Overview

overview

7

Static

static

3

jjsploit_8...US.msi

windows10-2004-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    133s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/07/2026, 09:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jjsploit_8.17.9_x64_en-US.msi
  • Size 6.0MB
  • Sample260715-k1mcmsbw21
  • SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 27 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.17.9_x64_en-US.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Program Files\jjsploit\jjsploit.exe
      "C:\Program Files\jjsploit\jjsploit.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1132.2400.17129306548128597276
        3⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:1248
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffbdabab078,0x7ffbdabab084,0x7ffbdabab090
          4⤵
            PID:4388
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,8357420746630476411,9030418231962851465,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
            4⤵
              PID:2188
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,8357420746630476411,9030418231962851465,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
              4⤵
                PID:4576
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,8357420746630476411,9030418231962851465,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
                4⤵
                  PID:540
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3564,i,8357420746630476411,9030418231962851465,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
                  4⤵
                    PID:1988
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Enumerates connected drives
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2044
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding D826B70FDD81D85AB28F51F8AFF2D36A C
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:3128
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                2⤵
                  PID:3096
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                PID:768
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                1⤵
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:1856
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0x84,0x124,0x7ffbdf37c728,0x7ffbdf37c734,0x7ffbdf37c740
                  2⤵
                    PID:2056
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1592,i,13092104803017050656,967945614010022989,524288 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:3
                    2⤵
                    • System Time Discovery
                    PID:4524
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,17484195314831871001,4442880510458495677,262144 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:2
                    2⤵
                      PID:3784
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,9805098867370706689,14681877243716920335,524288 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2436 /prefetch:8
                      2⤵
                        PID:896
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,15097024487323187915,17211368650050015947,2097152 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:1
                        2⤵
                          PID:4328
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,17804582660977102098,17931130018211973921,2097152 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
                          2⤵
                            PID:1112
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4268,i,7127873871062275731,11248503469601569997,2097152 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4284 /prefetch:2
                            2⤵
                              PID:3492
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,2397688858460710906,13093992259636316924,2097152 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
                              2⤵
                                PID:3172
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4264,i,7447038310110096828,10121848320488767502,524288 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:8
                                2⤵
                                  PID:3324
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,12236072757971252172,7991771427196551310,524288 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:8
                                  2⤵
                                    PID:4568
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,17345386820718731136,10003431800005542748,524288 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:8
                                    2⤵
                                      PID:1424
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5528,i,6687422960148977623,6779499576942258376,2097152 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:1
                                      2⤵
                                        PID:4300
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3632,i,11097601604392219660,3139635108375726886,524288 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3672 /prefetch:8
                                        2⤵
                                          PID:1676
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3684,i,5592280303097076849,13183789163788557955,524288 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3640 /prefetch:8
                                          2⤵
                                            PID:3228
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3636,i,4466785569781772039,4937783166376512385,524288 --field-trial-handle=2084,i,5887415133155402240,15869998831206151240,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:8
                                            2⤵
                                              PID:1916
                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                            1⤵
                                              PID:3136
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                              1⤵
                                                PID:3904

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    e58cf91.rbs
                                                    • Path C:\Config.Msi\e58cf91.rbs
                                                    • Size 21KB
                                                    • SHA256 171022684d381ef43c484174441252b059450585f8b938eeace52d87b1652a7d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    jjsploit.exe
                                                    • Path C:\Program Files\jjsploit\jjsploit.exe
                                                    • Size 17.6MB
                                                    • SHA256 75c45301f7a6632b67934cd30bb08d4c322c55b9e68d2a6edbc5873982cbcbe8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    jjsploit.lnk
                                                    • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
                                                    • Size 1KB
                                                    • SHA256 6649499a04fb20f3ed3bd06d3e9768b74f620a6d71368b43b42cdc05f07615f0
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    jjsploit.lnk~RFe58dabb.TMP
                                                    • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58dabb.TMP
                                                    • Size 1KB
                                                    • SHA256 3a6f8473e52ae1371053a232eb0f614a7ae246438f1764641bf0db14880e905b
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    BookmarkMergedSurfaceOrdering
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                    • Size 6B
                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    BrowsingTopicsState
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                    • Size 414B
                                                    • SHA256 6a3a7f2255e102b44034158bb1b82594ca166352dc220430e13f675f9489a47e
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    f_000007
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
                                                    • Size 373KB
                                                    • SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                    • Size 144B
                                                    • SHA256 134840815bf85cf6dd5b70ce120494e5500ae5caa11062851c0bd09bf10ab299
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    Network Persistent State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                    • Size 3KB
                                                    • SHA256 0ea617390181fa53b74c413fc44321ec3f6441464cd9d95e0ae1aaef0e9f9310
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    SCT Auditing Pending Reports
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 13KB
                                                    • SHA256 5daf568624dfa6e6a9425003154930757bba954da7129c38e4f6ed9bfd22cd18
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 13KB
                                                    • SHA256 5617273305b47fcf01c034a9c6368171349930f13ac21212ee1c38911243e65c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 297c79d92ad8c47b45c8bf4cc758f644a3618307f2c2d7266ba916f967620e50
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                    • Size 17KB
                                                    • SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                    • Size 120B
                                                    • SHA256 95298eb7920d5f5b399a2e7d1512756769326ff922bf19cf5ff9b660ccf2ce2c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    the-real-index~RFe591870.TMP
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591870.TMP
                                                    • Size 96B
                                                    • SHA256 c978a4231092383ae3dd366477d50a648ed07aca0823a0f2fc14695eae3176c5
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 232KB
                                                    • SHA256 8871c67845165e1171ce7e40b31371580ca4fb7434727a3ca67502e555fb76e7
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 288KB
                                                    • SHA256 ff82a76eb4c49efe821c4234b7e9bca1b4789ef665c8b811f4eddf3f2392a272
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 115KB
                                                    • SHA256 f33a13ec992e63fd202238822e0294ad4a37aaebce9543ba701435735c60e2ba
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 232KB
                                                    • SHA256 ffb12ed8031d5471998cec1a1614d66e9e92e787c36cbb6c02330d462d69bf6f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MSI8920.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\MSI8920.tmp
                                                    • Size 132KB
                                                    • SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 19f8f804fcad841ccbfb878d514d4f8300bdf8d4069bd794e5cb70dc01f5d5aa
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 4cc74314ffd5665e87ab3150b5d7cbeea90b27df539b14b9db420e02eaf1eaaf
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    throttle_store.dat
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
                                                    • Size 20B
                                                    • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    data_1
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnGraphiteCache\data_1
                                                    • Size 264KB
                                                    • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    data_0
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
                                                    • Size 8KB
                                                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    data_2
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
                                                    • Size 8KB
                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    data_3
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
                                                    • Size 8KB
                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    MANIFEST-000001
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                    • Size 41B
                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    CURRENT
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                    • Size 16B
                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                                                    • Size 1KB
                                                    • SHA256 e056ffbc6ba68aa4f630e4857ac897c78835de551bc952ac45d007a259ce4d3a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                                                    • Size 3KB
                                                    • SHA256 506878b6c72854f3406f28d70d9a94a76ad77fadbc9abcc2e5044e80928bbea7
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                                                    • Size 16KB
                                                    • SHA256 9e11683d8e8edeec2b49b77251fa382c7a9e8c9141382228ecc6a811f402dd8a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
                                                    • Size 2KB
                                                    • SHA256 0f9cb4bb9a87bedd0656b8ed14e5304b6444538d951277a2192444c7715bc819
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    Local State~RFe5a4622.TMP
                                                    • Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe5a4622.TMP
                                                    • Size 1KB
                                                    • SHA256 218b1325049951959d0b3598bab9f160d15c82deb1f4d5ff1a0c50a72bbf10e9
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    e58cf90.msi
                                                    • Path C:\Windows\Installer\e58cf90.msi
                                                    • Size 6.0MB
                                                    • SHA256 d60041d15a1294a6fb436d20bff8e2cfaffd6b61aeddd504aadd1a35dc7f5ddd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    metadata-2
                                                    • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                    • Size 24.1MB
                                                    • SHA256 38a2ac4ea8b9b0283712c727d44f151ad6288a0cd9ad4349aed0ca471e4ea201
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    {e6ebd150-dc00-4389-9add-6cb485822733}_OnDiskSnapshotProp
                                                    • Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e6ebd150-dc00-4389-9add-6cb485822733}_OnDiskSnapshotProp
                                                    • Size 6KB
                                                    • SHA256 c2888df3bd274ffabbdf0751d99b9504650eefbb8553d646db8a626bd2787b35
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    memory/540-308-0x00007FFBFCEB0000-0x00007FFBFCEB1000-memory.dmp
                                                    Download

                                                    memory/540-321-0x00007FFBFCB10000-0x00007FFBFCB11000-memory.dmp
                                                    Download

                                                    memory/1988-404-0x00007FFBFC150000-0x00007FFBFC151000-memory.dmp
                                                    Download

                                                    memory/2188-283-0x00007FFBFC150000-0x00007FFBFC151000-memory.dmp
                                                    Download