d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jjsploit_8.17.9_x64_en-US.msi
Size 6.0MB
Sample260710-s3l4naev9v
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
240	jjsploit.exe

Loads dropped DLL 1 IoCs

pid	Process
1448	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_1828712574\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_171019297\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_171019297\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_171019297\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e59523d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF65FC9215754DE233.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_1828712574\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}	msiexec.exe
File created	C:\Windows\Installer\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC7D52B63A8C10174.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_171019297\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF71472BA77AE35B62.TMP	msiexec.exe
File created	C:\Windows\Installer\e59523f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_1828712574\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping824_171019297\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF535500DBB025BCD6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59523d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5450.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
792	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\PackageName = "jjsploit_8.17.9_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductName = "jjsploit"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\PackageCode = "9FC2B6F90A0842C469E6F4CAD3052A7D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\ProductIcon = "C:\\Windows\\Installer\\{CAEE2EA4-A7F5-4155-9048-D4EBB6FAF462}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Version = "135331849"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AE2EEAC5F7A551409844DBE6BAF4F26	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3780	msiexec.exe
3780	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
824	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	792	msiexec.exe
Token: SeSecurityPrivilege	3780	msiexec.exe
Token: SeCreateTokenPrivilege	792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	792	msiexec.exe
Token: SeLockMemoryPrivilege	792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	792	msiexec.exe
Token: SeMachineAccountPrivilege	792	msiexec.exe
Token: SeTcbPrivilege	792	msiexec.exe
Token: SeSecurityPrivilege	792	msiexec.exe
Token: SeTakeOwnershipPrivilege	792	msiexec.exe
Token: SeLoadDriverPrivilege	792	msiexec.exe
Token: SeSystemProfilePrivilege	792	msiexec.exe
Token: SeSystemtimePrivilege	792	msiexec.exe
Token: SeProfSingleProcessPrivilege	792	msiexec.exe
Token: SeIncBasePriorityPrivilege	792	msiexec.exe
Token: SeCreatePagefilePrivilege	792	msiexec.exe
Token: SeCreatePermanentPrivilege	792	msiexec.exe
Token: SeBackupPrivilege	792	msiexec.exe
Token: SeRestorePrivilege	792	msiexec.exe
Token: SeShutdownPrivilege	792	msiexec.exe
Token: SeDebugPrivilege	792	msiexec.exe
Token: SeAuditPrivilege	792	msiexec.exe
Token: SeSystemEnvironmentPrivilege	792	msiexec.exe
Token: SeChangeNotifyPrivilege	792	msiexec.exe
Token: SeRemoteShutdownPrivilege	792	msiexec.exe
Token: SeUndockPrivilege	792	msiexec.exe
Token: SeSyncAgentPrivilege	792	msiexec.exe
Token: SeEnableDelegationPrivilege	792	msiexec.exe
Token: SeManageVolumePrivilege	792	msiexec.exe
Token: SeImpersonatePrivilege	792	msiexec.exe
Token: SeCreateGlobalPrivilege	792	msiexec.exe
Token: SeCreateTokenPrivilege	792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	792	msiexec.exe
Token: SeLockMemoryPrivilege	792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	792	msiexec.exe
Token: SeMachineAccountPrivilege	792	msiexec.exe
Token: SeTcbPrivilege	792	msiexec.exe
Token: SeSecurityPrivilege	792	msiexec.exe
Token: SeTakeOwnershipPrivilege	792	msiexec.exe
Token: SeLoadDriverPrivilege	792	msiexec.exe
Token: SeSystemProfilePrivilege	792	msiexec.exe
Token: SeSystemtimePrivilege	792	msiexec.exe
Token: SeProfSingleProcessPrivilege	792	msiexec.exe
Token: SeIncBasePriorityPrivilege	792	msiexec.exe
Token: SeCreatePagefilePrivilege	792	msiexec.exe
Token: SeCreatePermanentPrivilege	792	msiexec.exe
Token: SeBackupPrivilege	792	msiexec.exe
Token: SeRestorePrivilege	792	msiexec.exe
Token: SeShutdownPrivilege	792	msiexec.exe
Token: SeDebugPrivilege	792	msiexec.exe
Token: SeAuditPrivilege	792	msiexec.exe
Token: SeSystemEnvironmentPrivilege	792	msiexec.exe
Token: SeChangeNotifyPrivilege	792	msiexec.exe
Token: SeRemoteShutdownPrivilege	792	msiexec.exe
Token: SeUndockPrivilege	792	msiexec.exe
Token: SeSyncAgentPrivilege	792	msiexec.exe
Token: SeEnableDelegationPrivilege	792	msiexec.exe
Token: SeManageVolumePrivilege	792	msiexec.exe
Token: SeImpersonatePrivilege	792	msiexec.exe
Token: SeCreateGlobalPrivilege	792	msiexec.exe
Token: SeCreateTokenPrivilege	792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	792	msiexec.exe
Token: SeLockMemoryPrivilege	792	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
792	msiexec.exe
792	msiexec.exe
240	jjsploit.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
792	msiexec.exe
3780	msiexec.exe
1448	MsiExec.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 1448	3780	msiexec.exe	87
PID 792 wrote to memory of 240	792	msiexec.exe	91
PID 240 wrote to memory of 824	240	jjsploit.exe	92
PID 824 wrote to memory of 3556	824	msedgewebview2.exe	93
PID 824 wrote to memory of 548	824	msedgewebview2.exe	94
PID 824 wrote to memory of 548	824	msedgewebview2.exe	94
PID 824 wrote to memory of 548	824	msedgewebview2.exe	94
PID 824 wrote to memory of 548	824	msedgewebview2.exe	94
PID 824 wrote to memory of 3800	824	msedgewebview2.exe	95
PID 824 wrote to memory of 3424	824	msedgewebview2.exe	96
PID 824 wrote to memory of 3424	824	msedgewebview2.exe	96
PID 824 wrote to memory of 3424	824	msedgewebview2.exe	96
PID 824 wrote to memory of 5848	824	msedgewebview2.exe	97
PID 824 wrote to memory of 5848	824	msedgewebview2.exe	97
PID 824 wrote to memory of 5848	824	msedgewebview2.exe	97
PID 824 wrote to memory of 5848	824	msedgewebview2.exe	97
PID 824 wrote to memory of 5848	824	msedgewebview2.exe	97
PID 824 wrote to memory of 2020	824	msedgewebview2.exe	100
PID 824 wrote to memory of 2020	824	msedgewebview2.exe	100
PID 824 wrote to memory of 2020	824	msedgewebview2.exe	100
PID 824 wrote to memory of 4680	824	msedgewebview2.exe	101
PID 824 wrote to memory of 4680	824	msedgewebview2.exe	101
PID 824 wrote to memory of 4680	824	msedgewebview2.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.9_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792
- C:\Program Files\jjsploit\jjsploit.exe
  "C:\Program Files\jjsploit\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=240.908.6316901810825911523 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffca57a5fd8,0x7ffca57a5fe4,0x7ffca57a5ff0
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1660 --field-trial-handle=1804,i,7477332894450375258,14187041103088390056,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1804,i,7477332894450375258,14187041103088390056,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1804,i,7477332894450375258,14187041103088390056,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3324 --field-trial-handle=1804,i,7477332894450375258,14187041103088390056,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f /prefetch:1
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=1804,i,7477332894450375258,14187041103088390056,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=820 --field-trial-handle=1804,i,7477332894450375258,14187041103088390056,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:4680

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AF828BA191737E341A152D34E9E4AEAA C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59523e.rbs

Path C:\Config.Msi\e59523e.rbs
Size 21KB
SHA256 ee10260bebfda0d4c570d6297bf762e931fd667956b6293a98ca5922c8c7d9c9
MD5 838b99ed8ce7165984b8b8913003e553
SHA1 4c703a9e322aaec32567d446dbd6c4985e0e181d
SHA512 8e2f7372a902b304eeac32508909e34ad1aab6b8ebf85d734c9fdb62258ac63b991fb768f7a15ff49f0e2d875acabdd66621d87b0cf3784e81520655b85299d9
SSDEEP 384:dCZAB7OTEXTIrY8nTZoWjdLRWixst8t8t8t0tstststststststitztztNLIy1Go:dCZAB7OTEXTIrY8nTZoWjdLRWixst8tC
TLSH
T1D0A201835A50C2E6E66B0774DB975B043B72C58E9358420B46CCC27A9D877C83FF9A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
MD5 f5b2fd9a39c097322b6cb663cca5b4e8
SHA1 08c113bccec7d3cdf4f6a2b313d1b1421ad62f85
SHA512 490b5c18b55ca136782d2f25e8f8b86a3cc5ae0ad25fda274bfe1a3adc759cbbb8f11592f6e7ad3451b758199e90db482767f4ebae7d93db61d8b90b3f61aae8
SSDEEP 196608:h9Uzqh1cmdDOf+IHFLU/6NW+tiFZJXij:MzqoyS+IHFI/extiFZJXi
TLSH
T139070725BE8B996CD05FC474834B8A720A7570CB0B35B9FF448596392F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 4cc371ab737fc105bcc25848390ec3ced83711c59f52cab39408c6d01a366353
MD5 7de37aec7bd4f7e9b1c513e6fdb96640
SHA1 f746a01489f36e58e6f8c0c93c355231d51d7f54
SHA512 36b83262cbf7ace9353cf31f50819e91901514a9080944f1820b5ff82cb4c1b9ecdb719c96cdd15d6e41a0716aec73504961443318bc0e15ba6b8c102394921c
TLSH
T15541D00052F50B2EE3B586792F624721873AFC16AAA49B6FC186418D5C6C100D9BCF7E
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe5956b1.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe5956b1.TMP
Size 1KB
SHA256 f9bbfd6db69ab8118a92831dc7393e781ac2274dc3523441b0a2255f2514643e
MD5 4af2a4b7f88dcb5391619467c567285f
SHA1 12cad25479af809b589ef1bfd72dfab765bb3524
SHA512 a82457c0bf19902b4eab35b5e3a763eefe74d3c154ead51e91f6d4316b054d255b7d3015a32935604f507baadd34c00ede207838ac2397a834945f6e262ca10b
TLSH
T15C41900056F50B2EE3B582792F6247218B3EF815AAA45F5BC186418D5C68100D9BDF7E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3743.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI3743.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 544c4ad1bedff1d0363b825619150410f122e09211a5c12c336450d33ca60ee7
MD5 70073b4b6dd037f46244c625f9960a30
SHA1 7f34f114a09bdbef9c0111175d433725ea87dfec
SHA512 5122c5dca494596575f0fc7ac010e15192f4d2c538426b890472743f93c691476cc08d1415c962d4de4261778bd4054e4d69f28e78e882018c805f08e3d68ac3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cfdc6e05f0e3ac3d379e0e03273752db86f90a52229605d73b657f6965d8904e
MD5 1c8de5fd259a0ea52d465dae8d6da835
SHA1 a909bba85670e6523bd4c670fb12222374d2824c
SHA512 18bc05fc4236c9bca2e0cbc8411de4feb241b03ff095a65054cccb2be2f07317460200590f06a4218665e62e17a119a94fc4b995b5449288683abb9c4301eb2c
TLSH
T145D0241733010174C41031330C43730C1D00D31F414D4140543CCFDD1F1C0500D03441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

67083895-ec2c-47de-b66c-d93294628e35.tmp

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\67083895-ec2c-47de-b66c-d93294628e35.tmp
Size 6KB
SHA256 7575c00fb54f510dfa2b7597176ec8abf07d263254eaa3b3fd99312188db6dff
MD5 311452d3c5628a0edd6aa1847106553a
SHA1 d381b56307751dfa72dca49109cd05f3a7d8a9df
SHA512 e4e18695c5e5b02811b413d6943a3aa48021f19228906d93a82519e34f3456659a57e8c2928d67b49cc6b91be85ecf20c7c3297c560e920dc24725dd97e3f21b
SSDEEP 96:stm/dchK7b9Dkyo5h16ZPgs7/x+6Mhmuecp1B1enG/LG/9enK+gzw28XM1C7K:stem+lo+gsV+FN1BQoU956G6K
TLSH
T1AFD1B5036E24A97F4DCBE219BA25BB57E2FA643265D01E58EFF8461C08DB5CC2207C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 33d485ef2cab2469242da29bc39ea8680308125ff4ebb0ca2752c709469f3339
MD5 f3ab7815d006f692ae849b9fd7bee850
SHA1 2d5564fee954e84a6e0eb78fc91e2601d61a3e34
SHA512 c7e5431afe05482ded02ae83bbb64613edd67f15b787500c61a91e5dd6fa53ad00c1be9632d011ac9a5f142b6f2718ee038730e66a970ec6d0104725f74f62e6
TLSH
T1FBC092918B040BE8C6D1C2F960C2F0803475245A4E831C6822980C74F5227279316344
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c857.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c857.TMP
Size 48B
SHA256 511176cbf4d762520f0cd92c5cd4af34a0ccb9286932b92e1464682b4ec61fe6
MD5 e2bdb99bfa379c395c0950296879b90d
SHA1 ba97f5022fad3252c66fc8585fe75550cdad9c32
SHA512 eebd81a5d77dc472b73e9eb851d343caff1b67ce35fdabf1a2c834d79589ad0ef499c529ef8495761682683fc08a4c9f9bce514451a67e8d8086e24b65cf9f53
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 ba1683979a4aa824ab2d5cdac61dea8014744ad1fe0af0cd13621c5b561b3582
MD5 5ac9f497dab7ffd00e2da4056284eb03
SHA1 ba34748a60f10def00e3a46889df56d15e37172f
SHA512 29c36cfbd0e93e94718de65e4e7349a3e5f2127c660508a3caa1a9fd3560085506eec37db67af521dd71169dd043ab8cbafb61fbc6040530b709fa042708eba6
TLSH
T1F45154B7C6E49AADC81162F95A24391BCF5D091C46B83DAE88E5FFDB57D1070E30428E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a87fe.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5a87fe.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 15KB
SHA256 9e6e1a6874db588b59cb3150b6657ce1c9422a849a8d5cae1c03dfb9aab85dbf
MD5 f260219104ccf116ba7c1d9ff14c8aa0
SHA1 94588d9c78e6fd9c068f439d4ac2e81450e29e5e
SHA512 106b5d061e0842e95c326d23f50efa4017f3f88570abe8dd5c4acfed926dfb75b4de2b13564a3b0197e5494c881b49a753408e7a22a7b3ef8afc6e6208c57523
SSDEEP 384:bsrv+89zHqlDNP9oidXNBSi+itQajOH1Nd:wrv+4UNbdAsRI1Nd
TLSH
T1BD72AE33A578A6776AF79508B4866F073FBC609796C20AA4E9D41F8D45DF0C92313D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 44778588b5988848eee61e7eed09fd1466f6a4996cb76b9a242e4deff5c75677
MD5 fa3750122f9278901e294a210e5fa41e
SHA1 9b1f1423af31075f8465ab5da4fce66c9256843c
SHA512 cb33636331a0de00bced3986db3dc101f9269264d3c3fda9488b306b5b1b6d6c41ac1624a9254cb3deb5ab2c4e6c70fb993fdeb40bc9d576a028668137542cae
TLSH
T1C15195332D50A67B9BB38A087D0A7F63DFB990A5AA522F14EADC1B0C44CB54C1313C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 a1a54382f4258a7794452110fdc0af4b0881ebe0cb8b6c93c8c253891f53cca5
MD5 2b3754e986762b076a3e37055c25a681
SHA1 552a128310267cefb5367d8109f3bd0471c0e989
SHA512 912943346e9d8cf7d11acc3c01e1198b09e1a74fe28d1bc816e787d56f81511eb6d9622b0d322fdc4ce37954524afe4a76148d497e1e7e9a6ead99763806f1f2
TLSH
T15771863B6960E57B5EB39A057C452F17ABA55037A9813F58DAEC0F0C05C728C1313C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5972e4.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe5972e4.TMP
Size 1KB
SHA256 06c498be585c216d4af952b0c4ad34b506d7c40ffbb198cf3a6eecf00b9ffc53
MD5 187db7992fdd8de0bf7e6caa987225fd
SHA1 b8998f6f50ff57743aab7628f44809b9d388e105
SHA512 b407f18532034430f1c3c65f2067be8efcabde7f1297e5b37ebf89a6c8a5a9aef4d0969511ebb4d058a460b9c2f4da49f39b6359febc8fb568bbb805df1e367d
TLSH
T17D31C67655906677BE93560A3906AF976FB040B656414F08A5DC4A0C15CB14C112BC30
MD5 SHA1 SHA512 TLSH

Submit Download

e59523d.msi

Path C:\Windows\Installer\e59523d.msi
Size 6.0MB
SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
MD5 11554209ebea8dd6a79759b131da131f
SHA1 5a9a794e5b18389c31b00ce714111d0107061055
SHA512 eaed0b53938e0107fc9be0a6255d1b7cb35b90334a3174c878bdbaf035228833461bd25f329a0256fb372bba6a81ace028586b7c29150e144c747061dbe6d43e
SSDEEP 196608:01/HwnpyyCBiw0xvbWRiogDNHEt31ol8tDlc+:U/HwIxBinv1NGtVhT
TLSH
T19156338FFE829D37D89A0C32853F87658328BC505B4A645723D975A9C8F67C04D36EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-85-0x00007FFCC7B80000-0x00007FFCC7B81000-memory.dmp

Download

memory/2020-320-0x00007FFCC9520000-0x00007FFCC9521000-memory.dmp

Download

memory/2020-319-0x00007FFCC82B0000-0x00007FFCC82B1000-memory.dmp

Download

memory/5848-265-0x00000157C0060000-0x00000157C00D4000-memory.dmp

Download

memory/5848-126-0x00007FFCC7B80000-0x00007FFCC7B81000-memory.dmp

Download