hxxps://wearedevs[.]net/exploits

Analysis

user interaction
yes
max time kernel
355s
max time network
357s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/07/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wearedevs.net/exploits
Sample260719-c19h6scx81

Score

8^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe

Executes dropped EXE 2 IoCs

pid	Process
5876	jjsploit.exe
5704	Procmon64.exe

Loads dropped DLL 1 IoCs

pid	Process
4556	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
99	raw.githubusercontent.com
100	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe

Drops file in Windows directory 56 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1457457265\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1457457265\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1926037068\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1926037068\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_844458515\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\Social	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{B290DD00-4C97-4138-8CA0-74345D0C126C}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{B290DD00-4C97-4138-8CA0-74345D0C126C}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58b38e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\male_names.txt	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1677518175\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_844458515\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\Installer\e58b38c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b38c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1926037068\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1457457265\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_844458515\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1677518175\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B290DD00-4C97-4138-8CA0-74345D0C126C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB512.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_1656778306\test.txt	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procmon.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4572	chrome.exe
1384	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064924c57361694940000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380164924c570000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410164924c57000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f64924c5700000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7164924c5700000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289020435722056"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\shell\open	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Downloads\\ProcessMonitor\\Procmon64.exe\",0"	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\ProductName = "jjsploit"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\.PML	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\PackageName = "jjsploit_8.18.4_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\.PML	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Version = "135397380"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\00DD092B79C48314C80A4743D5C021C6	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\ProcessMonitor\\Procmon.exe\" /OpenLog \"%1\""	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\PackageCode = "992BDA45A1C9683438737609D5EB41B9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\ProductIcon = "C:\\Windows\\Installer\\{B290DD00-4C97-4138-8CA0-74345D0C126C}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Procmon.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\shell	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Downloads\\ProcessMonitor\\Procmon.exe\",0"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\ProcessMonitor\\Procmon64.exe\" /OpenLog \"%1\""	Procmon64.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1692	msiexec.exe
1692	msiexec.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
4408	msedgewebview2.exe
4408	msedgewebview2.exe
5888	chrome.exe
5888	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5704	Procmon64.exe
2388	Procmon64.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
5704	Procmon64.exe
2388	Procmon64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
5904	msedgewebview2.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1020	msiexec.exe
Token: SeSecurityPrivilege	1692	msiexec.exe
Token: SeCreateTokenPrivilege	1020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1020	msiexec.exe
Token: SeLockMemoryPrivilege	1020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1020	msiexec.exe
Token: SeMachineAccountPrivilege	1020	msiexec.exe
Token: SeTcbPrivilege	1020	msiexec.exe
Token: SeSecurityPrivilege	1020	msiexec.exe
Token: SeTakeOwnershipPrivilege	1020	msiexec.exe
Token: SeLoadDriverPrivilege	1020	msiexec.exe
Token: SeSystemProfilePrivilege	1020	msiexec.exe
Token: SeSystemtimePrivilege	1020	msiexec.exe
Token: SeProfSingleProcessPrivilege	1020	msiexec.exe
Token: SeIncBasePriorityPrivilege	1020	msiexec.exe
Token: SeCreatePagefilePrivilege	1020	msiexec.exe
Token: SeCreatePermanentPrivilege	1020	msiexec.exe
Token: SeBackupPrivilege	1020	msiexec.exe
Token: SeRestorePrivilege	1020	msiexec.exe
Token: SeShutdownPrivilege	1020	msiexec.exe
Token: SeDebugPrivilege	1020	msiexec.exe
Token: SeAuditPrivilege	1020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1020	msiexec.exe
Token: SeChangeNotifyPrivilege	1020	msiexec.exe
Token: SeRemoteShutdownPrivilege	1020	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1020	msiexec.exe
1804	chrome.exe
1020	msiexec.exe
5876	jjsploit.exe
5876	jjsploit.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe
3512	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5704	Procmon64.exe
5704	Procmon64.exe
5704	Procmon64.exe
2388	Procmon64.exe
2388	Procmon64.exe
2388	Procmon64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3824	1804	chrome.exe	82
PID 1804 wrote to memory of 4860	1804	chrome.exe	83
PID 1804 wrote to memory of 4860	1804	chrome.exe	83
PID 1804 wrote to memory of 4572	1804	chrome.exe	84
PID 1804 wrote to memory of 3628	1804	chrome.exe	85
PID 1804 wrote to memory of 3628	1804	chrome.exe	85
PID 1804 wrote to memory of 4948	1804	chrome.exe	87
PID 1804 wrote to memory of 4552	1804	chrome.exe	88
PID 1804 wrote to memory of 4948	1804	chrome.exe	87
PID 1804 wrote to memory of 4552	1804	chrome.exe	88
PID 1804 wrote to memory of 4616	1804	chrome.exe	89
PID 1804 wrote to memory of 4616	1804	chrome.exe	89
PID 1804 wrote to memory of 4296	1804	chrome.exe	96
PID 1804 wrote to memory of 4968	1804	chrome.exe	98
PID 1804 wrote to memory of 4968	1804	chrome.exe	98
PID 1804 wrote to memory of 4840	1804	chrome.exe	99
PID 1804 wrote to memory of 4840	1804	chrome.exe	99
PID 1804 wrote to memory of 4724	1804	chrome.exe	100
PID 1804 wrote to memory of 4724	1804	chrome.exe	100
PID 1804 wrote to memory of 4116	1804	chrome.exe	101
PID 1804 wrote to memory of 4116	1804	chrome.exe	101
PID 1804 wrote to memory of 4668	1804	chrome.exe	102
PID 1804 wrote to memory of 4668	1804	chrome.exe	102
PID 1804 wrote to memory of 3184	1804	chrome.exe	104
PID 1804 wrote to memory of 3184	1804	chrome.exe	104
PID 1804 wrote to memory of 3172	1804	chrome.exe	105
PID 1804 wrote to memory of 3172	1804	chrome.exe	105
PID 1804 wrote to memory of 2016	1804	chrome.exe	106
PID 1804 wrote to memory of 1020	1804	chrome.exe	108
PID 1692 wrote to memory of 4556	1692	msiexec.exe	111
PID 1804 wrote to memory of 5252	1804	chrome.exe	115
PID 1804 wrote to memory of 5260	1804	chrome.exe	116
PID 1804 wrote to memory of 5268	1804	chrome.exe	117
PID 1692 wrote to memory of 6128	1692	msiexec.exe	119
PID 1020 wrote to memory of 5876	1020	msiexec.exe	122
PID 5876 wrote to memory of 5904	5876	jjsploit.exe	124
PID 5904 wrote to memory of 5712	5904	msedgewebview2.exe	125
PID 5904 wrote to memory of 6072	5904	msedgewebview2.exe	126
PID 5904 wrote to memory of 6072	5904	msedgewebview2.exe	126
PID 5904 wrote to memory of 6072	5904	msedgewebview2.exe	126
PID 5904 wrote to memory of 6096	5904	msedgewebview2.exe	127
PID 5904 wrote to memory of 2732	5904	msedgewebview2.exe	128
PID 5904 wrote to memory of 2732	5904	msedgewebview2.exe	128
PID 5904 wrote to memory of 1808	5904	msedgewebview2.exe	129
PID 5904 wrote to memory of 1808	5904	msedgewebview2.exe	129
PID 5904 wrote to memory of 1808	5904	msedgewebview2.exe	129
PID 3512 wrote to memory of 5872	3512	chrome.exe	134
PID 3512 wrote to memory of 2708	3512	chrome.exe	135
PID 3512 wrote to memory of 2708	3512	chrome.exe	135
PID 3512 wrote to memory of 1384	3512	chrome.exe	136
PID 3512 wrote to memory of 1140	3512	chrome.exe	137
PID 3512 wrote to memory of 1140	3512	chrome.exe	137
PID 3512 wrote to memory of 1440	3512	chrome.exe	139
PID 3512 wrote to memory of 3752	3512	chrome.exe	140
PID 3512 wrote to memory of 1440	3512	chrome.exe	139
PID 3512 wrote to memory of 3752	3512	chrome.exe	140
PID 3512 wrote to memory of 4688	3512	chrome.exe	141
PID 3512 wrote to memory of 4688	3512	chrome.exe	141
PID 3512 wrote to memory of 2240	3512	chrome.exe	142
PID 3512 wrote to memory of 5668	3512	chrome.exe	143
PID 3512 wrote to memory of 5668	3512	chrome.exe	143
PID 3512 wrote to memory of 4152	3512	chrome.exe	144
PID 3512 wrote to memory of 5708	3512	chrome.exe	145
PID 3512 wrote to memory of 5688	3512	chrome.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wearedevs.net/exploits
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffa9095c728,0x7ffa9095c734,0x7ffa9095c740
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,5302878362283528003,12660313840398194354,262144 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,16691831209259204458,17242956689017416919,524288 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,14861809818611569423,14947135997822876608,524288 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,10046626323621963126,10148748732056839396,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,8795524066717400391,10057991972537437904,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,16039838451963491295,11901297698960819936,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,3616384404118734340,11410903229464693001,524288 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5756,i,16985585678530394746,1293085651087384851,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4840,i,16472126976346928324,4822281999629732762,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5800,i,11970675359074538039,5862776021724407171,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5940,i,14380248162481762535,681688601033382596,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4756,i,591532066839001504,9125731133054154828,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5676,i,3429033904226794258,11650600708620523187,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6824,i,10011497520588745675,13424525012934116847,2097152 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,11182787561176908388,5982830676671735120,524288 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:2016
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\jjsploit_8.18.4_x64_en-US.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Program Files\jjsploit\jjsploit.exe
    "C:\Program Files\jjsploit\jjsploit.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5876.5900.5448128816397547224
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5904
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa82a6b078,0x7ffa82a6b084,0x7ffa82a6b090
        5⤵
        
        PID:5712
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1844,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
        5⤵
        
        PID:6072
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1944,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:3
        5⤵
        
        PID:6096
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1904,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
        5⤵
        
        PID:2732
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3120,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
        5⤵
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4536,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
        5⤵
        
        PID:4328
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4472,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
        5⤵
        
        PID:4152
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4636,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4408
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3868,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1624 /prefetch:8
        5⤵
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3628,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:8
        5⤵
        
        PID:4072
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4632,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:8
        5⤵
        
        PID:1860
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4628,i,6967390189763049906,9543460718181258976,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
        5⤵
        
        PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6804,i,7805530360515915468,10957195351846569425,524288 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7072,i,1153124125269095543,4985876581143708320,524288 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6996,i,10659984181969065611,13757706464212460085,524288 --field-trial-handle=2000,i,14280981682730192520,12657247069735946849,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:5268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4904

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 16A1E1FCDCDA551D0DCCEF4F4C0BCFF0 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffa9095c728,0x7ffa9095c734,0x7ffa9095c740
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,17024519998039043472,14920101712942548601,262144 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,8553735330867140663,834710097660017733,524288 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2552 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,3301099982606411397,3565051032432295397,524288 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,13055041788284520241,7382207346610632260,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,4408926386848426308,7644505877926814949,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,13070148156455796698,1147747463497477366,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,6477547843512250000,638938632932264744,524288 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5316,i,11310471358452904476,9338373310536115014,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,3932060965632303071,5338665548000775371,524288 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3340,i,17415151292877854384,12282714956359237514,524288 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3344,i,14290925153561142284,4333468522058981716,524288 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3420,i,17106840030683140248,16238168410757785651,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5648,i,295309678567967258,14970336645222732952,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5756,i,2340378265968483245,14923559161058152327,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,457016651148967724,1826083872826971313,524288 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5760,i,6664768669306938992,11972060535441055553,262144 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4512,i,5219425881138064822,13491042995329582075,524288 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6180,i,2981083113786650157,9637703408789132806,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6320,i,2076375344211907281,1815261332537527376,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3452,i,6969796298586452361,16935230820651054761,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5772,i,9652702941487285732,18356897689358715060,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6292,i,3615091192115414685,38031518029663715,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6096,i,11473317722517532123,13556012951901102911,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5720,i,8893498867710656606,9552345359042300229,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6448,i,442206321569245985,10550259501045675991,2097152 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2632,i,18015969789083806821,13124973387902511751,524288 --field-trial-handle=2028,i,8157505018033755872,7811013147456668689,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5524

C:\Users\Admin\Downloads\ProcessMonitor\Procmon.exe
"C:\Users\Admin\Downloads\ProcessMonitor\Procmon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:872
- C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
  "C:\Users\Admin\AppData\Local\Temp\Procmon64.exe" /originalpath "C:\Users\Admin\Downloads\ProcessMonitor\Procmon.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: LoadsDriver
  - Suspicious use of SetWindowsHookEx
  PID:5704

C:\Users\Admin\Downloads\ProcessMonitor\Procmon64.exe
"C:\Users\Admin\Downloads\ProcessMonitor\Procmon64.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b38d.rbs

Path C:\Config.Msi\e58b38d.rbs
Size 20KB
SHA256 63289d30dbf245718ccf3717f12b02852de1013e51b179dc484c7cfee37aab00
MD5 46601006302680de7b237359398443d8
SHA1 77856a0d9a4f268ef75359cfcb888a30659c86da
SHA512 8065ab982c66bd6fde230bf9398d6d2b617e4ed3a501e2f5ab8ea41ee016fc9ef000a511d7b6e1b9c11e7ae7127b8810ac65b3cfe0745ddf46cacfc104111b1e
SSDEEP 384:TA0JjF1wp6TrUgIkTBNrTgTTAWnMkt8t8t8t0tstststststststitztztuYgYCb:TA0JjF1wp6TrUgIkFNrTgTTAWnMkt8tf
TLSH
T16EA210865F20C2E2D2A70774DA97B7047B71C99E9388920746CC9339D9877C02FA9E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 bb8da5fea36720a6a3b33543742f6c04a9bbbb394e97e8cd7af0cb24873a0f7c
MD5 0bbf1178a3b697b7922d6fd4510c9a59
SHA1 246a310a0fb99cb4dfc737d43009c5e3006d6ac1
SHA512 adac12f99f940fb4a891975d1296814564144c625c5d4b90f02e0c7d9efac9b62e7cef070b1f5f0f8ec339b09d425e51c4112ee557ab1e083daa7993237b8c2c
SSDEEP 196608:eCQhPIwBJTFqtrPh1sVSrwMpACozWhvmRY++b:bQdIwHq1scMMprauvmMb
TLSH
T1D217F725BE8B996CD05EC474834B8A724A7570CF0B35B9FF448596382F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 8fdd37e21889f75249675a0f3788ed6943832aa8c32e737402666837c8663672
MD5 c3e3fa2538b29ef0995fe24d10e5ee22
SHA1 83ac22638c9e1a178ea9072a762d35b5dad05442
SHA512 316b97629aeeb7ce18bee681a26d57fb950af53bb2d2e7ee141d71af35078e823b6d90b16ba41ca0fa70a1896b1bede03f7550a9c5b7005b87cc38f4c99d05fa
TLSH
T13B41BE2023E81769E3B507797AA24713867AFC22AEE4AF6B80D4424C4854100E5BCF7F
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe58b810.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58b810.TMP
Size 1KB
SHA256 1f86f7ce4c55d34eb3b99c20146cb5968b677cd4d767e37a7ea99a67a78ef0ec
MD5 9245806925b7e86b4ed4882e6bf64614
SHA1 a171007fc999ab268370102f3ef51f8dc81cb837
SHA512 078c0db2c5d4193d41d8c6160f2d5f87062f83f4e0b0f458dc685735bbcf8ee5ad19f3f79246b51bf6d72aff2a0e3dba7f1f47c8c33d97953e6268ce0a19c0e7
TLSH
T1B2419D2027B81B69E3B607797A9247128A7BFC229EE4AF6B80D4424D4450500E5BCF7F
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 34618950e0fea4f22974fbe9871df7fe932ce9f96ba9f9f5932f10c6af8bbaa7
MD5 3dd196143c249f9ac5368c44be4cd028
SHA1 38c424e83c3632397c44bc8e33fdaa90b7cf2969
SHA512 9340293c4770b50df206891b194ebca469ebe99c61d8abd5feafe8583a38036d626ca4eb767b34a473040cbcf5ab2e1befa686f3cff7ba5aa88399b180a3f220
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 60bd4631e15de5f775a3181cc1007a596ed6d9c452a1979e339795c4dc1eb9ec
MD5 6a00d4e32202b627aa8184a8bbf30c0c
SHA1 7d24e29e5f2b85b924ef94e2989869272adc8545
SHA512 50fc2400a211491a8432328c6274cf1f4e1da3cba8ffe2d12b3db38394f322a709d00cf45f4ce423412fe7fd7d4f347f5fa6dc4138b1d6ae9b2f70d5d2d50282
TLSH
T195E02BEAE826EC371CFD0B5964100B52DA5023566A41895B3B7D92088FF163F4645D5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 21KB
SHA256 827c2a2effb07cc4b1c55258223ce5af3e42f35643f91893b49ef2d8e16bbddb
MD5 a862dcce22578fc885f0d8350012e9ad
SHA1 c4c70bf38b6b83ec579d61b5e36d739928b7d80c
SHA512 8639a7c6ba1a99f394a2d7f9f7f5144affac8047a34d8653a1d2e257415177828ed49b36b33d062edb7cb9e6ef89bfcbcbe717a69c3120744c2db719ba451df4
SSDEEP 384:ncS/kaADMv3H5OuPEjUAFH0cythGyUCS3OEigedJYCBObMrvoFGt4lVDotOqInx4:ncAn4O3HE8AFkddci5dJtMbuowt4l1o3
TLSH
T16AA2D07D3903F1609FF9906846FB9A2F437C7D1E07A0D9925C6B98234D3F2890D629E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b
Size 20KB
SHA256 eed0567ac419cfb71b2ec9a4cb1f5771c57966d962dee1fa417732339e8526fa
MD5 43c7e69631f9b6049332e2789a88be1f
SHA1 c5d2c3822c66b44d766f0beed0c3c554e174aa0e
SHA512 823f1f59332cdd745d9fc4b4c41ccfcc6656bed3e2bf753e090ddaddd438c282442b2c69e9640bc13a61a08db3737873f927e9b09be4edd4e13b9a0663af59c6
SSDEEP 384:Go0BQuh+/Bg85jMGfCuMvo7zufc6m7qqFvBWCvKE0mO/mtF:7kCjDf5Mvo7zwctW+pWCvKE0mbtF
TLSH
T18592C04A8155445CC1E4EEB365BD26F7A671ECE9381643A8760C8B01E80CE86ADBB1D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000061
Size 51KB
SHA256 db0f61f7468b43f8b52d173b1e0fc839c2ef1eef20eeb9175b3cc7b1a3f3202a
MD5 d7892a8d918186dbad7734bd280ed44e
SHA1 ef3cabfecc833823bbdf332e859570b5ce375229
SHA512 c1032b61d8b73309d45033509b6516860a51ad13bd4f5d2c37fe3c69b6697e22609f40423fdaa4d16781cfa3afc86578c48bfa58b379065978ceb4c8219d388d
SSDEEP 1536:lLN3h0NskZczO2g4X2rNgg/gmL6Vb67L3zKkHEJBeNSg3pBX5n:lo2kZciimKs6x67jmkkJGPJ
TLSH
T1CA330252DD381E3E6E2B441DE231DA62E6691F6C47E0BF2A9B59930714003D7673FB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000062
Size 26KB
SHA256 13130fbc1dfffea35c9984210c07766a1cee42740a1a94d86f4b03352f6ab5af
MD5 990318740f813f0e573fa737c925d677
SHA1 793ea3d0e1e9eb10dc359ff78de65770d496db01
SHA512 6b640abb759a4e5671310204276b1e0f0d51a8aab80d603c8bd3ce9194ba230bf7ff27c769d3bb9390ac25acd88501403ebb3d083a48a37ebe1c21456232d482
SSDEEP 768:84+GNcmKB9XYkm/CJBgj5hmRe/42u4bBYt:/L49o6oj5J/4+Nu
TLSH
T14DC2E1AC34FE912ACF582806F290115FCE8B9DD5CDA11F0B1248EE72DE5DC11E6974A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000096
Size 3.0MB
SHA256 dc2ccfa360e5f94ac535f3fa14ba27578049b16290cbbfe5d2f11debf29efe8c
MD5 98d8d220012af9a5405381d47899a6ee
SHA1 8126bf2bb2c234a9fe47724c520e77b3720217fd
SHA512 9dec42c15294d48a97ccc9fa7d36ee87a67fd4e128142572aee8a734d8d3c623336841f439bcfb9e7e97a8b1f9b04f16f5a55e330e7ccbce1b42c98be9688ca0
SSDEEP 49152:acPGTbbCvTikqIIQS18Q7CC9BFdjtnUdFr0oS/hfm78WmZQL9J35NkOPAdXhe7co:aMG+biTVb18kJ9LhNUIockB3Hkhphoq8
TLSH
T182E5335FD8F90FA222C651F7B4CA89B45F709A89A8B6C49C5E10726E44F6B710FE1370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ba4c5ca7acca3bd178d19c26ab0b47325f0c76e8f1fab8a60b5f1f9400eb505e
MD5 06ba01b78074a80eee1c358b073371d9
SHA1 0e354b50f5e80210898621d4cb8bf0b7f6fbde1c
SHA512 c9e328331c5f730817243eaef6c6cf0fa4030709f54fd3eee5ed34ad47e342786310a21173001906d07fcded9002321d103a84807e0eb6ba173777cde5611c27
TLSH
T1EF41DBC0BCE594B3CFA68BB478CB7E1536E1036281663B8F213FE0A85453FE0342640A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 15c5bb032eb96636cc3c9656190cd71c8803a661fdb55887f8a3fe80603c609f
MD5 5a9aca6d9ccfe4e4f79b496e3f137a56
SHA1 962cdce3a41ca720d60e2799765fc8833e61324e
SHA512 5bce44a2db22b75fa2cdadc9ea665ec1eeca10802aaae7885789d89b77f7327ecd5d457f80a330b9db9493e4b2daaf1b473f9b4b015c747532c07384c9f5bbe8
TLSH
T1DF318ED0B0F9E5B7CF688E3478C73C0936765722D05A5F0F667BE0A988537E4242A54D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 5ff9c3adee20e9261fc49d023919e9b4f69a494f02b269d63431d5f8b6cadfac
MD5 3a5c77c43a0d04211348160ba22cc045
SHA1 fa65c822914c4a696abc1e50e6f628e740ceaeab
SHA512 a57030e1fe9d14e9c386dd010a18b28b9369a1b6586090cd3e6804782e50a1e2a305d71984493f48f5c585bc1b12a4a0aaccb0abef7ba90b60d43fd0553598f7
TLSH
T1BF31ACC0B0E5E4B7DF988E7478C73C0936765722C0475F0F66BBE0A894537E4241544C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2fbba31967d38a13bc2045686850507236ecef98a3e505b24f4f5260af9c94f7
MD5 b559f11a5cf74cf29355772d2a59f27b
SHA1 2587affc1c61f42e9e8d5487bf355b52aa1c5f8b
SHA512 563352c59c5726d083e414014fd8e2162934766f86f59746b3421fd42750fbc61d12d3c1840b255ff4670ae5ee2057de3d52a8c781ef0cb0a16555ee6c222ab3
SSDEEP 96:26zMbF4Czn7FQ/vF8/VUr1G1D67ucKBVS7M/+NBa:NwbSCz7UvO/Vr9cKBA7Mj
TLSH
T1469145D024D1C8F3CF918E74A9CA2D9235B60B71E607BF4F913BA7346C62BE23524189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b7265af823c6cbb6bc53b1f1b5ca0e1262fce9782afd5a711a5d49c35ace6bf0
MD5 c72750c683835c4aa92160da2c2926d7
SHA1 938e8ea666684aba7de2a5f58dad51c21a91fc13
SHA512 7f69d1fc9f3716413d3f747dc6f0422e2e10b66e05db7dfc0c4c743addba787ca06d832e4562117665671180b2559138b1546cc6fb7b226b6ba8bdefc74512dc
SSDEEP 3:MsEllllkEthXllkl2zEkljz:/M/xT02znn
TLSH
T1CF4404457FD00415CF4051344011C3501374D5101531575335714453FCC57C40D00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 24KB
SHA256 fb20d9662d64a26907a8ea041ddef98f28272d636eefa0b84fad126d892728a8
MD5 fc1cfb9f596378a25fb4ae6f37b76de6
SHA1 e64377d31fc742afd1b93ad0806ffe5e0406ea85
SHA512 7159989ae4fc85fdc4cf6756229a1bfe46acd3254e9c2a8fbe4725c6a72c26e5f535eff98b7827f5aca9f2d86281556fb7550491bbac1aa9089bf64599b8ef05
SSDEEP 48:neBmw6P1U1kmBAWfo26W42G4L0j5+AVcIWwh68j8gYiPm99fSsgf1hKmC7NMxkxH:neBCP7GL1NIj5+CjWWNIhfDuixiSH
TLSH
T1F6B2F85F5E347816DB650DBA231E193ACD3BC15C9FD69CD4383880618DB8EA2B0746EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 ad87d028644151e49608ad15f4525aeaa5fce7190d4787206f9559e1fb2239fc
MD5 8c2e75fdacd42affafe80ffe1b21afd5
SHA1 b14c11c563db66761d7014627201048a42542b14
SHA512 8b2d8f30d36ff0071921e079508d81e050de165fe1aab57dfdfcf1df3b730aeeecf687600248d3bd25627dd01363ca9a55667f34c381ce2ce01c17892da52f15
SSDEEP 192:+znO//tH+bF+UI3iWGVYWNkqp3E6ED2cow:+znS/tIkUI3ijVYWNkqp06ED2cow
TLSH
T174F3726F6F353611CEBD90B668E204A35D6EF03F875729C59CB104A4CEE2A52B05C1EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\000003.log
Size 39KB
SHA256 fed9356033d8194226c33244b98309259ea904a5acc0a8977deb96af994393c1
MD5 65ffda58c4896f8df80589f8e607ecbe
SHA1 f83e3a07bec7b3e9ec3576899c333c5591171482
SHA512 f3f6ef19bd359da158e4029f89ed1298f26f3642c4d936544d8dd4db273f59dee306295f021f0118ecaed9dae3a79795326fda26bf97574364295aae1d48403a
SSDEEP 384:kBuCxwiQPwiwmwRwhwRw4wkwjwJwn6VwtwnwhwnwhwGwNwWwEwoExwow3wFwZwFx:euChQB6jEz0GH5LV/9frzHtOMWWFKEl
TLSH
T15D032C2CAAE18532F2B7953DE9F217D778FB36663C40C95D50B1236E0826F625CE160B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\LOG
Size 355B
SHA256 ad20c1c20021a9c328aa9d7cf33bebb680791d200e07eef538867eaeebc04765
MD5 e46c8d264ac72f553ec561320b4a43f4
SHA1 f53d3aebae7153eef4ee5f5a5ae2da56525f8ce0
SHA512 9c3cdbeb35ce229e5e316d12d87ca07cc19fdd102580b835cca9eeeb18ba8f38722159a59e5dbf22edd5ee0812f55499fc8cb55d15bb6ceb7d0127c88d8d96af
TLSH
T158E0682D40C9D57F11D081A725B4FB2ECAE3251CD7CDA9424F82D46430C500C51F9221
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 d4ef677a4164e87123f2fb56e89698b3fec15d06a3ec8a2d7809fae0146e171a
MD5 484e9f701f122073497b957e7c8e1523
SHA1 40ec9ac35ec9194970b53954bb58775a79419ea1
SHA512 7cc94bc8687b6333bf3dfed973501d66117872daa29fa8db17925540b75cdc50bf14d3a152df3b6b900be7fedc47b69593806b53ad9038ce8a3093b55e774971
SSDEEP 384:D0k/PwK8eXgseL3SCJVBeZJcKEenJzebaIEadzUiWRMnWaWsnYUBm23h8T/lSETW:wPeRvzzHt8huXi
TLSH
T1DA62BEF3C2E4897D892161F9AB242D2ACF5D191902187D66CDE8EE4F93F1872E34164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 a390dd5cf82026c5c2c1ec00a0bef5c23d019b0cb09a8dc921cb5c54e61de4b3
MD5 8d39af79464d58213945153827f532aa
SHA1 02c8b099392fdc2b41538c5b53f4126011ff51c3
SHA512 82762d2be5555a9cdcb4b7f37c7f4fa3377a8a0c3eedf86d56334315bcad64ebed91f341fbb99c2461ae5df103bd28c2873def5c34e998f39dc3242d25fb8d4a
SSDEEP 384:DnbWMVfjewqucpCVRJIBesJj7tewJ0eonPaSPaI3iWRMnWaWsnYUBm23h8T/lSEQ:dG3PIzzHt8huXg
TLSH
T18A72AEF3C2E4897D892165F9A7247D2ACF1E191902183D66CDE8EE4F93E1872E34164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 25KB
SHA256 7cc9907ba5b81f134adf7834b6ae7e949523666a70b3e1d5e1d757247f576b4c
MD5 78ea37c4c821f192b2475ce6ee0f0838
SHA1 7e466c1d90d64d2bd5d16978110bce5ec2516895
SHA512 c7e1cacf2b9cb69f11322007fde969e14d8e5052b06ddc66720da56df7d33831f252057e565c033df2a8f1636264601a7b2239757b17e8ce1408ad9a9ca72b38
SSDEEP 384:D7bWMVfjewqucpCVRJIBesJj7tewJ0eonPaSrDGDGHQVYhajNl1aI3iWRwnWaWsD:pG3PZLzHt8huXs5tPmA
TLSH
T191C280F7C3E4C62D881166F9AB247D2BCE1D191942283D66CDE8EE4F93E1472E34164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 4721b595864b1e264403d50c52dcd05a4b846af7f0358ecf5c6f862279db3c54
MD5 bef20293aed46880c13ab0fc60b63b2a
SHA1 e9d509f571f94ca5126f56b74ed917c4cd4b30f7
SHA512 a4c53b5b66381714624347c18c8c05861346a60778b1f747c2efcee5ca9c00769a3008b0d6b38f71970f7271836da9151dec70e7abfbb456919c2711a1575417
TLSH
T17B518EA3C27EB56B207958AF2D467C096DBEB431019168F9DF66C12CB0A58F31B12427
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fab836f43f6634b719fb324e638827875aaf60dcea35b0da7f148dbc786557a0
MD5 5e61ad49be9638d6015fec965d747a10
SHA1 48a5ac68a15c6e9325351b25beb29602cf9bba46
SHA512 4c2b5c52c122419c71fde6d6dc63f3df05f5ef5af09947ee28bda6cf5b56bec455467406b512f81e66f2468988fc48a5474f62a31e2b5e0326096c30adcfc374
SSDEEP 192:wRXuHxui1Uccv7bpAPRp2YC9Q9Hsb+WNnUaJr72gmXIDDVyIsnAUge:wRXuRfzIfUXYqwVt236e
TLSH
T10D42E62EB900297B5CDFD26AF9257B93D7F2103161A52E84E7FC8A1C18E75CC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 93a5be36d4fd7afc1c1f6562d1607a3987a32afc3df3615cdb0611409959ee8c
MD5 4c3c6fdffbaefb976846d595c2dd4985
SHA1 ae89be48729582e13300939a6439c23cebcc1c20
SHA512 5d6fa04059fbc370cca55d58417a63303d85b7395ee9ade491092dd2c2f1ff5fc048cabcbab8263b09e11b20e04508fb996fc3552e9241e5b98e01ed375b2787
SSDEEP 192:+RXWcBzzxui1qx0Cv7bpiPRpJOD9C9Q9Hsb+WNx3v8UKZdWTXcN+NmXIDRVyIsnB:+RXWmzdfK0OfeXFqwVSOc52e
TLSH
T10262D66EB810297B5CEBD26AF9617B96D7F2103266942E84E7FC8E1C18E75CC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 557c2b0b5731d8b76657771273e599dd79346e46ceadc112f9ae74005dbe9306
MD5 60ac062d61836ee71868de932717ba86
SHA1 8472d49461d476d4f9d632e535c9aa8711073167
SHA512 c15a645f2ec04f2315fae8c69a622192436af929e02f2767aaa60a467ae3e159dcc508d11ade7a7986a3b119c5a1ebdd4b3d07b7681daa9a4068e8d58e5b7d79
SSDEEP 192:wRXuzxui1qcGv7bpAPRp2YC9Q9Hsb+WNx3vUaJZdeN+EmXIDjPyIsnAUgE:wRXudf1yfUXYqwvRe8oE
TLSH
T10352E63EB901297B9CDBD26AF9217B83E7F2103166942E84E7FC8A1C09E75CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9b8de24479266d33ac543c0e66d58c9077843733dd0ef4e56eefa924984e7f68
MD5 0ffadf40e8bf28bbfe6590afa1f8c9d8
SHA1 550d54d49c986dd513a563fb5d531596a84620ea
SHA512 1006d1e9655500723dc48b5744e563295fe30848a077546a9ed87af1ee1342a9c9345d776f6e4bbb64b39dc746aef250fe520bd4701dfec43c64ab44d0d397a3
SSDEEP 192:wRXuzxui1UcGv7bpAPRp2YC9Q9Hsb+WNnUaJr72gmXIDDVyIsnAUge:wRXudfzyfUXYqwVt236e
TLSH
T16642D52EB900297B5CDFD26AF9657B93E7F6103161A52E84E7FC8A1C18E75CC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2193290b8988ba09c41cf5fe95b6bcaccb63435a28e1af5e0b565313b711c744
MD5 99b4b6c3e762fadac3ee1bf19066b011
SHA1 5d64a5820ed9d64e7c3161df9963908fef9cec84
SHA512 bc81b9e49a7dedeb9b8a4bfe329fb3ec0afcca9fb6da5bdb0faf439293c176b06eda1cecd11e8bfc9cae8ec117ca04b1af77bc3393cc18ceb6e579f6413cb246
SSDEEP 192:+RXuzxui1qx0Cv7bpAPRp2OV1C9Q9Hsb+WNx3v8UKZdWDX2N+zmXIDbVyIsnAUge:+RXudfK0OfUXeqwVSG2jqe
TLSH
T11852D53EB810297B5CDBD26AF9617796D7F2103266952E84E7FC8A1C18E75CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 8e17751c75b75b8316662bca1bea215efce87886c7cb65724c0dec3dcfe335f6
MD5 bcb32c34f1a87241631faf53634f502b
SHA1 21fa71c01c8e6e924e6c141b7d7180a87f312114
SHA512 d5a6fa8279f870a6cf2087f43fe00846c6146e608d085b87f2d2c49d0f9c66d528a58c796e690af0c0548330b669c78981b0eabbc69f725c2d2976df68073919
SSDEEP 192:+RXpQcBzzxui1qx0Cv7bpiPRpJP6DeHC9Q9Hsb+WNxPIv8UKZdWTXcN+NmXIDRVK:+RX+mzdfK0OfeXSqwYSOc52e
TLSH
T1DF62C66BB810297B5CEBD26AF9617796D3F2203266941E84E7FC8E1C18E76DC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 a8ece72bcdb71f8aa1ffde50f669efbf273487851b3396a24ecd79f50f5e42b3
MD5 329bfd5fbc782ee5af7da6211e3e42fc
SHA1 39cecddfbc2bd33c25842d2634bb7fc8950d78c1
SHA512 0d39c1396bf45f26cc1b2dbecea1641c3caa270a321de31ed270c0f2a897395442e4f28d493759dd70034fb006571a060afc84ca2cdfea7838cc230b229092e5
SSDEEP 192:abRXpQcBzExui1q6Zv7bpiPRpJP6bRm6C9Q9Hsb+WNxQLBnvjoxZdW3k8IJCN+5+:abRX+mz8f55feXNqwzJJBCd2e
TLSH
T1B272E76BA810197B5CEBD26AF861B796D3F2203166D51E84E7FC8E1C08E76DD3213807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 1d46ec77459f79087aba93560c60914c83ce0a881a3ed61ee42400ffacbbcf78
MD5 e640545142b4eb0d7ef842c56b504c36
SHA1 265c1ef3379203d19d4bbb64b0b1c36e978da266
SHA512 5f2b7126a5e6f42734009812626c52961613b02e22e2dc90f971bd7a93c7acd817cb31d85e4b0b1c7c67f09aacb7821eded9c39c8aa4b645374ae98006c0da71
SSDEEP 192:abRXpQcBzzxui1qxZv7bpiPRpJP6De6C9Q9Hsb+WNxPzBnvjoxZdWTXGIJCN+1mj:abRX+mzdfK5feXxqwgJOHCl2e
TLSH
T13F72D76BB810297B5CEBD26AF861B796D3F2203166941E84E7FC8E1D14E76DD2213807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 dd2f60b87c921e0c108510918a4feab66d3dbd4c764762bb5eeb58b6c1cf829c
MD5 8e57cb8bfea0622664b34a683f258fe9
SHA1 7ade466af827577f464ccdeb75e934acd9dae0b2
SHA512 cb689c26a4fa66e4985e12ccda8317926a3b0861560065212cef74a011ca18aa9b68950bce8600ecda9aab4c7dc3d35fecf7385e3d9b44d84b7ed25efc483732
SSDEEP 384:tnjp87KxkXqKf/pUZNCgVLH2HfgsljH7pLuLcSjjeXODpk+ErU3hCHGfYT8+wA:tjp87KxkXqKf/pUZNCgVLH2HfgsBH7pl
TLSH
T1EE7219677C4C8E770F94D5CCD8267B4F9DB5024B65E9886883FA982903D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\58069eff-3af0-4a77-8f67-afce30067210\index-dir\the-real-index
Size 408B
SHA256 f6ecfebd8f0448cd39a70f4543017eceb4ab8acc528f2ccf0ce600aa0263543d
MD5 a145f6fd1ddd0d8b3dd30beb8156e5b9
SHA1 00e864483d79116d13d5c426241391e1e7b278e6
SHA512 cb7b0c86529deeae4f244051f3c0974978c625045fd0724cfac8118de4eb9046ea7dc29b38386a105d69e0d869906fc55bcc12583e9963cc067c181e51ca0722
TLSH
T188E02E1CD0E92300C04DEBF02A87628C2E76E812FD2CA00082A2744CFE0CB44492313C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ceb90.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\58069eff-3af0-4a77-8f67-afce30067210\index-dir\the-real-index~RFe5ceb90.TMP
Size 48B
SHA256 4b3fcfbbb58c117ac8be4d80533ae0033f89c8029b2ed32b0bb5601dbc60cc2e
MD5 6482118a1e922713a9516f3207cdc5f4
SHA1 a4b863f0beacc0e99acaec492c8040aff190ad1b
SHA512 e3500c13055904d18e07f9996311b3f442de8eb0cfd7d7f47fc30facf71f8f8e4ad966c9825c3e81c19469ca2529b6faca43aa4cf64965a56e23f757180c1cf2
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt
Size 147B
SHA256 12d5bc9a4a6fa795e1b462e00e6480e3f51ef36fafd1b9ef1fca9345f938c327
MD5 4167eab5583fa24451e5a105ff09df46
SHA1 350e897f330bf6d73d9a3a1bbeb5be467c20bfaf
SHA512 d1d1484a79020eb6a1647da87f9a19b6031591f76a85e366a500b70a4d493730d262bfe9ccac034a5a30779e16b552f15f94c50ca3a364289a39b474c0fbff90
TLSH
T197C08CE30000F2500FA0F0C201ADCB34C22300A7E8DD8884C080A0DA00C0A1A1823A03
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5cebcf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt~RFe5cebcf.TMP
Size 152B
SHA256 30dccd574f61cc7ed96ac7920dfa76ee0854e313eb144ac2f6eee980a901c95e
MD5 21dfba5f8d3441b22b7b26180dbb24de
SHA1 724775e44683282118b1cafd3fdc69e66ec0bff0
SHA512 1ba2b46d5c2913486acc790ba1da05b73d30d7a643a0f82c2acd50f36f414238afb826f7533f40a19708d62b7ef6047f20deb91dbf49f11180ae6df72200f5a7
TLSH
T1C5C08CE30010F2500FA0B0C301BDC764C2330CABE8DD8884C081B0DA00F061B9922603
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 5KB
SHA256 4555f61ad611faac8fffbfc72128e660fe71763d3b2bd8a83fef7b16dabf1199
MD5 803816e98e9a026a17fd8b0bd54f9bba
SHA1 fcf7b2e0afff52a41bea0c1f79b0a31a140c3e6c
SHA512 4cb21f441195e0d0929890064126094d7a0067dc0a1b127c5dbbf5ad239bcc51284dee575e6245d046f3a37c54fc8a4ee0dff696dfc2b3e1f5f843e55369d840
SSDEEP 96:F1mKsGMC3RwcnDh1JETZLXbXFXKXTUFXSXTTXFXKXTxxhXsXJ0XbXNXKXTYtuZXN:F13SfmDh8FL1ajWCjT1ajZ8SL9ajYm4y
TLSH
T16DC1C16FB90A185EE4690837CD78571B6B69CB0C2BFD3767B9EF8A04057096B11086E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 f90ee34d4b2462a8f5e45fbee0e43e18abe4ef4a0382612e5c9bc3bec93e2d67
MD5 3af4ea0a3741ddc738efa7ef72eeb31d
SHA1 6f4834a40cbc03774750121fb96891c88bf3030e
SHA512 1ae793f8521a7058252b1f61f35a2445ae8287803c399053cff3b9b93653e45259ea629f041d8ed37ff01ca4ef267420b7e2cdad1a5f0d142402675d9aac63c0
TLSH
T1DFE0D81C16C4C57D249641034362A32CD6E8791AD2CC6B162FCA848811C740CB2D2190
MD5 SHA1 SHA512 TLSH

Submit Download

b6c28cea6ed9dfc1_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\b6c28cea6ed9dfc1_0
Size 166KB
SHA256 04b0c4ed3d2ba795e4aff02962227934c84c2d180ee93b8647512d51bf1498e4
MD5 8baf715d550f7cf84b7db4ad47ba7a16
SHA1 e6b6cf962893610b4254429f82df84e88bcde85e
SHA512 cc572c288d1262d7705c4ce6832251e576822832ddbae61a27dd6094ec7cae79c94725b86ccad53d4efd0a49f746512d99f4a3fcab545ca25384f0efc4c48bc1
SSDEEP 3072:8LejzWM9SNxPCD1Ve0wnpdizhoKcuzCQi1KULC1rTb:8kzWwe0wKzKKjOaFxb
TLSH
T1A2F34457D1F89963AF6B4443E8857E82B32C3047E619DAE1F987BFE0101E62A70F5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6c28cea6ed9dfc1_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\b6c28cea6ed9dfc1_1
Size 219KB
SHA256 48226fec016b5865b23aaf0245dfe4aef8c1a05551cdb73453f288efeb7f3eb6
MD5 f0adad92ef522448d4da67fa1f38a8c7
SHA1 553a46bb5aaaf41ad53683fd064a7730a26c8cac
SHA512 2410e26aa48755331b9d9c8572a2f3071016f74eb14ce17f3d3fc4911345663f81742daa29c7c342301ac3c119b12a04270ab36afb77c8da13d981577d94e39d
SSDEEP 3072:DKft7RVaGfkGIZa198F7RoHYMfhrWU7ksBSUqyMmqhoEDsYX:D0eeiwGF7RYfhWUFBSjZmOws
TLSH
T11F240A8A632617BFDF7943B95103BE5113210140EAD3C0C6374A579A242EAD7B6BEE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 25455220389972ab2132dbf02422263ff6ed59fcd6e9666269f1f3e188530a80
MD5 7fb48ad0f7604b764a2507804e602864
SHA1 1db9840b51b5899a632d2daac1009e7addd2155e
SHA512 4d569587759c308fe49aa1bdd0627b7b7ce5fe500fb004b4a581244c6063a80beaab90a6d3d3936bfc6420d4fc820e114ffa5b63c563c99e34bfd71ef725c272
TLSH
T1A9C01215C402A341C04F13F01553D4B9B1386F21FA8E234D47E6B95ADC35161802617E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 1eff8645d7be95e3ef5544c7da014092ddecce0115ebdc811c08d5cf67a1549a
MD5 97dfc1ae21c4a758a2180e5f9df7f7a9
SHA1 ea9efd129621f6568a72ea27cb9f37c9e4182f5a
SHA512 3798a3b06c8a5ce146654e190dbf9bd0fe1c572b0636233d8a995c772691182bf2c9eef03f256ad0301c8b3a8e5ac33ef5dc2398efda2702a22bca12b66dbea2
TLSH
T17BC09B51C9056251C02503F416A5D45CF1186FED958B335842E4796B64355315115156
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5863d6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5863d6.TMP
Size 96B
SHA256 e8e6cdaa6e60275315d81f4fd2c0773f7dc688290a26f1e2c05e9d187573889a
MD5 bfda59dae34349c4bcc9e87f020e6b84
SHA1 1e1d749b0508602cbe080d431ad4001c304ee0f3
SHA512 80345ae493894f8645315abad5f38b6f492add8460d0188aef7acabadaeadc21c3974a95ca92ff29aaf2789b3312fecb885ddbf9f4d249cb0100b913da0b75fe
TLSH
T128B022E0C0022A02C00203F0208A80C83820CF20C303020282F00E32FC302308030220
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13428902076800487

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13428902076800487
Size 1KB
SHA256 3aa24132d947f67b13b1b7806aac8cc9da6af61cff6f0494d6c72ef623f220cf
MD5 eccde4fe478ae9f2857eef6464f99c6c
SHA1 7bb033dbd1985e19729dc604e851da7bdf78e0e9
SHA512 a94de3467da4a0099875b8429eb482b60f467825befb4cbed1c9c31bb405fa86a4514f859d73f3a3a94aa8ebbbf360dc43f2dfb9ebe41d2142ce8e40448fd9a5
TLSH
T1E1319BEFBAFA0011E27549B8956760AD7B27EB452EADC9CF80301209C832D106DD0F6E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 3b49b89e0025d9cc596ef33d5104846600a937ad509e9ef53be58b9d7a482893
MD5 ebe91cb84178bbb9cba840c12bc384fc
SHA1 c321587764246b84e9fc105eadaafd9c94200d34
SHA512 3cc4e73753dee63b1fb596386f5e7765c60776a83116c969bab8667c57b79eb235cdc39312e51ac1ce48be89fb1dce84edfb646e35eda1c12c542d3a908ca7b9
TLSH
T191B022200882083FCA0003F202E308CA33A22C30F382FC0202E000008008B033BB3300
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 3a1724be88182ab0637331a846c27c9b211a896af054ffa8081d7171e34061bd
MD5 a234c81b5a475e3a8089519b267e28a3
SHA1 a9e645522e28a0c478233d174348e9d8d94cbf07
SHA512 c10e48ecf3e5f6f733f4581f3a7a20a1a55683e19bc5b547123e8fdc4caa1bcd4c2a89aa04d485e1ed29b89e0ee669da571c1b51d2ec118798cb4e13c6be46cc
TLSH
T13DB0120EFB04B007E84D0BB3068847443310F1051000841798A4DB301DC8B98FC166D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 9ce8caf64a1b5577233ce401c4374de3170bb49da7dea581d4cb4babb91b4b64
MD5 ca04c2b1e988a1383b71a3f5a3199813
SHA1 88f44628cb848cdc456d45e4b785c457798168bd
SHA512 99f50f0a861ea8943ddd660ba0bdfb617b251752eb7808cb925cf586f28f126b0d72fb0a4ff39ba367ae8dd038f332347b76f6850cb2526487e9ed37f7f0eca7
TLSH
T152E0D83C26C9CA6E258641179362F32CC6F17905D6DD97362B8EA0C852C744CB3C2290
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 75698e739a5393a9f5c492b757ac00625aec9e0c22cfc861e589a16e2aa728b0
MD5 d6cd407dc75baeadbd968ca2f87859e9
SHA1 3be0ff0fc7cd08ad313afcbb084f0d2bf255e9ff
SHA512 b8624335edb7730177e04b40ed5909f852fed4a5c7c950079460a75f08e178566bbb60805616f1fc7c5c05a67030680998d5a1be929d32febe213d92602d9aaf
TLSH
T198E0DF7C26C8CA7D2880810383B2A33CC6F07E09D3CDA72A678E508861C200CB3E12A0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 32c2f96f13df1aeb6cf757cffe62fb9e8419760fce9fcd4b888d9be11d796079
MD5 6b254972151ca72cc5624484ffad171d
SHA1 2e131641452d359ac9d8ab1ee1d4a4bae2bc4c79
SHA512 b085e5c3cd7c55db3a7f41d6dcb8e73e53bdcbcb37b03c9a10956440fdb2f580ff55fb2fc008662c4ece6633f4c328e9c2321a4f64734d81f1cf1bec591880b5
SSDEEP 96:f7doKsKuKZKlZNmu46yjUorXwX4K+XsXBw:7ZT0nzXMgG8y
TLSH
T161032F8F662851B3C0B6C53EED8205E6FC7D690CA72B79D211E90B249DAC036A0142AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 69833aab41b7eaed462b7c69dda0b53cd0d0f9770bd727f4aa706e7ae445badb
MD5 8b206bf4d51d5427ce2b249a97526cae
SHA1 c4e5e6ed1a89ff8d7f0cda8e6be0077fd1f07969
SHA512 ff94c861a0bc522eef09aa5da7ceba0fe2f0c60f069d721bd347088633b125317420f07934257f75b5a933033bb87f17bfd89dc9a274f98700cb92536acd50d5
SSDEEP 6:0l/NeikFwDvJeP00etQxBuwu7Djiocc/XKuqHKu42nz/Cc/mLEJOgLEJLPcHV:8kikF2hnYHb6jrXXwX4UmLULIG
TLSH
T13502ABAF75054549DC39467FCF8DA8A72A2F8E8C3BDFB6C620E44E04A47E013902835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 0413808bbda9d0163cf2ecc1c251309d015f8b1884182daabc743e9ebae88b4d
MD5 e82c156bbfb5948d0718888989052733
SHA1 7d392c6ca3ff7496936e290e9f8337f98fb28722
SHA512 ed4aee8547493d867b5671723d7038b88a0feea6e826dc7028a03fc7aab4667c7ddb4a54144ae5f662757d321fc1484df24460b296fe078761cf2d570d0f72a9
TLSH
T177E0260978C8C5AEB495890742B2732CD7C53D02EADC97062F87C0CC50C2004B7C2660
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 eee9555b28a59329eb1a3378a82705759861641e252006fb8e37fd923f28dde8
MD5 01a9a51d2129936dc30c3282cd7475e1
SHA1 c913ce92db17703f20ebb2e386f200390c25268c
SHA512 73b7b19c773219e707ddc6201a1fadbb7ab7ada32bb7610d168ed22e05c44531b7091f9243d5424be4c36c243c14f08c88d08f8efdeeae876f402a62bbe3728d
TLSH
T15E21F116F330C144C28A867A603E2B251338C457DFF8ED0F14B620B52EB6E440D473EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 3170f505bc43bd84d51c5746ddbc4cdeb7de865fb4a08653e6dadb90dcc71564
MD5 145637b90b66fe1e6e0404e96be8b7e0
SHA1 1d969f427dbc3cce56afa923307a8f02daeff12d
SHA512 220bd85d40a086a373a0630427b28d9346f4f279deb0b3bff3206a3dd91c61fc8d0a4b944df95718ddffc273c125163e689331d77a270f36e8a7a9f4b7e20341
TLSH
T187E026097888C5AFB091891342B2B36CD7D53C42EADCAF022FC7C8CC51C2045B7C7660
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 14ef42e94ffaa6a8f9645eeae790e8eba924c46773b713ca942dd0e76f8f0ad3
MD5 def62ccc916885536dcbc6776114bd92
SHA1 ff04bb818e910f7ca30caf8c94646465c56ddae8
SHA512 c66be807229ab9cdc2089034b50be2bbc224ba62bb0352ab1135ab0e9d3f2cca89482644cd2aa74627cb0b28ccf60b1a7efbc1aed74d72d7338e9fcc33b9d606
SSDEEP 6144:Yik4RlER6EtbaSgZoh0KepeBf2LDqfRRVZFX8KZGES4P:YiHERLa3KYe+qpBFX8KZPP
TLSH
T1333423F0F43EE90FB626620DD3CF7B0FED28F1A3E56E64C96938550AA0166C5072195A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 36bfb3ea26a6072685f075d4bfead05ae15c7f44fcd4041ed57743ceb197403c
MD5 1fd529d5b9df2fb7c3230d114117ce4d
SHA1 abeef0387524a997ad1a4288c4c2e42d9705317a
SHA512 4793c9842913bcb8b67778cb1ba9532c5fc75048b1fb576b6323010f5084f212887f6028d75b43a0d7ef10cb0bf484901c76238d9ddc0ef5f028a5192f877afd
SSDEEP 3072:wqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:wqfRRVZFX8KZGES4F
TLSH
T1FDB312F1A91AC96FF356630DC3CE2F0FF66EB141D1265A80789D452E98477812323B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2258230ee5c7134ae92a4f4ae1f5ce41010905298f66ff03778358dd0aae9e03
MD5 60fda49410fb73af4ce5707edb952796
SHA1 aad16b63eccaeff01396b90550f4e458b484178c
SHA512 6626de034d1e80d4e43901a807022857e794cb14f43eeb28d38df3cb9a3ce0a2277cda2941d5ae94bb1ca815b4bd3eef51d90386d3dd5c0083d2c3bef2aba45a
SSDEEP 3072:9qfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:9qfRRVZFX8KZGES4F
TLSH
T174C312F1A81AD96FF792630DC38F2F0FF5AEB181D126598078DD052E94477842363B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8cf39e55704df467f2d55122c0ab27fe2bed44d9d655eed2c4f3cb56c302d7e9
MD5 fe7d69ed99cd425e3e9ab0b64e72dcd8
SHA1 ce218209ab80340978996cb8de8b40ceebc2677b
SHA512 7e2c50a19f8b7949eac10468dbac470ebeb096fca27790bae7227a3a75456124db82c341ed8efb8ec66f4e74c0342b497b29520473f432c9b9b528c5ef9fca3d
SSDEEP 3072:bqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:bqfRRVZFX8KZGES4F
TLSH
T1FBC312F1A81AD92FF792630DC38F2F0FF5AEB181D226598078DD052E94477842363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d325b0fee375518dccf92f61a59e843982bcbe0b71c76daa1d3a755ba1f91ad7
MD5 c49b5356b2ad685fc8f34b06892abe55
SHA1 92cff00297b3f7fb7d24a1c193685194b5d6ae92
SHA512 5e66e1cd874097881a8f1d0d46d4ddf5e4e6adca4c273c3689e29cb1915af633398a0b33d82078ab84645dca07086d39ac6f242d3176cad8bc97225163a052c2
SSDEEP 3072:9qfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:9qfRRVZFX8KZGES4F
TLSH
T19CC312F1A81AD92FF792630DC38F2F0FF5AEB181D226598078DD052E94477842363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 9e033e30af16a04ff4262ded91cb2a58bd4cc2826bc39ce6a79a6f28a4f381fa
MD5 e1d5cc291f7a20078334e2c9279938ce
SHA1 e9e28daf0f2eb6410249c030788a12ccf1f49fe2
SHA512 12fa8d6b96db2f0fae90621fb8672c6c96af9dd1d4bfde19e97dcf742f92fdb2edf5324c39fee75d73635e2df86522a0b8e8ba6ef242fa70e7955b1f66fa8428
SSDEEP 6144:uik4RlER6EtbaSgZoh0KepeBf2LDqfRRVZFX8KZGES4P:uiHERLa3KYe+qpBFX8KZPP
TLSH
T1A83423F4E43EE90EB75A620DD28F7B0FF12CF1A1E66E64C56578510BE056BC10221A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9aeb782ef524cc999036e28388ab12d675396425fb4bf3f0a84c448ea2cddd70
MD5 0fd5c65ded2e9ad32feb4a2711752f15
SHA1 14dc7f4557f298ffc7c7dc8955157c7ad68a844d
SHA512 c2f5486003720ce7107cf66d54f764039038c42d4e09d361645fb6e97b4564fe2ac8e37ef9e8a788edfcb44851853db59430a659b2fda791069d7bdc19f589f8
SSDEEP 6144:zik4RlER6EtbaSgZoh0KepeBf2LDqfRRVZFX8KZGES4P:ziHERLa3KYe+qpBFX8KZPP
TLSH
T1A93423F0F43EE90FB726620DD3CF7B0FED28F1A3E56E64C96938550AA0166C5072195A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 009f1a990a912ff03f26decf8b8861764fee378d29fda804ec33ac58a81ae405
MD5 77642fd46d0ca83df8688a1983b0b45f
SHA1 0fa0d36ff29eab20fb85437236b19b6c64aa9fcb
SHA512 a6488a7b0ae57ccd40c3654ca43b851f9c6ef9b8d9ce2ae63798b2fa4fdd0ddc22dab262cd41f57ff8360717f62f1c3211e654adaae6cb5cf3ef4bdfe046ece8
SSDEEP 3072:qqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:qqfRRVZFX8KZGES4F
TLSH
T188C312F1A81AD96FF792630DC38F2F0FF5AEB181D126598078DD052E94477842363B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 eb8adc7cc909485ba9d31fea641ad088f3aa81a370f183ab4f4ff9afa26ed561
MD5 7cc03cc4436ec594a34108edf6550a76
SHA1 ec5a2a4701d04b129678049f803e51db67e6a08b
SHA512 adef7f3841100a2f089af3a5fb4fd907137b1f881dd9692456b092484aee3b92739ea2821b24cd107be5a6803dff2f4d79fe2621e24140d1b0ea49e595c9f290
SSDEEP 6144:Cik4RlER6EtbaSgZoh0KepeBf2LDqfRRVZFX8KZGES4P:CiHERLa3KYe+qpBFX8KZPP
TLSH
T1DA3423F0F43EE90FB726620DD3CF7B0FED28F1A3E56E64C96938550AA0166C5072195A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 cff3fe866f16075c4f8015718056a095be35b32fed961c34883c102053896990
MD5 80fbb762a0a2e3226a5d8d53f8084472
SHA1 805d6bc82bb2b012ae56bb6b52e3d1d1f5ac949d
SHA512 d9d38b5734801ab33ea6ba07a7971d512f1c952f293b87c2d7b3b8bd1a59335621314f5204c6243164f61910afb9badc9f782fbbe8669b1c069c62c9c5412a60
SSDEEP 3:MsEllllkEthXllkl2zEklPMnNX:/M/xT02znsNX
TLSH
T14F4404C57FC00405C54010704011C3501370DD1035115747347115135CCD5500C0C000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 40395d9ca4b65d48deac792844a77d4f8051f1cef30df561dacfeeed3c3bae13
MD5 8549c255650427d618ef18b14dfd2b56
SHA1 8272585186777b344db3960df62b00f570d247f6
SHA512 e5bb8a0ad338372635c3629e306604e3dc5a5c26fb5547a3dd7e404e5261630612c07326e7ebf5b47abafade8e555965a1a59a1eecfc496dcdd5003048898a8c
TLSH
T1DEA0120384738406E4184092C45C1341287C80570119C0012074931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 394d921080939f719738619c862e99896b89e9017583877e6bb23ee2b4016e6f
MD5 2dd346418f4f707ca16ee64780a2dfc4
SHA1 eda5a1dd72d679b7a37da237d5569a82f66cef86
SHA512 d89d81f51846c525104810042f04c2aae57828578edb93c0e2439a164879ec450d5aa33ca99c25aae5fcfb730dcf8297bdaa2d101800c3915bfcb334b8c81b32
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0Jy:TkkhCU2QB2zbBxxZKJ+SWNM694EW
TLSH
T1E123F04E261521E9D196193FFED24C923C7E4F588B2F69C245E008768CE10AE612E0FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI68C7.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI68C7.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Procmon64.exe

Path C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
Size 2.1MB
SHA256 a7ab46fbe97fbc03ab66ceb786ec8c38c6588ccf21bf390f314857d1fd91d608
MD5 a6e0de916e79d21bbf779471c77e09d7
SHA1 042e59cc2ac4b25741b46a4322ac3e42f8bbee36
SHA512 cb36a4695faffe33589145adafbe032571a78c944a90d79eb61cf4fb6f64ce4c0a291def16603c130d9d9a98d3fce9d5e446b890bf45c0bf50d1d43da9adbe78
SSDEEP 24576:c3kKl+lPtMpJ9Ug6hiBhFHe/hegiQEvRq4mRNpUp2K2K3:c34lPtMpJ9Ug6hiBwi84mRop2KZ
TLSH
T16EA54A1363E84098E06A9234CAB7C53AE6737C55177196DB16E08D5F3F33BE60A39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 622f0852a3703ea46cef1484ca9624a8deb12364f445f1b741e383bad4b3bfdf
MD5 08002142b16fa2e59f5b6feddecc1fd3
SHA1 3506cb461912ebb30859f7b18513afc695239d58
SHA512 0a7dde41b71fda9f5d6af328343f9839387d699ea8145ded2b4f2520609fb0e6e302b6ea7dfb832d46d0722308e6dcf57d1ebb1f5b410d50b8d900d71bd1e3ff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0517233a1e2172fb93a3e712ec8e4b4f7d437f2ba237f1be9d5279f06623de51
MD5 e57fce26571c522c3af94eb306707608
SHA1 b27d4ddbb4095262c7dd7db24b0413014dc91b65
SHA512 df8e9c67f94bb0df7c64780e548446100b9525c7712c57864f8e8d05748aa4666a17dd24f0b721e4458322c4c7e96f3907453d6077c9a94b09926edeb92fc117
TLSH
T112D012163B0106B4C0102073106266081900C21B414A800098389D1D2A080640D02861
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 79b76c88d42cd9d44f19b08bc6a70fbc1e4933298344faf20f5097d4d6806d20
MD5 4a8eac9ec0678d5a26a0204ecc9faf80
SHA1 33c1f1a0a1e8d2bc4778ed5fe0af2f1196bc595a
SHA512 c1b3725a7feacce97f11aa8e20e7d86c7c732ddcabb8ded4325b29a50736dc84b13045ed871d2a02acccc2b89409dc6fdf53c7aac9089448dd1eda7fadb6f635
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 1cddfbcfb6fc97639634d327244e2222ad741967bc93572128f8010740b640ce
MD5 e0e58ac33e4b33b354074c1b8c2571af
SHA1 fcaca2c2669d2fa0327d4821fbc6a9aac82376c7
SHA512 125b3ca9702c9ca2a545fb049fe35301d2a1be702e22a22795146be2adf4cd9dac0e48ec3582e4ececf5359db0ba2a569dcc2acf508aff6cec4950700f4873b8
TLSH
T18CC012DAC1468AE5FF72DAB7E6E3090C31F15FA5C0CB1E65E2AC24A4AC21364B043114
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 03abeff5f7ed65e70e643cd7940b57734f59901765d38e9def4ecfc8c66238fb
MD5 16c023868d06e3d73823ba9a0744bda1
SHA1 083a2c8d0a4ec115a731b0a404b2896a2d615420
SHA512 2fb25891164aea17e6823533e8ee84fc455da20bd9b5a42f493fa00294dab55d984fcb11fbdde405b17a1058c740f690f10f67ae19bae2958bed2647a1125e57
TLSH
T1245178B7C6E486ADC95162F96B203D1BCF5E091C46B87D6A8CE5EFCB53D1471D20024E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f003.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe59f003.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 7KB
SHA256 83d6ed8e7a696e34394dc483f108bb54585d3e5baf546187e01862cc2b1b663b
MD5 f731da21aae7a5f69ab65d89efd9c2ac
SHA1 91527c83357f3f19e63f87719ffc7c4a35f602bd
SHA512 41589f5fcc36d434a21835a11b6952e519131f582756ce776f17f1953ad47bb5db1aa9db78fe0f59910caccac8fe381fc35ffd3ca76b0db98bee24d82289f39e
SSDEEP 192:stRZ00W9fzZ8paXg/S+Wi73UwYNOiCSYMC:st40W9CF/VgweC
TLSH
T178E1A503AE745D7B4CC7F65E7A35BB62E2F6106266D50E94ABFC860C04E76CC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bde8ea18-1dbc-44d1-80bc-61f4a401094a.tmp

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\bde8ea18-1dbc-44d1-80bc-61f4a401094a.tmp
Size 6KB
SHA256 becd17accb770ac356847a16b3c3a867deacb316d8cd079a334fec854578d310
MD5 5350000d43483f6a56b54f8cf3269345
SHA1 f5f1e5df40dbc05d119a872c4f7734963d4ebe4a
SHA512 19f79a40346bca7098bf12765df8d0d295b228d96f99acb21b6aa0aa860fe3050bd0a9bce58b6716b98fa7a3469f36ba8446efa6cd80b9ecadf1ee1b3d5c2fd4
SSDEEP 192:stRZ00WLfzZ8paXg/S+Wi73UwYNOiC4YM8:st40WLCF/Vgwg8
TLSH
T181E1A603AE74597B4CC7E65EBA35BB66D2F6106266D40E94EBFC860C04D76DC6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 1KB
SHA256 b7378e16c0cf2a4693d87be2bbb5b400ac8f2ea59500e00fadabf3f73dd75a99
MD5 9dd37469a36803847cf22751f521a47e
SHA1 4f3ec0e0b8b109d5fcad5daef046ca727524a590
SHA512 3cc77a2b332260ad5be17b98080ccc1833cc1293eca11f29b95bdd6c786c6fc91611b7737c05095cc43adb028ce8a52821630d80b8d27cec3b24539ff719a9f5
TLSH
T1683185B3E0E41F795DC36583B5036B976E711069C2619F44E3ED971901E778C962AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 bcdde0e784cc108ee3d1b91498d4b28c927da9a9caa72c72de2b2cebc3931388
MD5 ee9ec7074de504e0198bde6b69c8fe94
SHA1 f1ed3fa4046c60feddfd26554a095f0bfc44a3da
SHA512 566f3987537b2d17d6bd1937a685c9db8847faccaf1372e636de6f70a0c2078179defbba64620931266e957af48db9d64414ca457cbcc63c3d58953951d1d677
TLSH
T14651D773B8689E7A8AE35585B8063B63EA75516193A22F5097EC1B0D00DB75C2302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 c8964f0ddf917c15a0e886f4ca55f2314ebc278f2a6e881137694922d93558ed
MD5 e52e3740e5b08b386c71ee13ab465237
SHA1 bfb0b313f1badfa97062e6d3fe4c471c8895f43c
SHA512 55e19ac113da1957143603bc05c2836cb2a9d57744036cbfa3bbb00a5e1c908465f4dfc34a30b1a4ef0a9d91ddb7e5743b38ddd41d7bd7d979d36ff0e455668f
TLSH
T1FD71C563A4B8A93B4EE3A945B8862B17B7A55137D2D13F95DAEC1F0D01DB7881302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 37d47273037ba6390a3a9fc92e2f74d5070825e0e37b54e4bb3ea8b49f1e3821
MD5 ac16201cccc56c82da29fa9c095002cd
SHA1 2bec99f5f598fba2160069751faaa46c7c28c2e6
SHA512 c0d7eea38a79bdc79af290183d83bb6b1f990c7f78eebbee0abf712418d358e8ab9a6522e82d4fcd90494ae9d65350c7efd5a0dd40f2b9e1c64be83285b23c1b
SSDEEP 384:z+srv+89zHqlDNP9oidPNbdhoHqjA82N+:Vrv+4UNbd9YqjA82N+
TLSH
T12772AF33A07CA737ADF3E485B44A6B07BB74609691C20BA4DADD1B8E419F5D92307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 ebe6c9703830f17f3ed9ee7e7705ad54981559afb52b08bd74c0acaf97ae3472
MD5 217dcbf26afed7ef01fd39b855071b6a
SHA1 38dbbf55f736857af12a695e1d906b947574478f
SHA512 2870c01f776802dde2140b00f3e77df88ee6abb15ffb50ef8eaec0e2fe09203a2eb04e4143e68828c6ecae4eaa48f9e0cbda669a126e1065ffa1a6051f101a38
SSDEEP 384:zKsrv+89zHqlDNP9oidPNbdhoHqjA82N+:xrv+4UNbd9YqjA82N+
TLSH
T18872AF33A47CA737ADF3E445B44A6B07BB74609691C20BA4DADD1B4D429F5C92307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58db19.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe58db19.TMP
Size 1KB
SHA256 8a5364ae350e9697aeedb0c40ad084386202c1d9cff55e555b836aed3fb8af57
MD5 af910e4708348e22637f60b46e042533
SHA1 8f0c43c052c4da401749956bcfc82e657cdb18e3
SHA512 3b1693b2a386b7260067f06d3efe0a0deb42c657cff9225a75c01d70fc3dd33b2e5f52caee496579b7702b9523c54866d4bb8fa2cb7d1438e80863f168fd5923
TLSH
T10C2165B3D0E95E7969C25442F50267876E6051658360AF05D3ED931901EB69C8637C33
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 559986.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 559986.crdownload
Size 6.0MB
SHA256 ea003af9543a0300e61e0e4df3ed6347fc4eb89fa79a110467581be59f9780c5
MD5 5d1dcad60da204b74e2edc56605a2004
SHA1 91262fdbc9e31d12c7df97c65f20a273ac27e371
SHA512 4e4b9b20a0d53c26dd4396c3811466b152fe20f95d27f278e5d1dc2078de349086afd6973c94b42b05b42b62ce004c82d794b278d7efe131e9e625dc57faebb4
SSDEEP 196608:U05+XgdXVfoLhOumykPBnjfdhYm37t+oS/N:f5IgRZolOAkPBnx6mLt+tN
TLSH
T12056331F7EA08A32D0620DB2483E5BA1D938BC300A56A5A727E9775DDDF25D00FB0DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5904_2095179077\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 20e11ce036af782df8b8db0701ea8157fa8b61a9571ed1d8a9e5c2271ebbf7b9
MD5 0dd9bc57ffc262d2b6d88e81f42f2881
SHA1 04f3e2ff55c065883bb6797a006dce1367efe7be
SHA512 b5f7f4a0d1e1f53fbe01393fb0b9f3bf025d7cc90bd88c6a93368de2c40b912d8df191771a663fc8cab70f13b7509500370057166e2237d128d27344d167c8c3
SSDEEP 24576:nEpmg3MQdoO/vvTLz64Oip22gMbx1A3uUYINOjUK8taDEWWIIt7GtkBDzZ:QY
TLSH
T1E847F52436F92211E7F39E3CA8F0AA134D397D579C1ADE8D45851B4E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ad09138e-f095-40e8-9064-cb2bbda8f61a}_OnDiskSnapshotProp

Path \??\Volume{574c9264-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ad09138e-f095-40e8-9064-cb2bbda8f61a}_OnDiskSnapshotProp
Size 6KB
SHA256 0c2aeae3b26e52d6d2ff7da63cf59f3d172c82c686faadbc9096e8d2d8fa1a6b
MD5 ae43c8dcc61ec6a6106aa64243966c29
SHA1 2c88f0166b64b0823e023b0fc2b3efa41ea2b2a2
SHA512 14fea6c24edb4384d0d50d52a8dbd580e3e08871a3018eff51402a363936402b151ca6c216e5bd43ab5a3336e84b2bb93bc0344f5ad5eb8993cce76da6423d31
SSDEEP 96:FYGQeAdLj0vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:FQEb++ZVmN
TLSH
T12AD19A185AF54311E2B3AB7228F14557A877B911FF33CB8E0198238E6671910F875F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-545-0x00007FFA9FA90000-0x00007FFA9FA91000-memory.dmp

Download

memory/1860-1517-0x0000026743D80000-0x0000026743DAF000-memory.dmp

Download

memory/2732-541-0x00007FFAA0DF0000-0x00007FFAA0DF1000-memory.dmp

Download

memory/2732-542-0x00007FFAA05B0000-0x00007FFAA05B1000-memory.dmp

Download

memory/2732-793-0x0000023F5B620000-0x0000023F5B64F000-memory.dmp

Download

memory/4072-1349-0x0000020323FB0000-0x0000020323FDF000-memory.dmp

Download

memory/4152-1207-0x0000029094F70000-0x0000029094F9F000-memory.dmp

Download

memory/4328-1110-0x00000258E8310000-0x00000258E833F000-memory.dmp

Download

memory/4408-1219-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/4408-1212-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/4408-1211-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/4408-1210-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/4408-1222-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/4408-1221-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/4408-1220-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/4408-1216-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/4408-1218-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/4408-1217-0x0000026E48B30000-0x0000026E48B31000-memory.dmp

Download

memory/5620-1884-0x0000023082D30000-0x0000023082D5F000-memory.dmp

Download

memory/5976-1287-0x000001D1279B0000-0x000001D1279DF000-memory.dmp

Download

memory/6072-534-0x00007FFA9FA90000-0x00007FFA9FA91000-memory.dmp

Download