hxxps://wearedevs[.]net/d/JJSploit

Analysis

user interaction
yes
max time kernel
115s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wearedevs.net/d/JJSploit
Sample260718-ecy4msft6m

Score

7^/10

defense_evasion discovery ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4340	jjsploit.exe

Loads dropped DLL 4 IoCs

pid	Process
1376	MsiExec.exe
4340	jjsploit.exe
4340	jjsploit.exe
4340	jjsploit.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
269	raw.githubusercontent.com
145	raw.githubusercontent.com
146	raw.githubusercontent.com
147	raw.githubusercontent.com
258	raw.githubusercontent.com
259	raw.githubusercontent.com
263	raw.githubusercontent.com
265	raw.githubusercontent.com
267	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{B290DD00-4C97-4138-8CA0-74345D0C126C}	msiexec.exe
File created	C:\Windows\Installer\{B290DD00-4C97-4138-8CA0-74345D0C126C}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{B290DD00-4C97-4138-8CA0-74345D0C126C}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e597a49.msi	msiexec.exe
File created	C:\Windows\Installer\e597a47.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e597a47.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0003000000000735-858.dat	embeds_openssl

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5832	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041efd9123c6b0a670000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041efd9120000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090041efd912000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a41efd912000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41efd912000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288201310021382"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0E332E8E-F01A-42BA-A9A8-63EF714E4BFF}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\ProductName = "jjsploit"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\PackageCode = "992BDA45A1C9683438737609D5EB41B9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Version = "135397380"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\00DD092B79C48314C80A4743D5C021C6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\ProductIcon = "C:\\Windows\\Installer\\{B290DD00-4C97-4138-8CA0-74345D0C126C}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\PackageName = "jjsploit_8.18.4_x64_en-US (1).msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Assignment = "1"	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5636	msiexec.exe
5636	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
4128	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5956	msiexec.exe
Token: SeSecurityPrivilege	5636	msiexec.exe
Token: SeCreateTokenPrivilege	5956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5956	msiexec.exe
Token: SeLockMemoryPrivilege	5956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5956	msiexec.exe
Token: SeMachineAccountPrivilege	5956	msiexec.exe
Token: SeTcbPrivilege	5956	msiexec.exe
Token: SeSecurityPrivilege	5956	msiexec.exe
Token: SeTakeOwnershipPrivilege	5956	msiexec.exe
Token: SeLoadDriverPrivilege	5956	msiexec.exe
Token: SeSystemProfilePrivilege	5956	msiexec.exe
Token: SeSystemtimePrivilege	5956	msiexec.exe
Token: SeProfSingleProcessPrivilege	5956	msiexec.exe
Token: SeIncBasePriorityPrivilege	5956	msiexec.exe
Token: SeCreatePagefilePrivilege	5956	msiexec.exe
Token: SeCreatePermanentPrivilege	5956	msiexec.exe
Token: SeBackupPrivilege	5956	msiexec.exe
Token: SeRestorePrivilege	5956	msiexec.exe
Token: SeShutdownPrivilege	5956	msiexec.exe
Token: SeDebugPrivilege	5956	msiexec.exe
Token: SeAuditPrivilege	5956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5956	msiexec.exe
Token: SeChangeNotifyPrivilege	5956	msiexec.exe
Token: SeRemoteShutdownPrivilege	5956	msiexec.exe
Token: SeUndockPrivilege	5956	msiexec.exe
Token: SeSyncAgentPrivilege	5956	msiexec.exe
Token: SeEnableDelegationPrivilege	5956	msiexec.exe
Token: SeManageVolumePrivilege	5956	msiexec.exe
Token: SeImpersonatePrivilege	5956	msiexec.exe
Token: SeCreateGlobalPrivilege	5956	msiexec.exe
Token: SeCreateTokenPrivilege	5956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5956	msiexec.exe
Token: SeLockMemoryPrivilege	5956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5956	msiexec.exe
Token: SeMachineAccountPrivilege	5956	msiexec.exe
Token: SeTcbPrivilege	5956	msiexec.exe
Token: SeSecurityPrivilege	5956	msiexec.exe
Token: SeTakeOwnershipPrivilege	5956	msiexec.exe
Token: SeLoadDriverPrivilege	5956	msiexec.exe
Token: SeSystemProfilePrivilege	5956	msiexec.exe
Token: SeSystemtimePrivilege	5956	msiexec.exe
Token: SeProfSingleProcessPrivilege	5956	msiexec.exe
Token: SeIncBasePriorityPrivilege	5956	msiexec.exe
Token: SeCreatePagefilePrivilege	5956	msiexec.exe
Token: SeCreatePermanentPrivilege	5956	msiexec.exe
Token: SeBackupPrivilege	5956	msiexec.exe
Token: SeRestorePrivilege	5956	msiexec.exe
Token: SeShutdownPrivilege	5956	msiexec.exe
Token: SeDebugPrivilege	5956	msiexec.exe
Token: SeAuditPrivilege	5956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5956	msiexec.exe
Token: SeChangeNotifyPrivilege	5956	msiexec.exe
Token: SeRemoteShutdownPrivilege	5956	msiexec.exe
Token: SeUndockPrivilege	5956	msiexec.exe
Token: SeSyncAgentPrivilege	5956	msiexec.exe
Token: SeEnableDelegationPrivilege	5956	msiexec.exe
Token: SeManageVolumePrivilege	5956	msiexec.exe
Token: SeImpersonatePrivilege	5956	msiexec.exe
Token: SeCreateGlobalPrivilege	5956	msiexec.exe
Token: SeCreateTokenPrivilege	5956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5956	msiexec.exe
Token: SeLockMemoryPrivilege	5956	msiexec.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
5956	msiexec.exe
5956	msiexec.exe
4340	jjsploit.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 3784	1720	msedge.exe	86
PID 1720 wrote to memory of 5832	1720	msedge.exe	87
PID 1720 wrote to memory of 5280	1720	msedge.exe	88
PID 1720 wrote to memory of 5280	1720	msedge.exe	88
PID 1720 wrote to memory of 5280	1720	msedge.exe	88
PID 1720 wrote to memory of 5608	1720	msedge.exe	89
PID 1720 wrote to memory of 5608	1720	msedge.exe	89
PID 1720 wrote to memory of 5700	1720	msedge.exe	90
PID 1720 wrote to memory of 5700	1720	msedge.exe	90
PID 1720 wrote to memory of 5700	1720	msedge.exe	90
PID 1720 wrote to memory of 5140	1720	msedge.exe	91
PID 1720 wrote to memory of 5140	1720	msedge.exe	91
PID 1720 wrote to memory of 5140	1720	msedge.exe	91
PID 1720 wrote to memory of 2324	1720	msedge.exe	95
PID 1720 wrote to memory of 2324	1720	msedge.exe	95
PID 1720 wrote to memory of 2324	1720	msedge.exe	95
PID 1720 wrote to memory of 3388	1720	msedge.exe	97
PID 1720 wrote to memory of 3388	1720	msedge.exe	97
PID 1720 wrote to memory of 3388	1720	msedge.exe	97
PID 1720 wrote to memory of 4620	1720	msedge.exe	99
PID 1720 wrote to memory of 4252	1720	msedge.exe	98
PID 1720 wrote to memory of 4620	1720	msedge.exe	99
PID 1720 wrote to memory of 4252	1720	msedge.exe	98
PID 1720 wrote to memory of 5920	1720	msedge.exe	100
PID 1720 wrote to memory of 1492	1720	msedge.exe	101
PID 1720 wrote to memory of 5920	1720	msedge.exe	100
PID 1720 wrote to memory of 1492	1720	msedge.exe	101
PID 1720 wrote to memory of 1492	1720	msedge.exe	101
PID 1720 wrote to memory of 696	1720	msedge.exe	102
PID 1720 wrote to memory of 4648	1720	msedge.exe	105
PID 1720 wrote to memory of 2288	1720	msedge.exe	107
PID 1720 wrote to memory of 2288	1720	msedge.exe	107
PID 1720 wrote to memory of 2288	1720	msedge.exe	107
PID 1720 wrote to memory of 2388	1720	msedge.exe	108
PID 1720 wrote to memory of 2388	1720	msedge.exe	108
PID 1720 wrote to memory of 2388	1720	msedge.exe	108
PID 1720 wrote to memory of 2524	1720	msedge.exe	109
PID 1720 wrote to memory of 5784	1720	msedge.exe	112
PID 1720 wrote to memory of 5840	1720	msedge.exe	113
PID 1720 wrote to memory of 4692	1720	msedge.exe	114
PID 1720 wrote to memory of 5956	1720	msedge.exe	116
PID 5636 wrote to memory of 1376	5636	msiexec.exe	126
PID 1720 wrote to memory of 2952	1720	msedge.exe	127
PID 1720 wrote to memory of 2952	1720	msedge.exe	127
PID 1720 wrote to memory of 2952	1720	msedge.exe	127
PID 1720 wrote to memory of 1492	1720	msedge.exe	135
PID 1720 wrote to memory of 1492	1720	msedge.exe	135
PID 5636 wrote to memory of 2064	5636	msiexec.exe	136
PID 5956 wrote to memory of 4340	5956	msiexec.exe	139
PID 4340 wrote to memory of 4128	4340	jjsploit.exe	140
PID 4128 wrote to memory of 4164	4128	msedgewebview2.exe	141
PID 4128 wrote to memory of 1912	4128	msedgewebview2.exe	142
PID 4128 wrote to memory of 1912	4128	msedgewebview2.exe	142
PID 4128 wrote to memory of 1912	4128	msedgewebview2.exe	142
PID 4128 wrote to memory of 4232	4128	msedgewebview2.exe	143
PID 4128 wrote to memory of 4580	4128	msedgewebview2.exe	144
PID 4128 wrote to memory of 4580	4128	msedgewebview2.exe	144
PID 4128 wrote to memory of 1392	4128	msedgewebview2.exe	146
PID 4128 wrote to memory of 1392	4128	msedgewebview2.exe	146
PID 4128 wrote to memory of 1392	4128	msedgewebview2.exe	146

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wearedevs.net/d/JJSploit
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc25fbc188,0x7ffc25fbc194,0x7ffc25fbc1a0
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,8182039826639351315,7627990251359532195,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,16388001046526201874,992933748771467096,262144 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,8003643645349900099,10879769601979039346,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,2050074602950292332,7629303693030976288,2097152 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,5052132920024362617,9319005855196310241,2097152 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5036,i,8684131948297739630,2996765591103910084,2097152 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5476,i,8747822317881986193,3238617408965692058,2097152 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,18333553650263571634,8008836459039343216,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,6063647355312856052,6404444269636123983,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,8658865510962027008,650405659389375563,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6204,i,12485820311340449499,14064968172110936477,2097152 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,17332134773792621966,14790032807637121759,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,1433946893734481842,7116904925737804496,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,1433946893734481842,7116904925737804496,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5140,i,7110801522552021990,17433022055685434735,2097152 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6168,i,18094056587147710935,8618069633673516243,2097152 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,16495728537205823212,2026541787959228788,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,11863968094050550508,10859588956970074910,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,8021395373246587687,2271503998594944686,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,13650183360164914874,6872407986172340294,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:4692
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\jjsploit_8.18.4_x64_en-US (1).msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Program Files\jjsploit\jjsploit.exe
    "C:\Program Files\jjsploit\jjsploit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4340.5632.6166383585440366650
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4128
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffc0e40b078,0x7ffc0e40b084,0x7ffc0e40b090
        5⤵
        
        PID:4164
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,6489800552996920841,13434698636451103908,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
        5⤵
        
        PID:1912
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,6489800552996920841,13434698636451103908,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
        5⤵
        
        PID:4232
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,6489800552996920841,13434698636451103908,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
        5⤵
        
        PID:4580
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,6489800552996920841,13434698636451103908,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
        5⤵
        
        PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6712,i,3285319589295614834,9958297813649218845,2097152 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,6980488707813555793,14342334090133353679,524288 --field-trial-handle=2380,i,5140550128050842637,13045178185586842942,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1DF576950F92DF3950E578DB83F81E92 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1376
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597a48.rbs

Path C:\Config.Msi\e597a48.rbs
Size 20KB
SHA256 63bb262055f808480f9dc8e7d098186432f5249e0e530e48d761b0329c8e2385
MD5 414d9fcc4e7dfd75df471c1e95375acc
SHA1 ef22a57289d47acf73241102f49fda27d1f9e1ab
SHA512 07b134ea69c1e0a35c81ff66a382355cd65ce45d3c840995e44677dbd85f8ae92927097d3815ed3d4c0f6fe03eb688e0dcbf768b5b6cc57aa621b460a2456735
SSDEEP 384:ui0JjF1wp6TrUgIkTBNrTgTTAWnMkt8t8t8t0tstststststststitztztyJgJCV:ui0JjF1wp6TrUgIkFNrTgTTAWnMkt8tR
TLSH
T190A211865F20C2E2D2A70374DB97BB047B71C99E9388920756CC9339D9877C02FA9E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 bb8da5fea36720a6a3b33543742f6c04a9bbbb394e97e8cd7af0cb24873a0f7c
MD5 0bbf1178a3b697b7922d6fd4510c9a59
SHA1 246a310a0fb99cb4dfc737d43009c5e3006d6ac1
SHA512 adac12f99f940fb4a891975d1296814564144c625c5d4b90f02e0c7d9efac9b62e7cef070b1f5f0f8ec339b09d425e51c4112ee557ab1e083daa7993237b8c2c
SSDEEP 196608:eCQhPIwBJTFqtrPh1sVSrwMpACozWhvmRY++b:bQdIwHq1scMMprauvmMb
TLSH
T1D217F725BE8B996CD05EC474834B8A724A7570CF0B35B9FF448596382F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 81708d37ae5e86fc9591be6acc512476cd77c543ea8da13071c33bca77e7a1d3
MD5 bc86433a1a9a6e8d3c9937bc1c14a4ca
SHA1 b79ed7c055917adc21f0242d76c3d8831ed256fd
SHA512 8a52805bca38190577c2c409cd993b3901e968a4c53967a544d34567834b28436733948920820e63bda5ab13d5d0bd93b21d7254e13bce6597f0cde0b2771513
TLSH
T1A141BE1157E90B35E3F5077929A203538A7AFC26EAF4AF6F41C8028D4424500A9BCF7F
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe597d73.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe597d73.TMP
Size 1KB
SHA256 97897dad1c235a6a88dcce738dfb33a0716d6cd2843d684e93216f91e65632b2
MD5 711c0f9feecc5214c6408a5b2856f819
SHA1 c245538b24eac2b2d07e3f3932972a9bcdff71a4
SHA512 db348816a2f97d48af02adb35e6966ff5a4ca74089fa3052ff7faa2ad7658003609bb2e528e2aafbe6059c77194b86abd4798535f50d14a9473dc7271594543f
TLSH
T1E941901157A90B35E3F507BD399207528A7AFC26EAF56F5B41C4028D4424500A9BCF7F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c1aed14dc5270992abd7e3c5d7ba1bda2f5255283c6babd547429bd02eae0b86
MD5 2261ad16e009ed3d9f6f0804ce8c731f
SHA1 d8327352bc8ca09d6b5736052a58cb26c3d3bf6b
SHA512 5453f2eff18f14794dae1fd07ee1c6a79caac6b822fc313c81d23b2dccffaad79d2431378acb52f2d53493384f6d8badf0385d2238748f2f6ddca7a698d69614
TLSH
T100E022BAC862FC2B18FD4B69A009874AEB0113172B44895F3F3C820C8FF862A46C585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
TLSH
T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 27c2d2b079d495980e12f1634280eadbfce15cfeb5e53579f927d27110cfec14
MD5 6151fbf4a2179483f56a8f1b2cc5877a
SHA1 6593ecd45749f81c900e437889e5f1c23fb18760
SHA512 41dc8fbf08eb162e15042967bf60fcd309b5d0eb3a6bb6acb5b21bacd423a9a389bc8eb4d3be0f72c545bd2f6326241cea74257f10d043406ef1e61988672abc
SSDEEP 96:kS2dzBcMnh8LfodSTbg8RFhnlcrX7XsrG0o:kSQXn8fodQ1Tnlcboyp
TLSH
T1A4916D3E01811C65CB12BCF498D33979B4BED8C8F90BCE06C50679B62D2B397A354D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 89e1f23ff20ba69896050d361a512e82972ff3de59ede4bc06b35e8b0fdb2c6a
MD5 feccb921f89b34b9cc479aed88217dff
SHA1 9c759d605ad02c56e4be49459f575e97a123c63f
SHA512 5d645a6e2f2f81bcbaa29d69899011949b6e0c59942ba1ce2e4966e436606305cbb709128065a650fcc64d10ab222683cf871a515596c2eefb026f1d4be4d037
SSDEEP 96:fS2dzCMnh8LfodSTbg8RFhnlrrX7XsrG0f:fSYn8fodQ1TnlrboyC
TLSH
T141915E3E04811C65CB52BCF498D33979B4BED4C9F90BCE06C50679B62D2B397A355D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59353f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59353f.TMP
Size 3KB
SHA256 85afda27c524ca76b8220ab5d11906284680682a1bb69bece95d2e7354804ea6
MD5 b44e5297d12d1221982e127dbac81eda
SHA1 760d6bde27f3fb28e39d65780e3816b93aa9f817
SHA512 d5acc7c6477bb1c0c84f79a0e308796985184c9d7ec8d5f980a843ab03926e8c46a16134593f4629f0c1f8fb09239cf0928f317c74fbd57c678bd0642a5f52be
TLSH
T1A2712A3E05016C60E7257CF5A8E37639B8BEC5C9FA1BDE54C50035375E1B35B4329288
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 3fd2ecee7ae3e4bc9a1078d3bae666c06e77a96ab553be44b110311aaa869f14
MD5 d155d438e66cc6069b1780aa9468a560
SHA1 ec76985e21526b04527c3b1e18802301528935aa
SHA512 77a2d8ec24f173328ddeb14d5c620d6f6a0b650a377b6a461004628c968c3236de0727e016d9381751fa5a05b9a32b812b27e282257aa43c6dae4133725c7b86
SSDEEP 192:D1evlYJpwWOJNxEcJkDJoRaaij6vLW1W7mWCarTGg8ibkoQZwdmIVYPBZOlPcvPI:D1evlEpwW2NxE4kDJoRaaiGvLW1W7mWb
TLSH
T14712BEF7C2E4852E991165F4AB247D3ADF1E191942283D66CCE8EF4F93E2472E20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5dc22110382ed8dfb9a4a5e204e2a334e5f0e9adf516a2332565d5339902d858
MD5 6dd3c8c8231bc54764b84ce4375a9290
SHA1 4bc05b545d8740c4b8cfffc42cd6ed44af61b961
SHA512 99e53c4e87b33c3087c84c13fb031f797c41157739a45f9c3a85668925a7b4daacd7f99dfaba0901c4e221b4bcc5da3c3946edf902775df6d48f3bef95a45baa
SSDEEP 192:sxZBR9yMqZjK1Ml8MkG/fJsshaOlaZduzodpSqHW6+WNrCZ/Yv6C+P+dIgjnJ:sxZB6MG/fJssUeaz1ZHbw/3P4jJ
TLSH
T1E562E9066A3499778CDBD219F6457F93D6F91563A2904E449AFCCF0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1edc9e1971351ef5c586815389728134c1b1f9864d114d1bcfc050f76958d838
MD5 b584103cb3b78f8c38e68a0a95ee69ea
SHA1 a23e407934b95fbc6854cbedd27df5ed52b90f6c
SHA512 ed7018125495e30886ef0af4eb6a71f4fceb4b55451ab27b7d8998b1ee8fa0f47aa5b792f04b6168cdae2e0282eb6e5d1b15936d9ce3b9e1b68fba6458404bf3
SSDEEP 192:sxZBR9yMqZjK1Ml8M9G/fJsgaOWZduzodpSqHW6+WNr8zZYvAfGP+dIg5jnJ:sxZBy1G/fJspnz1ZHboZIP4RJ
TLSH
T13562E8166A349977CCDBD209F6457B93D6F91163A2914E449AFC8F0C08E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f94776bfb8012b26b657169ffdaf76f98bcb4ba070a1fc8005e2062524fb526f
MD5 cfc27a533a317b6fab53d60e35683ddd
SHA1 90fef33070e8d5c04e2171793c88e130164df69f
SHA512 5ae3dfd7f17e4a8e7463f1032c4c7c607ec0410b2d5d7310f69d43246d29f476754edcf4e2e6441096c195176e95e196063b7fc0251af5d0526e1ed935138767
TLSH
T14AA00217C99640A9C12052F7E3494AC8B2394814122D762950B904B8C878240D593004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dba5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dba5.TMP
Size 48B
SHA256 1eb3e51bd0c066d744dc33d88265549f9b3ec16891f50166875f7c7fdfe25296
MD5 460a619f3cee34245dbb02dc05c92d2b
SHA1 7608ce17dc654ce461094eb2d45f35a1bcec2c30
SHA512 890c7e93ea046fbd54015e3793917e6361289862ecae5e7d08db3b8719221bff1a4ee61f00cba66aeff60cab5ce033ca9ec1ae75ec58a39b621ff7fefc0f25ce
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 6b2c8f4403111babfe2c87ec9c007adb35b2243ef97a01062c5449efcdd1e225
MD5 a010a70e6a196f8ae38619e0539bb287
SHA1 55af77f146a50aef03b43aefda72f5f454e7cb68
SHA512 730f1fbc5c8d166f3d67dbca3158b31f5011762b09cb706f686f27e5b3e5fbb44dda292642df96fc1c073ee007a30aa54085c8f5640522dc5c95de9db6daae32
SSDEEP 768:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzdz8:0LppY93PBZJPtN53Dbz8
TLSH
T11BB2695A713A0211393E2988B39596364F8235A33058F4AF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 39bb8e72998a2ef67b3f4f2c51d20daa4af8d5662d959de32b99bf6bc081eef2
MD5 396cbd060bafed0407490bea106cf113
SHA1 fadfb1b98ac88579c27d3aa04e7d38dadc69eb41
SHA512 a55b6b87369bad2e1093fec262a557577c9679d699298993c40a572a8c9baaf333ae1037151dfe0303a7d8a4b10c97f4ae054e31ce2ffca3f4d82cd5cc929f3b
SSDEEP 768:pHFccps3awgbkUk3oGpENdwjn5VkI8p0KS:ds3MiHO7I8p05
TLSH
T111C25C32E898DEABECD74F99B74A3507DEE04227868C9AD4DADC5D4D00971ED430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 799d5d9e73fe5d1318b2b604e79491f075f7ac09c3e804efe7c99f26961ac5bc
MD5 dd7e0d64dfd616d39b869e07f6f0fcc5
SHA1 072db3370480e60379e85fe86b3537c12f3e356c
SHA512 a6036274c4178333f3476e059af926414eaa09d80ce01ee190026073f820fdc48f9e7f6c8e3faf927a5ba56b1b9e80be78529b28ec0001e75198666f768cb866
SSDEEP 384:ntiFVtNn/s3n9S+3sNn8TUNTUlI4TQckCrdN92phiftGfFmmEEXIQ/4dWnjnHVkd:kFVj+9P3KwgSkG9ooGpENdwjnHVk29Mv
TLSH
T158D24A32E894DEA7ECE74FD5B75A3A57EEE04263868C5AC8D9DC5E4C04C71AC430B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a484ded1dc36e42d87a746dd659b0bc9aca7c28e11de149c72f507045024d597
MD5 8ee2a7b3d4f04a060ae1ffb24dc3e945
SHA1 f674775a5ae44a04e54190f9784ceb105a329b45
SHA512 21254d57cf842e6c09a4b7af2374d5b98119721fd42e2e746ee0c00c47fd41d12f123cf82371d9fc1ae8f0a0b1b0ffaf22e3fb32b623bcc2c32c30c4c3ca7d58
SSDEEP 384:npIiF9CcmyWCs3sNn8TUNTUlI4NQckCrARsphiftGfFmmEEXIQ/4dWnjn8VkA9yk:pTFccps3KwgakB6oGpENdwjn8Vk0D
TLSH
T1D7B22A36E898DA67ECE74B99E75A3543DEE04263C68C5AD8DADC1D0C009B19D430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ea5a3e11bdbac59db597478a4314b821fa34580aa91bf4f013377f64e84c02d7
MD5 7654116b730f364b7d82712225620337
SHA1 d57c441a8828cf7863ab87ddee68d251d41374c0
SHA512 0813a2e7ba799cf7c8a747130240cc709c82499799e2121830c89be8b642f3dd4e8fac0cc79688e0cd3c7eb887ae35508b1e2f0123dc6b37749e559b02ec5ecf
SSDEEP 384:ntiFJtNn/s3n9Sr3sNn8TUNTUlI4TQckCrgN92phiftGfFmmEEXIQ/4dWnjnIVkd:kFJj+9a3KwgSkR9ooGpENdwjnIVk29Mv
TLSH
T100D24A32E894DEA7ECE74FD5B75A3A57EEE04263868C5AC8D9DC5E4C04C71AC430B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ccbc719b566a5850d1731bda6cdcf90c8a8b533f6a3ebd8b8ea25ea3cc0fefa9
MD5 257a758cb181224e81e6ef8429fc3f21
SHA1 f8900d2cbda42f970453baaa86ee143c6d71d938
SHA512 2d90a9046cec541eaabf9c5cc7aaba0cd73c5ec9fb02dd9d109c05079714f5e161a6090c0bff4ea7a4da3c3844715d1dbca66978d5d16ecd0cc1ad959bc7ed48
SSDEEP 384:nFiFrtNn/s3n9SVI3sNn8TUNTUlI4TQckCrTN92phiftGfFmmEEXIQ/4dWnjnfVa:MFrj+9/3KwgSkY9ooGpENdwjnfVk29Mv
TLSH
T16DD24A32E894DEA7ECE74FD5B75A3A47EEE04263868C5AC8D9D85E4C04C71AC430BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7bd880491940c2d801094d2b6639a9081f78773ce4655fe4fe78d051001f5dea
MD5 8c5d16ce41292f2b133633eb723d3609
SHA1 0c9e7874906f62eb9faae222eec37d601e454bb0
SHA512 85ea8d710206dfa8379b00fbd8b2783dd0eecbf7c7cc56b45c8ef75dc73e069461f9f4c96b3af172455e125931257c8a460b98199999da11c16e7465c8b2c53a
SSDEEP 384:ntiF1tNn/s3n9SGR3sNn8TUNTUlI4fQckCrWN92phiftGfFmmEEXIQ/4dWnjnIVa:kF1j+9r3Kwgmk/9ooGpENdwjnIVk29Mv
TLSH
T16AD25A32E894DEA7EDE74FD5B74A3A47EEE04263868C5AC8D9DC5E4C04C71AC430B919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0d5e6506d5826aa631b22201aff3585a0e3de0a303bf08e2dca1fda102d099c7
MD5 2f2f6491b55e35f4c75145eb1a450ac1
SHA1 b6100c7335c2753d0ef2b8d4d31fd7d5f2b06b5d
SHA512 bc1c43ec0b05421e98c245accea5c4612c5610c8d3283343eb7ed2c34c2b4e67b49738cc2a9de40ce75b45484b91ffbd8271c3c3eeb24bfc1c042da288a17355
SSDEEP 384:npBiF9CcmyWCs3sNK8TUNTUlIm2QckCr9lHKphiftGfFmmEEXIQ/4dWnj2jpde4a:poFccps3bwgbkUxkoGpENdwj2nI8p0KS
TLSH
T115B25B36E868DEABEDE74F89B74E7A07DEE0122785DC59D8DAD81D0D009319C430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f7b2b3ad8f603c8cea87d8e3b0859970a9436105b41de2563543136d087c94fd
MD5 2ffb27734254dd27c8431ee40eb06835
SHA1 de2ba27e9efe177ae2f52111bd5a4d6d3769c6c3
SHA512 3f2c99412cd638bed78c310fefa3909c0e42aac0af7a1bdd529106871fd1ed6419e613348f4efdb2fb531498f762c640ebd71aa4c32e81f55ce6f04fa40e046b
SSDEEP 384:nFiFVtNn/s3n9SVa3sNn8TUNTUlI4TQckCrdN92phiftGfFmmEEXIQ/4dWnjnmVa:MFVj+9N3KwgSkG9ooGpENdwjnmVk29Mv
TLSH
T10DD24A32E894DEA7EDE74FD5B75A3A47EEE04263868C5AC8D9D85E4C04C71AC430BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 920ad597f6a2065d5ca6738f2e9f2fb35188d34132d68e37adc0283cfa03e7e2
MD5 535ccecea927803489b75b55a897d4cc
SHA1 8a36f2f1b7cc47ef8f8e8e04f9b1ee7ce932fdf1
SHA512 f956ed8e88f125d83fbaa8bbae06353c01da4d867e8902b382189b4744551a18aac76e11f718139965bf557da464bb2518a3032fe3faf44ca991a6e5b8a0d31e
TLSH
T19841F458B6E91148B3B76F56ABB6A86E447EBC772F1BC45D10110D8E0A27B01C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3629.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI3629.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19201766-3a56-405a-bc9b-eaac05d01a52.tmp

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\19201766-3a56-405a-bc9b-eaac05d01a52.tmp
Size 2KB
SHA256 76afb2bd82ee71cd324d0560b15a5492054f25c4a77c6d99135f8d696756941c
MD5 9395713e811330cf36b4fde0d09dc347
SHA1 3a1182e029e818b0536ebbd222a4c93327b4a59f
SHA512 dc1d8ba05bf768f6a6220f7d122000e2e9b229b4c38292f95620579eeb0aa3550d0b5f6708d47ea15cf7a7aca085777306ac7c9affae0f630b0a0181336f2700
TLSH
T1FA51A533A8489E7769D39A44FD893FA69A36916197515F649BDD0F0C01DF29C3303C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 63afde0d3dca4c509ed5e61db2c41a728e03a3a51c3ab4046ec1a079faf0d47e
MD5 8b872b8bdb79214d812a390620ef3468
SHA1 c92af4d25a199bf0aa0041dffb5be1537861de5a
SHA512 793e0192dd23ce4af755db3994c217b8ec7690d3a9e342df9976eaf2f839350394060dae15e45763415764d4d9c50e10081e90013df1776bc7ff49f03c2c66bb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d046ec11c0446b0a728554fbc33a3a52464e49456b11346f5bf40bb440595da5
MD5 388c4b76cd67bef2c8f6305993a3f87b
SHA1 7e7a0b03165c5d6d8fc345f109b4ad15caf3bcd2
SHA512 f3ef2c06f66c39b59f0d90f1f0e6d867c88b240e199bd16807eb31e463b1d2b037ef77d80bc93f687a2d216e169be37431e48d934c4816324cb3bc21b6e8e4df
TLSH
T1F2D0122636111234C01020730502B75D0500D12F40068441542E851F5B040501903482
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 37a559f30ebb408e0e7fce60b81064606a1c92c107a40ed3f68b21f3ac82916a
MD5 a438164e6be8a88f72aa4c070dce2efd
SHA1 551d3156fb8cfad3421f610cfb578474049a1ff0
SHA512 17c98a1838007a9645ce39507cfe77caccc95e9036b89fda02b398f2e490f7f47a9ed563adc33e4eb39c6992f94989450145a571deef47e7fda0ebaf5f21fa36
TLSH
T10EC0921EC21805A1C7812BB2A4C3488536B165AE01E77957499B1CE1A92269782C2804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c26f78ae50a8cb71ce1d7f03ab030de17ef4c0ee6f9754910cad9655115a7da9
MD5 8de8e08372d7d8c3b20f85171f19547d
SHA1 404f1bcce02bac0d0cee88729c0a9031aab53dd0
SHA512 35676438a319cd8ee43b876a69499ac67e3f84703193eb99bbaefc879242251995e91d0a2e61772e52b58dddce5c050ad2bdeec139423f1868571080484eee89
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 ae7f833b84254dda06c3ae2585d39c9f75ba7788074a85d0fad0aa1ba6891fa6
MD5 c4a54b4cb9c8824aa0c43af7bb82f80e
SHA1 226778076cb4af35f767c267d66c99f4212d16d1
SHA512 2275e78fe666937afe22d923eaa7f23fa396fadb913bf7375e99e8a648cd1af6334af9fdbdb6c290b4109659bf6ac8c1937b4c555fd2bc10b3b97fac8459f296
SSDEEP 384:zcsrv+89zHqlDNP9oid6NbNQlxTDFjAVmNp:zrv+4UNbd3lhFjAVmNp
TLSH
T16E729D33A16C9A376DF2E844B88A2E1B7B74919691C10BA8DAD91F8D46DF0D83307D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 50821cfc7bb3d5ee24be042c4f5b141b91b003316e87f631c11a630a46fd3260
MD5 abfbe5e7e46c3757d5aedda13372e045
SHA1 8eb7b25e80a889fb23f4dbef403a0b5a5e1bdcf4
SHA512 53ebdc08d9635b497bb6a1231e105b8198102f4a4461bddf24b6bbfa9ab64005fcaf0d87c400ad4ead566fed53fb28cd0d92c7146fc2fe7e25417feb335dd96a
TLSH
T17071743765689D272DE39A44F8C53F56B6625123D6956FA8CAEC0F0C01DB3D82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59a9b3.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe59a9b3.TMP
Size 1KB
SHA256 bbd0f2a550a5b74107b40bf4bfa166cbcaa12a0fe9de178ee60be22c9f75b517
MD5 2c69635370fcf8faf807d359f1c596fb
SHA1 7d717325942785e0c5ab6d97f2635f9deafef90d
SHA512 66899ba0533a6895fbfcc532e7f206e57f2effcea8feabd42ef6983833999608734db26ef2ca9d295d12943bf607fcc310c6719e5c4c0c6023199d2c26be7eb7
TLSH
T1AB216F77C4C86E763D879A85F6827ACA2E5152629314CF1C96DD1B1C07CB6DCA223C23
MD5 SHA1 SHA512 TLSH

Submit Download

eb2efce7-778a-4cf9-b468-061152d44cdf.tmp

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\eb2efce7-778a-4cf9-b468-061152d44cdf.tmp
Size 1KB
SHA256 5f9dcc9242ed01a6e9a069e51de7b15f25840caf0b3315b759bb24738cca905f
MD5 6e665df5e50390d47d451b5932774fb3
SHA1 8c0885a95f9afa900f006221a91894b6dba9bbb1
SHA512 19bb29d35f4dd5978acd4dbe69ad33553a28b7905cc243b36bd0d8cb6ed57bc6781c633aa3366f1774cd2a9bfb9f8eb54926af2277044834917e745e6f9e7d26
TLSH
T186316073D0985E763D83A686F5823AAB2E211166C350CF4856DD0F0C06DB2CCB227C22
MD5 SHA1 SHA512 TLSH

Submit Download

WRD.dll

Path C:\Users\Admin\Documents\jjsploit\WRD.dll
Size 2.3MB
SHA256 d20818340aa56b55d206f1aac330a25f6c09d39efc604ff9aff6a7e71e42396e
MD5 e0a708ab169d72c33c70d62768cd7923
SHA1 0b4693228b5e0701907377c2afedf38015e0adc3
SHA512 d160485320ac70851f8a3274ed2eea5c7b562376c527ae8e86ed9bfebb8f9c2a419af5a34c7cefb84f52c98f854ad54b3b8d66bda005bdbd49486bf03aaa5790
SSDEEP 24576:RHDJROzvYaDruvr4sPY4yscBLOgiU18jwC77e89vFwKMRO7yMQuEkacohlFZKOhm:RWwaevFPY4yRflm7ib1kNol/ODTjzz
TLSH
T123B59F17F65900E8C067D1F8CA5B9A13EBB278194324A7F712E1A6652F23BE14F7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\Documents\jjsploit\libcrypto-3-x64.dll
Size 4.5MB
SHA256 03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
MD5 a9c1f7ca15c65c139bc9d4bf57df2e1e
SHA1 1b1377139a6b289d43a6b1161cd1089ffc817cf9
SHA512 97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
SSDEEP 98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC
TLSH
T112269DA9A5BC0056E86A91BCC3876227D371B51657F057CF2E688AF90F23FD1227B740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\Documents\jjsploit\libssl-3-x64.dll
Size 802KB
SHA256 0bda7daeb4040c722b8c287dfd2307c9b8228576db1dbbbaac901c35cc8dc62b
MD5 51b0d5f42a82f6fa8739b403e9b8b81c
SHA1 75968c157628bb7aca9b5f2331f7a0c9a1d28865
SHA512 94fba90ad7bcf190079089dcc3af97c598c016eb359fe4d2ea439b5fbcd4a5489ab4422652223926aae64002beef1368d5b95874f68a2e5bc4971b4f9604d814
SSDEEP 12288:Mzjte0Fevo3VS1npHEDHLqjRmqWSTzt7opiTdEVB3S:M9e5o3VVZVSPtopwdEVB3S
TLSH
T189053B69BBB8059CD876C13986934213E6F6B4563370EBDB0B648A790F23BD4273E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

664bafbb-e7aa-4c0c-af58-3697ec8a1d23.tmp

Path C:\Users\Admin\Downloads\664bafbb-e7aa-4c0c-af58-3697ec8a1d23.tmp
Size 384KB
SHA256 9e513fd191373f80373771a62a980cfb89d350adcedcb6b7aa144fa3a5c5c8b4
MD5 0071ff418726b393ce70c65cd3ed2274
SHA1 8b0ab9963536250f7a24f7ad2ca14665af5d78dc
SHA512 9447f907d49d72e052f369466de0a58cadfc26d7f652438e45fe4c23010e2611af60bd5e03ee82e4ffbea6bd2459ca486000aa5c0058fff8bbd01870c0b89085
SSDEEP 6144:vlepqoah7uT+X0JeEnsayj73l/UdaOWS0ENWYRlCJDqHhm4f2ml5yT68WJy:depq1FuFGAfNdnRl2DqHht2mzWUy
TLSH
T1A984221ABDC38F62D5B7717B05EEA528D004FD340B60CB875FEEF32A62757255A48222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit_8.18.4_x64_en-US (1).msi

Path C:\Users\Admin\Downloads\jjsploit_8.18.4_x64_en-US (1).msi
Size 6.0MB
SHA256 ea003af9543a0300e61e0e4df3ed6347fc4eb89fa79a110467581be59f9780c5
MD5 5d1dcad60da204b74e2edc56605a2004
SHA1 91262fdbc9e31d12c7df97c65f20a273ac27e371
SHA512 4e4b9b20a0d53c26dd4396c3811466b152fe20f95d27f278e5d1dc2078de349086afd6973c94b42b05b42b62ce004c82d794b278d7efe131e9e625dc57faebb4
SSDEEP 196608:U05+XgdXVfoLhOumykPBnjfdhYm37t+oS/N:f5IgRZolOAkPBnx6mLt+tN
TLSH
T12056331F7EA08A32D0620DB2483E5BA1D938BC300A56A5A727E9775DDDF25D00FB0DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 a6a477cf64570a2fd86cc52d370d33f94a1fbc38585644eefd0a396d39b44f35
MD5 b12d87a9dae2e19d45d7025c6a55de76
SHA1 9e01cf394987dadc1308fbe6b9474bda921aca13
SHA512 f4ae3c9556359ec058890913a4de5010725e2dce02d09b9caf622e5103085d0eadab718312605a7bec2c42a76a3324ab9b37407f06d8afc22fc46ccdb699f6f4
SSDEEP 24576:0u8m+1zHdoO/vvTL7WNeImKZc00jV1dShLmtPC8Vl0aMOqkAIv1UF7GRo:c
TLSH
T12F47C42437FD2210E7F79E3C68F06A27893A7D5B9C159E8D05411F8E0961BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0ef874c3-a4a5-43ac-bae2-7bd26414274d}_OnDiskSnapshotProp

Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0ef874c3-a4a5-43ac-bae2-7bd26414274d}_OnDiskSnapshotProp
Size 6KB
SHA256 eae61af1678ad53e59118b8b30295ca6c77ae9db76cf4186dad9c15585084e9e
MD5 2ef85bc55608d2b3c3bef225b9f6886a
SHA1 8906e1a8b3fb792946b0e5d6b96672c133e39c96
SHA512 9cfbfc57eff86f238a1a29515fd39d5a648e434166882babdec3583b6c6d382dc36a6366c2713fb271e72ce50dfb1ee8979ed41c15cae04f767d1fef9f6e9ba4
SSDEEP 96:FWQenWvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:kQFb++ZVmN
TLSH
T16DD189185AE54711E2B3AB7129F18557A477B811EF33CB8E0198638E2670A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-723-0x00007FFC3FF00000-0x00007FFC3FF01000-memory.dmp

Download

memory/1912-602-0x00007FFC3FF00000-0x00007FFC3FF01000-memory.dmp

Download

memory/4580-817-0x0000012FA1170000-0x0000012FA11A0000-memory.dmp

Download

memory/4580-648-0x00007FFC41130000-0x00007FFC41131000-memory.dmp

Download

memory/4580-647-0x00007FFC40BA0000-0x00007FFC40BA1000-memory.dmp

Download

memory/4648-430-0x000001E661B20000-0x000001E662B20000-memory.dmp

Download