1ed3de4d0903
SHA1 26f3a8fcdfb3a96bb7b746826f32f855fb54c40c
SHA512 c8ba26f2d7133c2653682f57e2533daa6bf1ea473c4844349d8bbc3ad79d4b6aa92016cd3450caeb610c479b716338da1563e74b1acee34d739335c13d1b5da8
TLSH
T113E0C028C8C8C25F112070E700307B0FE1E7752ED7CDBD450F08C950704A448F56D1D0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e04a12157d8cfe2583409953fc1665a7ad56bc3b1e69f97ac9a739888d5b97bc
MD5 444a29feb58055b48e24fa082b0c1a6c
SHA1 a25e24f6be27c21f953a016dd0b114f8aa2933f2
SHA512 36916e31900e8c0c5d37285627069074e6de74c0fd4e21bad7fde7eb8dac2edba8f3398695ddf3688b95f91be9519a65d007148a82f2720a4dba3bc6626877cc
SSDEEP 192:D1OVPVLkMbiDLqaaij6vlqHxRXmw+GzL1xAWo9:D1OVPVLkMbiDLqaaiGvlqHxRXmw+GzLE
TLSH
T123E1BEF7C3E9821DD91156F4AB197E1FCE1D0A14432C3C2AC8D5AF5B93E2870E251A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 28d70cb06eb2155060bff4f12af00d55ba44f826a7cd3a87031c66106792f220
MD5 b8c153394659598731b7fcb1dc5c50fb
SHA1 04c6477007d023e685df25a566ae28d854b3053c
SHA512 537dea818f76e04fc492e30d7cf75089535b96fa0e668606df2fdab6865b1180ab27987cea1503559d1535e19e317c7dc9fb14248f676f6b77c1b8b18a073011
TLSH
T14CD02313120670B5796D7F854565EC8FC72621100441EDD411D069EE05714DC1607140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e175e5b629303281cc89e9f980b2ec6bda86e7ffe3f06588218ced198b3583b1
MD5 1b43a566cca09a85151ad932ea4a8379
SHA1 712d091c32f16b21c2f6f5ad8dfdd962c6c8d97c
SHA512 a477dc260a6247d46948ca685b1c32cac77a00701ddfca2e5fa6d8ac2c161dee136fb4bfd1498457189928feb3dd74c9edb7999d59aab8e5a9fd3499e201dfa8
SSDEEP 192:sxZGYRPyMqZjK1Ml8MkZ/fRsmbXHlCZtGzodpoojHW6+WNrIu/YqqSbGIgj3J:sxZGYYMZ/fRsmLFEt9VHbh/6jZ
TLSH
T13462E8166A349977CCDBD209FA45BF53D7F9116392904E44AAFC8B0C05E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 3de95ec7ea3bddde6cdc35a8e758eaf8d83356103468a741fa861065e1713038
MD5 3537b9f37dda234eb91ba38c95db65ce
SHA1 01281a6b52c140e67b2dbe4966f8e73820a1f3c5
SHA512 a4631921e4fbe30db9f50b0b2764f3e357e58df85dafea957865a3dfe66be9c5b3167b1aa7ed2e74d695bb72a26b5fb53425916bfa43f46bf321304da5db5d9c
SSDEEP 384:sxZGjYqsAm4Z/fRs+EEtFjHbYQEw/tPgDD:sM/Vm4Z/fnEgHbD4D
TLSH
T1ED92E853A534C9778DDBC619F964BF56D7F904629A914D48AEFCCA0C04DBAFC210382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 dab5756843c0cf6123b8494654e4789e57a052270bf1c35e8663288bddda6573
MD5 81ba3a1f63e74d2a255a7df26446e289
SHA1 f291af862ad2a74264aa461c1c5c2b84b7efdc41
SHA512 a55dbd78e3b1b91763df0631382f8ee4541f4550afb4862b377e378f7fda3791571f83981a6d9d23c8d68feaf5d4dcb66712358d32d2e059cfa0331c937f26fb
SSDEEP 384:sxZGYYqsAm4Z/fRs+EEt09HbiEw/FPgDD:sf/Vm4Z/fnEvHb4wD
TLSH
T19E82E956A634C977CDDBC609F964BF52D7F900639A514E48AAFCCA0C04DB6EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 651d18d7abaf1b4f4507289af79e93ffe95d6e230d9c89fe5a8aebdede26c27c
MD5 9dd7ae8c57ce3535e5c2baefe9ca8bf8
SHA1 42ae411589278d4b5e0d59c5b7cecdaffcbff912
SHA512 d3970861ce02bd450fc80ac93673893c9c190b78c5522e34d9398cded070a8ea2caf937ed0e05f9dcab65c8f17b0460350ce2b7ac68e6d0f0399bc5ac40ac43c
SSDEEP 768:+IM2tv5WvF32/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4sLl2cNV9rolDWr5ljo:+IM2tv5WvF32/u1ja1sLUcV2lqrc
TLSH
T1EED2FA3B680CCB7E4F840E9CDC265F976ED4018BA698495487FA494C03C77EB522B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 e318ec067937ba10c63783183a44e65f84b1bf5fef4b6d9048d167bd5df709f3
MD5 de70d7dadc9b8cf3a267eb261507f3a1
SHA1 c2e40feee7d5e374a8a255d4d1de37b98efbe0de
SHA512 e8fd68f0d0454043982c13692da0c61171755c8bb76082c79c754a513991e549037e49d0f04619eca3e2e3f5b77e1f3336110a39d4738b5dcaa67219acabb56b
TLSH
T18CD023D7413349562570EFCC9038765D411D8D45F941DC945804B057347C103C001B29
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 c6bf4452c2788f9e3175f3a85041936b7147b671b29a44a67b3c1471c587387c
MD5 0c4cf27d25242e5f22529ff37670ab7a
SHA1 a3463254d08f067f61467f811be5c98b52d42df3
SHA512 499cc81d022d922763057cbea9944e654382f0423f9c6bf440e8008d23cd9ef7b8a3d4898775bd1b45e251a5b16888a900c38b3c4316a6e7cdd7b2a6a1917446
TLSH
T1F4C09BE70511879A0974EFC41038BB1DD61F454898D5DCE8A4485117313C5134441765
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 b89819318a7700955140af77ef8884b551555eae8227d0f53d540421839de15b
MD5 8d040a61bd31b302b398599cce6260ad
SHA1 b659285c6fe5b0498b58246d8c7ec695931e7d46
SHA512 fdedcda11d5d7c2576a23b0930656f4e7525ecf6ebd795c092bc7099977683bf4c65f151e55954af209a07e3d252e8bcc8577be6cc8814219ac84aa51ab43ad4
TLSH
T1FCD0A7A36E61064956755FD5353CB56D861F9D48ADD1DC6859843216733C503C051B34
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a635f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a635f.TMP
Size 137B
SHA256 9d0cdd8d64371c2e586390c270c394c9dfe9403dc3d218a19485449badd23b06
MD5 f87975777bff728d51c721918cbaf3b8
SHA1 d2c95b8078eff306cf5158cee52a2eb8a2c0e2c3
SHA512 3bb4d7c169f42d40f9e1093ea50702e08f6171b042a6c7ab56b13452464df0680910eca144c17e22c0c52bf7d7311b3c11eb38fc57c68783ba793d73aa8c3618
TLSH
T1E7C09BE7051147960B70EBC41438BB5DD62F4D5998D5DCECE54D711B313C6138441765
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 8c18233beea4d7bf7c29ab02f24799ec692ccd58eeb2e8b4549231af57c5000e
MD5 cae5228bbb595d5b2b20ad3b58a3d139
SHA1 76574a7f1d8dbbb7517a47a0e26c9b78f2039415
SHA512 86ac232bc529f4207b26abbe326c983cb5bb9cfa78cb3a32d41caaf286ac6e22fea189c711185b77ca83d24448d64fbf10ce0cc906b1bc754d723257ec36e50b
TLSH
T150A0026045C54D27CC28077611D9818032D57818B54D8F53B59A0559CC532DDA269246
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 fcd9a5eb690bafaea3a31d1fa2cf55297075d312223a0b1f1efc877e4728a775
MD5 51efbf4da27dde424f960e96950d6ada
SHA1 7d89b92d468e1a8b5ecccbdc7a5993f7b478659b
SHA512 e18c1fd1c3a91cb6449832a058232ed0451c765c9dc62c47a3f6acfad45c3cd4a0e61659b3503b90790ad29573989dd4532c05c5f99bd417dc4a077b0523d3fe
SSDEEP 192:KrFjPXY9/gfrWThFLh/DNTVl37vqm7KmgIIJ46:K5jfYlgDWNF1/JTz3TG
TLSH
T162B25E16313B12027CBD2808A7A6D577DD8232B33119E66F7BAC04A64E67E125DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e5bfc3bce771370dcbc527943d770964644db930274f9789b57a4013e2cea213
MD5 652cc97b7c50b13fab933895db68d806
SHA1 ccf7f2962a7a71bd9f2c614b9f0a991b354f01e7
SHA512 dff96f1e17c54411addac77cd46f3ff91dbd779cf3b264da07b8b6a2d2010dc2945b17ea5ecb10e2cf12a8a080f952bbe64feafbea2a9d043c025dc7caacc701
SSDEEP 384:nNiF8tNn/s3n9SAn3sNT8TUNTUlI4AYn7fWE2Mz2iBf+UGfyFJboYvt1rcpTZOOD:EF8j+933gwgYzVGfi7cpTZ29MT
TLSH
T127F2E5F698D78A77D89E4B97A33D2D029AFCC157B6885984B7D81D0CCC871BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 633de171a2c8400c1b78fb8c99e81464cc399cbac04d006c493f19ad33426271
MD5 eaebd5e202e35e0b10378fc2cac6be9d
SHA1 e49258fc4a72fb1a278d0f26904ae80cb00c4041
SHA512 0bc7dea945ee258464ff078985eb8c63a5f6f1d1fe23aaa51e85dec8df84648122d618c1c358e459ff014766cf1d9e3a5aee2548f9fbc6f66192f7ab66b26558
SSDEEP 384:nNiFKtNn/s3n9SAE3sNLs8TUNTUlI4AYn7fWcMz2iBf+UGfyFJboYvt1rc9TZOOD:EFKj+9U3gswgdzVGfi7c9TZ29MT
TLSH
T1C8F2D5F698D78A77D89E4B97A33D2D029AFCC157B6885984B7D81D0CCC871BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cd8ba8644d6436a77369a834b1e537a654abff24385eb40184099695edb04cd8
MD5 bab491d5e7dd7d7f2b967cb5d9dd4cb6
SHA1 80710535840b2e908d132b6cd1e1f7460a0d587a
SHA512 28580d57667aed1e3fe797c8474c7447546eace3ae003b8ad02aa2b8c4cea45ce1d9b207680850572d268c832924780394cd94318c775e87da1cd204fb79323d
SSDEEP 384:nriF1tNn/s3n9Se3sNT8TUNTUlI4kYn7fWO4SiBf+UGfyFJboYvt1r5TZOObjI92:GF1j+9P3gwglhGfi75TZ29MT
TLSH
T131D25C36EC54CAB7EDE38AD9B74A3A03EEE442A7868C5AD4D9D85E0D01DB1DC4307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8e11dc9d2cd51a8ce991456dac03577ca7ae30fcb3541e72924b798320d405fb
MD5 182270ba15c8c3b0ed74d8bd068c0282
SHA1 f49e425df9b0a03d4d3b76207c8d58f99a95e546
SHA512 e3b18911717ea0fff8d9d71a87822e3214fba5812336c37a0825d50fd2cd94836bef28d9aade251ae87aa0d14eb08d918224623a8ac3110ce71a31a55bdc964e
SSDEEP 384:nriF9CcmyWC23sNT8TUNTUlI4kYn7fW7+SiBf+UGfyFJboYvt1riTZk0uXsnQjpA:GFccp23gwgAhGfi7iTZk0nnz
TLSH
T160B23B36EC58CAB7EDE74B99F74A3603DEE4416386C89AD4DAD81E0D01DB1DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0439cc0902a3b64c74d02c126ec32bbf7f4222899234a57d2627548a7bb8f9d2
MD5 65059e7944731f7a6392341fddc1b614
SHA1 81f37df547835af54e82a283a672b47da2c2b2b9
SHA512 a9c627399c92b7585b10026af0049fb39dac801725876d35c21ac3c91d169f36f760e83d7c11ced9b5a6ae67c9f3508aa5fdd3a041fed5ac2df4560570d4b89a
SSDEEP 384:nNiFrtNn/s3n9SAE3sNT8TUNTUlI4AYn7fWqMz2iBf+UGfyFJboYvt1rc2TZOObn:EFrj+9U3gwgfzVGfi7c2TZ29MT
TLSH
T189F2D5F598D78A77D89E4B97A33D2D029AFCC157B6885984B7D81D0CCC871BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9c4781e5db09b8b1eb16afb9440524587134b8588013252d3f89c15534fce63f
MD5 75a396b70762789602bb3f5ced905091
SHA1 bf8b91273b868d0e7af8354414f3e656be785539
SHA512 5c31f7fa95ccedb60917e9239818748c84e790c79ca3fde001a43b2c28d02f37e3c06a63c350e5b2b28324b7a33d10f0b771d46abe74190c9fb13410a2606f62
SSDEEP 384:nuiF1tNn/s3n9Se3sNT8TUNTUlI4kYn7fWOkz2iBf+UGfyFJboYvt1r5TZOObjIY:FF1j+9P3gwg1zVGfi75TZ29MT
TLSH
T101D25C36EC54CAB7EDE38AD9B74A3603EEE442A7868C5AD4D9D85E0D01DB1DC4307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 545731171007fa20083318ff64fab06a279acbf7fba8002bd0869e1693cfc410
MD5 f76be8ebc4232e6a895ede2ad4b232a1
SHA1 6580e7518b804c4024647c241bbf3a0e0951b272
SHA512 641ed239885f537e11b2bc0be9d71bd76f69a2ad14c0800e5221411ee60a1ea4cb67f1e64ad9dccc1e490af79d8cdd2ebff9ca0f14fb9eef44fb1178e6f04b8a
SSDEEP 384:nJiF9CcmyWCs3sNK8TUNTUlImkrn7fWmNmiBf+UGfyFJboYvole4KV8p0/Lpty/0:gFccps3BwgPFGfiElI8p0/LL
TLSH
T168B25B36EC58CABBEDE74F99B74A7603EEE0116786D899E4DAD81D0D00971DD030B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1d540540feabe4fb2b7ada9e706d63c01115b44912a0f365b340cadd758f91b0
MD5 8ca814bd41f7d18f0a49f6832dfadd67
SHA1 9d8f2bb72d4f88b84777cdd8a9127cf150ccf81a
SHA512 f2ae7721fda4188a1fbb29f244f220a354126bd7417a1be86ca6dd4fbb0caa3dc894ae699355ae6026880908cbe1c5fc43bf64739c0fca02961550b0402e5516
SSDEEP 384:nNiFBtNn/s3n9SAP3sNLs8TUNTUlI4AYn7fWcMz2iBf+UGfyFJboYvt1rc9TZOOD:EFBj+9f3gswgdzVGfi7c9TZ29MT
TLSH
T145F2D5F698D78A77D89E4B97A33D2D029AFCC157B6885984B7D81D0CCC871BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 fcb1473efed174458d1723e25b1615240693c0a7563ab14ddeefaa670cab0ffe
MD5 8d5c313840ec793f076f441112660a5a
SHA1 ddb6732bf38459c17613944705ddaf28c791a05a
SHA512 d7b4c35d7e6d89a18958e4230e477e87a0bc8215ab92694f394e59eeeeaa6fb533f0e25083db41e5cd7ce12fda79b62c49d76e3a057afc1227966539958bd8d6
SSDEEP 384:nNiFttNn/s3n9SAj3sNLs8TUNTUlI4AYn7fWwMz2iBf+UGfyFJboYvt1rcXTZOOD:EFtj+9z3gswgBzVGfi7cXTZ29MT
TLSH
T1AEF2D5F698D78A77D89E4B97A33D2D029AFCC157B6885984B7D81D0CCC871BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 42e5f75d04be01725fd43fc342cf1282a016ffa0c49962e2f4f6548db3577038
MD5 6b60617212cb9accd501e739b9bfdc3c
SHA1 ad3d3f1b30575d20eeb9799db209532ff5edccec
SHA512 47d28c1010271aa18046b097bddb4777a25c484a6a939edcac7e0ce20e24a08caab4476ce782aaee16af54d5abc52117d9f2c9f27abcfb0ba52ec2a759b2fbdc
SSDEEP 384:niiF9CcmyWCs3sNn8TUNTUlImkrn7fWtZjiBf+UGfyFJboYvt1rNTZe4KV8p0/LL:pFccps3wwgaOGfi7NTZI8p0/LL
TLSH
T181C24B36EC58CABBECE74B99B74A3603DEE05167C68C9AE4DADC1D0D009B1DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 45c153efd24ca02f26a5c1eaae056b787f9735e7ea6de87628e935924457f7a9
MD5 e89c002ddc2d167c565f152afb0b5586
SHA1 46d0ffa0c98f18dc10498d4c3df9883a32b67217
SHA512 464210f61f3a09894c56446d96616903ba463e39d7632f855db82e512dd3491b38c8b11b891ce7c1502bd4daacb4544c28984609617e463bef2c51c3b14ad019
TLSH
T1FBE0020392000497C064433001C31B206AE3941102A242058A2442683C223002E11680
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 10b00e4abfc59c1a6df495f9cdbbde824486798487bcd8ccd337c07a2f4feb23
MD5 3f0ce96d60c79d93f10af778d4485530
SHA1 16d3bf88b2a537ed25f1fb3bdea6f2b91e29bca5
SHA512 e573502a91d9c167c89d831333e35ddf318612212c293a2fccd5692632f6b47b9e10e1d6fcfd8286da032f76f80cbcae41c9ca50129f39f2e39edd210ab07b70
TLSH
T189E00103D30004E6C068433001C32B206BE3D42102B243178A2446683D233002E21B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d74244fe3b6859f257454f3df97f397edc2d452a91841c848c53ae4ea1b5e93e
MD5 eb1573afa3dc7e4082bb5e729a92681d
SHA1 75a7ae706f1b652f6e246b8313197541a482711d
SHA512 6281b369577446d2f1c4889c487f3e4fc16175aa2ded4861236c0554382e1cde97a82485d4e7ba42e40a3fd8c44eacb63c32a4669cead9aeb32d9978d206d472
TLSH
T13CE00203D30004E7C068433001C31B206BF3942103F343458E2446787C233002E21B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 614c2b52abaa5174b0933e98e1f0fa8ec13a2dfc19efaa78c01d2200f6ac2d4b
MD5 2d5abd524d524903e35c6c5a07d06039
SHA1 ec172ea95a8fd3c63a9746a5b81eb086217aacd7
SHA512 d7a77a03691c54db76bb674859efb7c91308754312a1da424282477873c7d2d6e2f65969c224951ef5eba6a11827e3910288e2e6e1a39fbaecd9998de7072305
TLSH
T1CAE00902930014A6C0A8437002C32F20ABF2D42112F247268A2446783D232002E21F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5887c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5887c9.TMP
Size 392B
SHA256 5a03e0240f3652c92b58c78da20f7207d4ab85bc8e73924e0b79625ca772bb42
MD5 1172ef47fe1e13233c0142e197e4bc23
SHA1 539fea8dd51dc76ad16d7d6c3875ed7bcf6eb6c2
SHA512 5fce19e508457415d964b38eba4333ab3ba97a5f02f6d0f67619aa44aaaa1d903266a4e02ed0fa1ff208dd7bde3cb634d53cf3fc4e036bfc661bd3ce5a695539
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 86088bc44a193a46cc0594205379524a5e5572f1a7df8fd07ecada3948bc9c35
MD5 6512ce68dff2c2b282e5f58f5647c451
SHA1 0fb11d3afb3e2e495cf4e1ccee8d5e13b36ebc97
SHA512 602e9ce0705cd9dfa1487f69a0d35ca46934c463959e6cdbe92830d610410fbddb4912834a47585b92e8b3f5993cb2b44045788c274c1fd5d7c12aca8d8c7ecf
TLSH
T16E412758B6EA0148B7B76F5A6BF6687E447FB9771F0AC15E00110E8F0B62A40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4ACB.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI4ACB.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bdc9a97a3b3cea02df8bd989d04f8612514480f4e90ec360b89934ab3c2657d8
MD5 4a9c256448604ec6c06a3d525999dd64
SHA1 32ce10422b385886d242ffa35a2122e4d599fa13
SHA512 9fec375ac20365ad3a363aba93a1a65ee4fa1ee7f30a15c726072c6dd7c49127ce1a955b028ffc98b611c260816032427d0a779e758d486f279b9bf2f6ad30e0
TLSH
T1D4D09B37F712467ED42474720291E9392E05B30F5146C115D43DC65D69694D74B828E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e60e104322fa6aeeec12a52472595018899da075bc7b1ce3444bfe0dd26d778a
MD5 e8dc0729e6735d7c3362673ac4b032aa
SHA1 bd1eca019d37fe9dbe3c3ec579cb1485f3c18ba9
SHA512 9ff9a0ee54b5e1be4e38516d66318d9741c450beb91bf2508fd2c15a35d8da8bf6b8965c6a72b0711aa706d6f9870041732517c2dd15ca4cc274358321003479
TLSH
T1E9D0C036F311523FC02034310180DC242B40620A70C6C33ED838C77C2C7C88B47D64E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d177506735b78cb4d1e7ec7dac52976a9d5bc47e4f4ec79908a736492a2b3605
MD5 0bbeeb2b93f9bc966d6baf8055912b9e
SHA1 d0b0d564fbfeb0d465b03b9b1d60a42354730bcf
SHA512 b71c76cb662546b4bba9ac4bd3c19855e5e59c0ed25f6188e7989bd55ad6ee60e58d8b0315d3838dfa5f20554b6c740bdf7d233c824a47edee0c926a9e1c7504
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 16ea612b2b8edc6d76a8568ed0ec02b5109580cc72a3b44eec85491e352d9c33
MD5 fa75f2b642e7ed1e9b10b5b9bc3feea8
SHA1 800ff55085a98470f5ba74735f2d1027277e7d61
SHA512 21f10b75f3cc404a04946f546f11691e073fd38269793e2bf6174d32890c82560d76797cc5a4c9b4b6c1b1229812526f4825b2a2971027073b0763260196e3c7
TLSH
T1A1D01132BB038238C02020330282AA082800C20B828AC200E83ACA2E2A280A00B03882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1bdb42d4c5f8872c7355eb78b649bcd353f265794e1e5aaf988733c7e2d9a5df
MD5 70c80f01b5751194da7a3bc949f46dba
SHA1 767871115942bd5ae8ed85c235d51d7bb2955e85
SHA512 d8c22cc51cb69f65136d722a01494c2be6db5871d79baa310f8a0008aee1ccbb4c602ed05d50b93ad39a57d7967cf7bf8d300d08d495912ea6c2839d2c303ff1
SSDEEP 6:/FSLIj+u9+/ENgUwE+GnEl+ED7R++GnE/YdkgnYwGceGKg70F1R+hXmyRUcFWaka:dnWMgUwWefWkYvnvT0whXvzk5A
TLSH
T12A13C23D4F900E0AC8E15C3D58B79BB4E778E204C512CF73C9307635A059B1D214D346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 149f03b412859fab1c9fc2d8193b09b1d15fadc770bf0de31ed66af1880f3457
MD5 3b29baa631bd17c94bf60c76ee1625c0
SHA1 f237b90029bd66882a83a06ba28bd25e7c358ee5
SHA512 180d65a4da9d0bad391cd0bf75b2f5a3d9b1d2b74262fdc20dbcc3d4a54c40efd5f396e641e4d92ebb58c130f438cb1b265a36c6a021f125ab582c2f114804a2
SSDEEP 48:Dyn9gs+1aIoSJwwNPAIDA+LX3LjVF3xa4:+gwIoSJ3M+LXNr
TLSH
T12B447DFF1B02E015CB5446F1458CAD3EA63B80BCBCF9F596FDA498A444E329D12A121C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 27534b30ae0d4eb8a45f29f76906ef8f23478f80d185c64f6babd9dddae93d17
MD5 6fe90fe44587a0b055799ef57fe47159
SHA1 a5bb9107b78aea147d8c57888bff394924d1b30a
SHA512 6df6a132ee71ea20e07b921071fe2a45420e9369c8997082fa7c806d8e41edc9068ca45914815c48298968e997bebd21bf99aec9fa58b450cf8bbc6cec9c616a
SSDEEP 24:WTNvAfMAM50rCnPs/EWsoAh59Q7hMrXvjVYPB4OSGOq/wzzlGgp7Znc:MV5Ps/OoKP7vjVJoq57Znc
TLSH
T10325E92017901F13E154E47217C7CF0E59497D48394631A1A84000B8D89F58D9BB071C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 67e02f0c4238f9967b2792c22926ae7956649468ea13a92cf24abc04e2e0e101
MD5 abe08c89a5bcc2cd6f1419102c172de5
SHA1 ac64751a6e4e04d5419ce406c5d8d00a0ca5ae8f
SHA512 7ceff05c3338fa30049bf842d57cb91a3688694a76c7421e48cd47390dff5da110ecc26cb6eb6fa9e752e830f8a72664f9db41944d548ee90778083139efdabe
SSDEEP 768:8i9dBg5PSW3gLXBvLG9zAAUgz6RC3g66TuGeTN3gZd9Jo3isNrgH2Nrg:n9f8PSW3wKnrz6RC3Z6AN3mod
TLSH
T1B4169DE74F78B902E952DEB0BBC8FD2D3D7102827596E5D3E44782B828D47C06B8654E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\f_000001
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\f_000002
Size 151KB
SHA256 120a526a8a23068fa48778f29a0c9acbb4f6b4975d5f181ea10eec720f8509d9
MD5 330a71e7facb3b1310a380a2d98a38e9
SHA1 2d94a11e1e0a5ea3058ffba437e572e241c40fd0
SHA512 e1db62fbbdb24bdda002f2ee83a0e4637d63b208740ba637a631fab7bc1570a20b0b6116d7e99a6435bed5d76f07a34ab79239fce1337201172114306a425941
SSDEEP 3072:sdXxOHGzIleRm3sgguHeE2oYnAbNu0Hgqt393LE+RCgWpcXwVZKa3YTLDO6Ne0Fm:sdXgHqtYgdKYnAbwUt397E+k+taoTLDy
TLSH
T1BDE31249C741723199BAB7069EECAA6CC5C7E5AC4C83FD40F7749E79F12901B8E98063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 4058fbd180e012ff3e66ea3ac87dc86ad20de694b934aa4b07ac46ef55e4a9d9
MD5 79ee1480b08d2a323faed8a7213219e5
SHA1 0ee15bd2f5259c29fe5b24ad35d1e4bc3d2effd5
SHA512 6fcbdb65d86d92787ab448df4012d55c240c52c2a3eb46920aa97ce623b9241bca661437f80c0609ded4048b7eef8ffabc7afd63d50cb9081673c802e8020798
SSDEEP 3:LsPlklNllkll/lbCWk11nvlXlolXlWNtle/lAlfl//l5lHNl/l8Nl/l:Lsy3lEtbCWJuNd+N
TLSH
T13244121907440C1EC8D4153F408343311330E440C11FDB03130801101CC17042F2C350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 427d1c1e231497ba363f2e05540017dd2b5e03a5579b1bd0fb141b3951386e3a
MD5 3b50da6929fc7ea4b78518d58b26332a
SHA1 6d3d94e86c8d24830767e92781d829a2873a6537
SHA512 9560de60978ec6d4701012fc5f71eb4ebd19680de899e9d3a9e11a6ae283a8df50fc64aaa2739ba0b3272f97269da8510281bfd8fc9ed9971c7b467d77faf148
TLSH
T16CC01221960217DDE7437FF1A492DC8EBE36248D409BCD66F6E81678D23026EC213305
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 2edda4f84dba0417d77dda05c4ba36708d2f9e760333884d62a222b28277d43b
MD5 c1813a683049db542e1f130f9354fc4c
SHA1 b586732b0ffbcb9bcacb945ad995c5b829a898f9
SHA512 cc845004f337635247fc27c702e630dc008a5fa042415ffd192bc264c8958b810dbe83caa915d19906566ecae0fc6307e5fbf727f392f8778f60b03a823fffe8
TLSH
T11ED08010520407F6D74709F5D1C14D567D711CCA457FDF22F0941BF45811BDC8033A15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fac1.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59fac1.TMP
Size 48B
SHA256 d412baa333d5f82298f9406e26d601a06fe44c47b07e6605f80dba14e6fced1d
MD5 1ef102f975e47830c8c5935f2651012c
SHA1 15fecbba1d5c62ee3f14896ae3bfb397836c998f
SHA512 33bd046a0988052e7cc205401b15dffe93048ba75de7b5548bc195d39c016bfaecceda439186c592604b3a6d3810011e3fd2ae598227cee77b36d41517488a08
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\History
Size 184KB
SHA256 f1ac312cbf553104e4768c8427a98d7abe510734f976de5353d844d4ab719792
MD5 fbd900f0da9af1db844e9a2e07dcd536
SHA1 dd9fdcf41947f42e160279061fdb88b53651838e
SHA512 90154f8e670eec90f700fb97f5e7472c0663a675f8b952ad911d6d0957750b68c863511081f764ba4c75da6edc946a95c842f89dee2abdb6d1ed9f5d269dc13e
SSDEEP 96:HB0RK2gejzH+bF+UIYysX0fxQp97FEHt/DfLjLqL/yibgI4VgNr2jWRk/E0M:HByPH+bF+UI3iWGVFWN3qL/cVgZQW3N
TLSH
T1A904FC5E5F243612CDBD513A68E645B3587DF03F8B236AC66C6108B1CEE2656B02C4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 a2e86bcf036ac03f09533f08ca66444cc3c7a377fba22de05d7194e539820879
MD5 2a1e2e1f67152a3d3e0b3db60efb11eb
SHA1 47805ab40b021767b1e93ff5667cf321314666b9
SHA512 aa2f3501ec3a677d4017a5bbc4c257dd6632f934742b4baf34f4d594f57546ff02a264a79c297aa5bc223ddffa1aa837f5e45d15c89107c3f2dc5d61eafe67c6
SSDEEP 48:T9LopFMatSaw/auUOt8BqqjpoISNIwf6TxyW:NeMatUaAKx6NIQ6lyW
TLSH
T10792204F9F606210C1F14A36DED2486B2F3D002DD3672A15D9140CF28EE676EB15967A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 aff856eb54d698f4c9a3b398cbe30e0598b8c9b5b09a903c88daaa8aaadb1c0e
MD5 65e11c9af8670771fa0e8a396a6ae909
SHA1 97833e60f291c28579bbdd9565d112c841028039
SHA512 fa4013f4919fab22d1114d6a330fbe0611438811df8ecfbae7cdd70d28a97ccd499b17d363ae03a56929b6674f1e77e4626161b45bdfb0b1fcc3d8ff1d2b576b
TLSH
T1B6516BB786E486AEC85656F91B243D1BCF5D091C46B83D6AC8D6EFCB53D10B1E30054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59fbcb.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe59fbcb.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 bee834fd6b54e7b9699be70359eb8394a579b9515511460b1595718d0da5f03d
MD5 484b6efd6f0192758e8de2f8380e8259
SHA1 2cffd0fa86d00dfeadcd9800af002c29c86e8f6c
SHA512 ca80e499d591f6b4bbebbddacc852c03f59866a5dd9bba58af3c0fff5e547e3564060f40a5de7db8f4714b9c4b0464466c11b7d5db915eaf1cd286355be166d8
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB6Ic:uIEumQv8m1ccnvS66mMIUMe4bH2I+
TLSH
T152F2DFBF0BE9B644C0B09474E5841C8BBF5A041C4BFEAED985E59AE3FB821B1F124215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity
Size 1024B
SHA256 f43aaeebe526ba60d7c245656e53143e011a598b2649532f6510a22ed66cbd0d
MD5 51ddbe8c06bbbe3bd253018eed916871
SHA1 859bab921d4485c83cea53dae6700558f0cdf077
SHA512 c3fb5b6aa939c059331e85c9d26fa08483be0afe78dbea5dee4fe09fe02e08b1e069df04467d9f2ca014f285c45d1ecd948648510336c6935905feb1933b55ca
TLSH
T1371159A381BEA96B20281F7F0E44BC129D7EB53112416CF8DB9B526CF0C21FB9607026
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity
Size 1024B
SHA256 88936f541b31f10e398f20da6b3629ff7387fa6a34695554c7812e874bf9afad
MD5 c38b73d2f571b936ba6fcce507d2622a
SHA1 d1a6ab61cab1eeb7449c4602470b2767bead3540
SHA512 c1cf9ffec4b659c87db752fe3261bb303264b196477123ba6e5cbb97c130656223fd7a702393c57c54121339fa1046e994574abf901ac4dadc89a42a44c95f6d
TLSH
T14C1159A381BFA66B20281F7F0E447C12997EB53512416DF8DB9A522CF0C24FB9607026
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 6KB
SHA256 8eb10c1edb45527b434729a06af0051d4e8f7806a11935f94633fbb164f5aa9e
MD5 bfd170a2dad56dabd76c3e278d0803f9
SHA1 eff83c4defefc62b6eba3ea6ca62112030c773b5
SHA512 1c685d33565abfdab4b32c84e1f1b8f8e0e192a985c41c395c913ce11e70a50e230b438999960b3ba681a9157f15770b7eadbaa4a6c6d77680b9f7f0098beaa0
SSDEEP 192:st/00cwfgZ8paPf/S+Wi7azO9oYA1Wl/7ZK8:stc0cwXS/V+a9oms8
TLSH
T1CDE19A439E6499774CC7E219BA39FB16D2F6102266D40F98EFFC860C09DB6DC520790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 7KB
SHA256 f00e891cfe598c1681bab20e769ead43ecd530ab382fc10f6c3844831d207376
MD5 ff55d8e9e1efb8c0ad982649e2055aff
SHA1 7bad0a811fb79869204f6e70ed25ee3a0da83bcf
SHA512 da67389a1bd347bb4aef0ffccfc7e2a20803bb85cb577f04c7a1932764e08390aac2e07bb39bfa4488bdea683248d335b2df45c0f904bac41046e696ac51840b
SSDEEP 192:st/00cSfgZ8paQW/S+Wi7zJWYn7TLlSclM8:stc0cSXy/VJW+7a8
TLSH
T1B5E1B9439E24997B4CC7E6197A35BB16E6F6102277E40E98EFFC460C09DB6DC520790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59fac1.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences~RFe59fac1.TMP
Size 6KB
SHA256 93b25c86a1686ada7f391310754538feb06df01d983ec74e594f69c19fb5f675
MD5 a3840cebfa2056e1116caa8ddb687d78
SHA1 5ee883f17bd99950d72a5f6b85e502fa14e57ad7
SHA512 f810648de14b84d256b9a22f210c9c52ddf5e259897415ed26b9a3f59c0acbc148f484aefc0ab303c6abefae5401a5d1d9f57b70949717b42d3adce8a55ae425
SSDEEP 192:st/00cwflZ8paPf/S+Wi7mMwYA1WlWJM8:stc0cw4S/VJw08
TLSH
T13BE1AA435E64A9774CC7F2197A39FB16D2F6102166E40E98EFFC861C09DB5DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 7e860558c64ee9280276dae2b57015d78f64239b38c6e2be5fd2883304631b00
MD5 8f366f218c93961aa99c74e92a6a0f51
SHA1 96025ac55fd2325f212767c465a19694eedb683e
SHA512 52449d8084cf0fc3c400c888d65f5d2267fd25a6a691f022f40fcda4af1eb0961fde5ee00b02c2c5e49055a2266217095f122771d6ce8def1fa456d9bf05feb0
SSDEEP 96:HlziJPlf/ROoKOpkF5d1+in7sMaTEv9V5h5pg5+eeoCGCqejj4XOVXhnQB:HoRWGeD9lKKJjjVXhQB
TLSH
T180D1B4A7456DC534AF488AEED93C3ECAD9BA418F98D54C0697E2C4480BC2AFD20DE4C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 f385e236deda2b7e5c663593bd0772e0c3637f0debc3a7aecfeb7bbf54a9cc71
MD5 7b87565aa3683acb88b18b602553837c
SHA1 2260fcbaf805a2123737fc4f0e0ccc96ef1137b9
SHA512 27ebacbc44412f30529184c89b5bdb8bb72078816167a564a958edd701325e18ba054edbf3ec99e79f8189056bc3d69d99663e0f429b08414586b9875bde371b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 9d82e8a41b90dcd13e6a620fa20eea95920ff8d012020ae5457fb68efb8b9b6d
MD5 f29cd454e768430a809dc9612b8436ba
SHA1 48e5bdea16b3dab57e07fae2e0d46c90418f1de9
SHA512 230b3c9c9d4c5f6f292939f4a8bd79d3183602000145d17cba0f99e929b9677346f796655352d882c63352d5aa0b08a6ac187cfd7434ead640adcff36aff712e
TLSH
T18F51C633789497374CE2CA44BE8A3F128A75506683712F58AEED0B0D02DB68C2343C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 1KB
SHA256 39ced3fa2d841f3c5217aedf293abe436cfd04de3d46bd9b8ec1f10a3bc2bb8b
MD5 d8a0a6788110de4972dbcdb6c9a62756
SHA1 428914bbdd4f061e159a26698b84b8524ece1561
SHA512 66cdda204874b795c9624c8c356eeeeac4d0f801cd603678a7fbd21e4eb1000abff24e6823df2b5c3f86f968d45c65b674aff44b710d4bcdb4cd5502dadda950
TLSH
T1CB316573A4D417325CD1E685B6C52A9B5EB0506B82704F0CB7DD4B0907D72CC56ABD36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 67ff14fd0475aeff15ad76a432f2fc107c03858c7dbf66f71bbd77e3a1b78422
MD5 1669970ba6f47aa09e97a6e9883b1b39
SHA1 0dc9b943441aac75afc986bb5fc046784017c9a7
SHA512 467a2552f126889143dce63c667f609cbc31c68798d8b837a59944dedbaab75322e112599ce77b0ea16d100d612079db2d15cc7c5c7562c33730b3d9a67a4b9f
TLSH
T17A71853768A496274DE2DA44B9C93B16A6B55127D2A13F98DEEC0F0D06DB3D82382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 94ab893571a1f74e405e338409e1d1fe244c36cbf3434dc4291fb7788b2ca01b
MD5 b7f221ba3051f5d2ca37e80ce9be152f
SHA1 90be125a6585c91b1fe8acd2c0f24f7725a1f3f6
SHA512 845ca4f5d8bb97a284439dbb86938e6954bdbc2d61c85b67488f04492b5e032e36d86f3fd8f44fc76b10bc6f833c31dd096a12a1fdc424394750b0489c30cc4c
SSDEEP 192:z2BsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vnNbliN/r1ooS:zcsrv+89zHqlDNP9oid6Nbl4vVY34mN9
TLSH
T179729D33A57897334DF29949F48A6E0B7BB860A751D11BA8EED90B4E42DF0D92313D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 314e71ee1c915f68392f84e4a7e22f10c7f425b5a772a03bb22c9bd227c4be15
MD5 694f39b9682191465cd0086f08835d77
SHA1 1110bf912b011eb886021132d8edbf8884a6e786
SHA512 c5a3dfa4fb142b73d9f618cc7c146ac46062cc476e3bd11112082cc6ecbc5958affea463f530d1097ede1a8a031d5ffe873b16ddc0711ff9f5f13a7f45e1ef8a
SSDEEP 384:zusrv+89zHqlDNP9oidSZ3Nbl4vqY34bN9:Vrv+4UNbdSZTVbN9
TLSH
T1CC729D33A57896334DF29949F48A6A0B7BB8609742C10BE8EAD90F4E42DF1D92303D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 825626be11a2860c661cafc994edf29206855dd594b81fc451f30d29d1a9a7f4
MD5 b9a72661fbd5d59124c5815fc94d79db
SHA1 2c5cbd51479e6fef03b5a7b881752f6f1b4aa0b8
SHA512 87696dbc2e1230784da15f53b9e0f1a032effabdf6d510e96e10c73faa55546441feb8d14c17bdfaee7093833661cd4114879c93e3e3205d82154bc1fc818301
SSDEEP 384:z5srv+89zHqlDNP9oidSZ3Nbl4G6Y3p6ukDz6Na:Crv+4UNbdSZ+0jNa
TLSH
T11D729D33A86896335DF2D849F5996E0B7BF8516782C10BB8EAD90F4E02DF1D52317D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 ab0aa68def6e57204a6763ffa1e76b26615cb3355d29b37291ad71d8257f1a7f
MD5 b70d89a1a199a91c5f3d7e4232ba3dd1
SHA1 753bf47398b38fff41f9a7d0efa617d2f15d0595
SHA512 fc2b01a55ee4542fa7dcdb9ab7e7620bbdebdc07f5530eaac8d7a71c636fc06f1962b85c384f5570984f0dc53bdaddd5d353c91511e759c209795f1b96099ea1
SSDEEP 384:zksrv+89zHqlDNP9oid73Nbl4G6Y3p6ukDz6Na:jrv+4UNbd7+0jNa
TLSH
T12F729E33A468A6334DF2D949F5996E077BF8606782C10BB8E9D90F4E02DF1D52307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59b52d.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe59b52d.TMP
Size 1KB
SHA256 dcf7adae7fde6f60552d1c4a99475ab6eb214025cf59cf1d1723a03350e4cb8a
MD5 21dcb0ead95023ce42e68b2de02ae3e2
SHA1 591239eb69d7db8bc99cc045bd8cc1d2d55ea2f9
SHA512 0f468aa5de79a0f7d59ce37c0ec4902db759cdae7b91478441277303793a0c335c922c63deb231e90b77c079d55ca61aa1290326baa1bc194ed24237b7e413c2
TLSH
T1DE21427394D457325C91D985B6956A8B1EF0906B82304F0CB7DD0B0A07DB2CC96ABC36
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\ShaderCache\index
Size 256KB
SHA256 177aa5fd11f6ecd56a02ab907895ba3acd4e85d6e2f28c6444ddb1e0b511349c
MD5 850b680d5c28131f361e4367bbb83449
SHA1 3d1997eb118454b66456c38078b690cf1e17d8b9
SHA512 c032f04812bbb3e88d832c0ff3691256f2001adce0d33857ddc6d547d6ba085e57ff75669e170168aed0257234c9b76ab52a1f71d42891b2470e5750a3925d84
SSDEEP 3:LsOllllklkXlG1Sl:LsUlPiS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.msi

Path C:\Users\Admin\Downloads\jjsploit.msi
Size 6.1MB
SHA256 8e269f69cc241af31098d086c02d3d5d37b172d6ef85f8a43f0e13a8e166fa1b
MD5 ad1d89c3147f24d3bd43c24761cbf24b
SHA1 7f712d7c75926aa378d764cc965242a04d5fcfab
SHA512 8625aa4bb1a2786ed8e17571649dca412f780093b0f45402102bb9d10c01d4d7d80323d1e9dcaebddeeab1aec4c4229fd1e8ebc5b8c1ced903326449f2559130
SSDEEP 196608:KsiCEa1wAWUBqwcxJ0zWD+qPoLoXXCaLn:KrFiwAWUQwcMKHAcXNn
TLSH
T126563327BE815B26C0EB1E752879D3514B7DBC245F9688132292366DEDF23C08EB94D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 ec9ed522a34bfc86b7552e62a7b68c57cdcf263e7935d90fac9cde7505ca531f
MD5 3d95c20031755286ca374f8ae761a8f8
SHA1 3fca362cbff7b2d20eafe99db19a6b11bab30cb4
SHA512 937524f37daba1378e661eb6316ff116d52a73af6979529dd743976dff014a2793cef8fce782f9239d22d346a4183d00ddf363bdf068204a36860c754c755b81
SSDEEP 24576:SEpmg3MLdoO/vvTLz1netZm5vcbBaPoRbnothTr18y6DrWJX4ikGC7R8jM:Ks
TLSH
T11747B12476F92210E7B79E3CA8F16A234D3A7D5B9C15DE8D05411B8E0822F71EC72F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{54f50e00-9272-41c7-8895-b0c0635bd222}_OnDiskSnapshotProp

Path \??\Volume{8cc34c9f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{54f50e00-9272-41c7-8895-b0c0635bd222}_OnDiskSnapshotProp
Size 6KB
SHA256 ebcce829311c7cd584d294454c2210e44ad5ee4161ba656c1e958cf628e99ae7
MD5 d790c171a662b058f33d659b8160945f
SHA1 aaf9667bb003add371733d9396eb6a8613308caf
SHA512 6e8573f88e811ca665e801a5c15e4fdc3b2b038afd4753f819c7ded9de7f5afea3354ea340d7693237fdfdb480c2e4dbc0f0bca6f14d22fec5596558ca94d601
SSDEEP 96:F3QeNhvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:NQ0b++ZVmN
TLSH
T1B3D199085AF54311E2F3AB7228F14557A877B811EF33CB8E0298638E2671910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-786-0x00007FF8757D0000-0x00007FF8757D1000-memory.dmp

Download

memory/4556-766-0x00007FF8757D0000-0x00007FF8757D1000-memory.dmp

Download

memory/5432-770-0x00007FF873BE0000-0x00007FF873BE1000-memory.dmp

Download

memory/5432-769-0x00007FF874E80000-0x00007FF874E81000-memory.dmp

Download

memory/6036-339-0x000002140B300000-0x000002140C300000-memory.dmp

Download