Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 21:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjsploit_8.18.4_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
jjsploit_8.18.4_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target jjsploit_8.18.4_x64_en-US.msi
- Size 6.0MB
- Sample260808-1kp2lafe64
- SHA256 ea003af9543a0300e61e0e4df3ed6347fc4eb89fa79a110467581be59f9780c5
- MD5 5d1dcad60da204b74e2edc56605a2004
- SHA1 91262fdbc9e31d12c7df97c65f20a273ac27e371
- SHA512 4e4b9b20a0d53c26dd4396c3811466b152fe20f95d27f278e5d1dc2078de349086afd6973c94b42b05b42b62ce004c82d794b278d7efe131e9e625dc57faebb4
- SSDEEP 196608:U05+XgdXVfoLhOumykPBnjfdhYm37t+oS/N:f5IgRZolOAkPBnx6mLt+tN
- TLSH T12056331F7EA08A32D0620DB2483E5BA1D938BC300A56A5A727E9775DDDF25D00FB0DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1896 jjsploit.exe - Loads dropped DLL 1 IoCs
pid Process 5748 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jjsploit.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\god.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua msiexec.exe File created C:\Program Files\jjsploit\jjsploit.exe msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\fly.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua msiexec.exe File created C:\Program Files\jjsploit\Uninstall jjsploit.lnk msiexec.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFCA98EDC8145F8198.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5532_1910817461\kp_pinslist.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5532_1910817461\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e59dc8d.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5532_1910817461\manifest.json msedgewebview2.exe File created C:\Windows\Installer\e59dc8b.msi msiexec.exe File created C:\Windows\SystemTemp\~DFDE918E3F8D4B34A3.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF90A88398C36FDAE1.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE0D1.tmp msiexec.exe File created C:\Windows\Installer\{B290DD00-4C97-4138-8CA0-74345D0C126C}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{B290DD00-4C97-4138-8CA0-74345D0C126C}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DF34CA4D61FEB82973.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5532_1910817461\crs.pb msedgewebview2.exe File opened for modification C:\Windows\Installer\e59dc8b.msi msiexec.exe File created C:\Windows\Installer\SourceHash{B290DD00-4C97-4138-8CA0-74345D0C126C} msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5532_1910817461\ct_config.pb msedgewebview2.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 792 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b2aeec40121f1360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015b2aeec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015b2aeec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35b2aeec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65b2aeec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\Environment = "MainProgram" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\PackageCode = "992BDA45A1C9683438737609D5EB41B9" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Version = "135397380" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\ProductIcon = "C:\\Windows\\Installer\\{B290DD00-4C97-4138-8CA0-74345D0C126C}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6\External msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\ProductName = "jjsploit" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\PackageName = "jjsploit_8.18.4_x64_en-US.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00DD092B79C48314C80A4743D5C021C6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\00DD092B79C48314C80A4743D5C021C6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00DD092B79C48314C80A4743D5C021C6\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2608 msiexec.exe 2608 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 5532 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 792 msiexec.exe Token: SeIncreaseQuotaPrivilege 792 msiexec.exe Token: SeSecurityPrivilege 2608 msiexec.exe Token: SeCreateTokenPrivilege 792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 792 msiexec.exe Token: SeLockMemoryPrivilege 792 msiexec.exe Token: SeIncreaseQuotaPrivilege 792 msiexec.exe Token: SeMachineAccountPrivilege 792 msiexec.exe Token: SeTcbPrivilege 792 msiexec.exe Token: SeSecurityPrivilege 792 msiexec.exe Token: SeTakeOwnershipPrivilege 792 msiexec.exe Token: SeLoadDriverPrivilege 792 msiexec.exe Token: SeSystemProfilePrivilege 792 msiexec.exe Token: SeSystemtimePrivilege 792 msiexec.exe Token: SeProfSingleProcessPrivilege 792 msiexec.exe Token: SeIncBasePriorityPrivilege 792 msiexec.exe Token: SeCreatePagefilePrivilege 792 msiexec.exe Token: SeCreatePermanentPrivilege 792 msiexec.exe Token: SeBackupPrivilege 792 msiexec.exe Token: SeRestorePrivilege 792 msiexec.exe Token: SeShutdownPrivilege 792 msiexec.exe Token: SeDebugPrivilege 792 msiexec.exe Token: SeAuditPrivilege 792 msiexec.exe Token: SeSystemEnvironmentPrivilege 792 msiexec.exe Token: SeChangeNotifyPrivilege 792 msiexec.exe Token: SeRemoteShutdownPrivilege 792 msiexec.exe Token: SeUndockPrivilege 792 msiexec.exe Token: SeSyncAgentPrivilege 792 msiexec.exe Token: SeEnableDelegationPrivilege 792 msiexec.exe Token: SeManageVolumePrivilege 792 msiexec.exe Token: SeImpersonatePrivilege 792 msiexec.exe Token: SeCreateGlobalPrivilege 792 msiexec.exe Token: SeCreateTokenPrivilege 792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 792 msiexec.exe Token: SeLockMemoryPrivilege 792 msiexec.exe Token: SeIncreaseQuotaPrivilege 792 msiexec.exe Token: SeMachineAccountPrivilege 792 msiexec.exe Token: SeTcbPrivilege 792 msiexec.exe Token: SeSecurityPrivilege 792 msiexec.exe Token: SeTakeOwnershipPrivilege 792 msiexec.exe Token: SeLoadDriverPrivilege 792 msiexec.exe Token: SeSystemProfilePrivilege 792 msiexec.exe Token: SeSystemtimePrivilege 792 msiexec.exe Token: SeProfSingleProcessPrivilege 792 msiexec.exe Token: SeIncBasePriorityPrivilege 792 msiexec.exe Token: SeCreatePagefilePrivilege 792 msiexec.exe Token: SeCreatePermanentPrivilege 792 msiexec.exe Token: SeBackupPrivilege 792 msiexec.exe Token: SeRestorePrivilege 792 msiexec.exe Token: SeShutdownPrivilege 792 msiexec.exe Token: SeDebugPrivilege 792 msiexec.exe Token: SeAuditPrivilege 792 msiexec.exe Token: SeSystemEnvironmentPrivilege 792 msiexec.exe Token: SeChangeNotifyPrivilege 792 msiexec.exe Token: SeRemoteShutdownPrivilege 792 msiexec.exe Token: SeUndockPrivilege 792 msiexec.exe Token: SeSyncAgentPrivilege 792 msiexec.exe Token: SeEnableDelegationPrivilege 792 msiexec.exe Token: SeManageVolumePrivilege 792 msiexec.exe Token: SeImpersonatePrivilege 792 msiexec.exe Token: SeCreateGlobalPrivilege 792 msiexec.exe Token: SeCreateTokenPrivilege 792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 792 msiexec.exe Token: SeLockMemoryPrivilege 792 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 792 msiexec.exe 792 msiexec.exe 1896 jjsploit.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 792 msiexec.exe 2608 msiexec.exe 5748 MsiExec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2608 wrote to memory of 5748 2608 msiexec.exe 90 PID 2608 wrote to memory of 1484 2608 msiexec.exe 97 PID 792 wrote to memory of 1896 792 msiexec.exe 100 PID 1896 wrote to memory of 5532 1896 jjsploit.exe 101 PID 5532 wrote to memory of 3340 5532 msedgewebview2.exe 102 PID 5532 wrote to memory of 4728 5532 msedgewebview2.exe 103 PID 5532 wrote to memory of 4728 5532 msedgewebview2.exe 103 PID 5532 wrote to memory of 4728 5532 msedgewebview2.exe 103 PID 5532 wrote to memory of 4728 5532 msedgewebview2.exe 103 PID 5532 wrote to memory of 5764 5532 msedgewebview2.exe 104 PID 5532 wrote to memory of 3188 5532 msedgewebview2.exe 105 PID 5532 wrote to memory of 3188 5532 msedgewebview2.exe 105 PID 5532 wrote to memory of 3188 5532 msedgewebview2.exe 105 PID 5532 wrote to memory of 1092 5532 msedgewebview2.exe 106 PID 5532 wrote to memory of 1092 5532 msedgewebview2.exe 106 PID 5532 wrote to memory of 1092 5532 msedgewebview2.exe 106 PID 5532 wrote to memory of 1092 5532 msedgewebview2.exe 106 PID 5532 wrote to memory of 1092 5532 msedgewebview2.exe 106 PID 5532 wrote to memory of 4888 5532 msedgewebview2.exe 109 PID 5532 wrote to memory of 4888 5532 msedgewebview2.exe 109 PID 5532 wrote to memory of 4888 5532 msedgewebview2.exe 109 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.18.4_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Program Files\jjsploit\jjsploit.exe"C:\Program Files\jjsploit\jjsploit.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1896.1244.7996966775802673811 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffaa4a95fd8,0x7ffaa4a95fe4,0x7ffaa4a95ff04⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1720,i,13406901015406995278,9160401393252971437,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1912 --field-trial-handle=1720,i,13406901015406995278,9160401393252971437,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:5764
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1720,i,13406901015406995278,9160401393252971437,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3264 --field-trial-handle=1720,i,13406901015406995278,9160401393252971437,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f /prefetch:14⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1720,i,13406901015406995278,9160401393252971437,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:4888
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 47BB57BC1638C296DC9580F1E1E36F52 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5748
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1484
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2232
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59dc8c.rbs
- Size 20KB
- SHA256 c3973824e2da62504b86e69bdd397e27503256bfb0089051214ce847e40b3a27
- MD5 e2a838eb459c0ae48785efc81fae7b4b
- SHA1 67458add1a02b6ff7b10152a3642d3dc98f73af8
- SHA512 d7fd22731473b0f83e178e0213531c52d9858740d224ebee05d75c9508f30b891ad819626bc331e34daa4f4cd17fa5df45715d7a7bec1d3ff460ee6dd0d6c1ef
- SSDEEP 384:BR0JjF1wp6TrUgIkTBNrTgTTAWnMst8t8t8t0tstststststststitztzt0rTgr8:BR0JjF1wp6TrUgIkFNrTgTTAWnMst8tF
- TLSH T1FCA221865F20C2E2D6A70674DB97A7047F71C99E9388920756CC9339D9873C02FA9E8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\jjsploit\jjsploit.exe
- Size 17.6MB
- SHA256 bb8da5fea36720a6a3b33543742f6c04a9bbbb394e97e8cd7af0cb24873a0f7c
- MD5 0bbf1178a3b697b7922d6fd4510c9a59
- SHA1 246a310a0fb99cb4dfc737d43009c5e3006d6ac1
- SHA512 adac12f99f940fb4a891975d1296814564144c625c5d4b90f02e0c7d9efac9b62e7cef070b1f5f0f8ec339b09d425e51c4112ee557ab1e083daa7993237b8c2c
- SSDEEP 196608:eCQhPIwBJTFqtrPh1sVSrwMpACozWhvmRY++b:bQdIwHq1scMMprauvmMb
- TLSH T1D217F725BE8B996CD05EC474834B8A724A7570CF0B35B9FF448596382F6ABF41F38219
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
- Size 1KB
- SHA256 5d0239fb4d442207e7a833663f325466944675b8b6fde26c79840e3742434ab2
- MD5 9858bfef4d0e39daf3914dec575489e7
- SHA1 4e685b17150c878783580715b8978b8c548f1fc5
- SHA512 362421fa422b6a0bfd35696ac356ad96e7fbb1bcc757082fe1d134e0af8d2f8e4fa3ea63010e1bb7b64ff662640616b36a617227093ccb826a490a1075717f7a
- TLSH T1C941EE2457E8072AE376067D39B147138A7AF833E9A4AF5F80D4028D1854110E5BCF7B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe59e277.TMP
- Size 1KB
- SHA256 2b7abe85e786cef3649d5462dfab19049274b2b7e27f6994e87a1c19e9e5d791
- MD5 497402f61fac97d98b14522233d98c66
- SHA1 c5a4cacb56609fc480073fb576cf981f62cae2f9
- SHA512 951059b944cfe1a72283673e861992c73aa3103979465513aea4c33ec94ab894f84de520541c6b9f59b0dd294f1b7296e88ab524c518706c061cce0569be957e
- TLSH T1F241DF2457B8072AE3B6027D39E247138A7AF832EAE4AF5B80D4028D5454110E57CF7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI85E0.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 707aa9ebcf6b6bc94fcbe55c99483fda9297336f16cf23db8a41f3a71eb54128
- MD5 5b0eaf73b523de3ca3586780fa20ef06
- SHA1 e2726732f067d78f45231acadbe296f9a60f1c25
- SHA512 3f563040a58b89b9e773d585c36854653ba29043bacb86df4ef1aa7c07793a0b3b9d8a6a49163dc8835c58e61a51628e22ea5ce1c33ebf70fc0b3a62acb3b846
- TLSH T129D0126732024278C0102833060265080500D10F41054007942E852D1B040541A16843
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 eca6f7c9fb9079d4440e919d4eebef20844c53ab8eeaa592b63ab0b8b97c69ab
- MD5 500a640d7d3a5e9b4bacb9b60392be59
- SHA1 a4e8d03849504f1ac0fcecb024b7c3effe3b5a59
- SHA512 28bb39d80f899d223b22e4a5b5ed63a0cbb4faa0332a73f497c20a6aef35312b57f15e4dbe6825e384b1db070b134a34ec468a0f7376c0425015a3730e6387fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\72762d57-4514-479e-9533-f417630bcf0d.tmp
- Size 6KB
- SHA256 c4ed7e02a9493c84f39e7d4cceb8135110e7b7802d1c7f0f2a701e07cbd219b6
- MD5 72a094df12d1759f29b9074ec38ee076
- SHA1 7e5f5aa49eff7d44b4f696d90652e7ad17719a0d
- SHA512 56df7c0d4544a3e22e77109e27234974f610b6539db46ad8e9c62cecb491d6241c8c49a452c024fbc60711c0a442c7b188a8cffb4d66bec5f3df5f3eda7ec039
- SSDEEP 96:stH/dcZIzGb9PkNo5h16ZPKs7/x+6MhmuecpuN1enG/degK+g8c28XM1C7K:stfmSk+o+KsV+FNuNQod8DG6K
- TLSH T1ADD184026E24797B4CC7E50DBA29BB17E2F5612174D11E58E7FC862C18EA6DC6307C1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 120B
- SHA256 fc0b025eb1a339ce19ee1cb52c19f52231f3ce9c905de90bfcade74e95128e4d
- MD5 a69cb377bb72b49392716cd1e75bf20f
- SHA1 dcd2d6ea983470faddae9d23ba3b21855b15f526
- SHA512 bdd55e274b6af6afc567ea392644160fef51094e670e1073136e0f3ce320fb35c0498500f1143802dd66c858e81d582f309d0bff026d3b1ff31a12087baea863
- TLSH T1FDB01201C3280A90C3010BB331C105DB3531081A01638F8247542CB0A522BC1F141084
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 d011f3fcab7b1cb83bc6e1885af2be73384d2263f1def9732a520470cf5742d4
- MD5 ce60eaf81b1c9a59dd9ab409299a0fc4
- SHA1 ac196b9a660089209ac8494120950aafd9ea16a5
- SHA512 07f4ef10fa8c64c8dec6a92d2061e13d0116ee80d5564ba6bf889cb666558656bb98876fdead3db5028d36cbe01b4303ffd592f1a7d3a3e040ecae68f73f667d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
- Size 1KB
- SHA256 47910b115efe361f137ca876d3a53763541cd4e7bf8bb5bb010e1b3df8cfe850
- MD5 47a259d2c2a431bf20a40e863de260a8
- SHA1 8ab889fa88699c42b364b30a376c810fc4bfe884
- SHA512 e47ae90d31a21163fc3da094e47403dcd57e4ab592e39b43d58c8e6ed3f43af528cca19960f0d6af2d90ef0fec8b2687de09f9df51d8dccf9e13a48ab4b84ccb
- TLSH T1493178B6C6E486ADC95252FA26203D1BCF5D081C46B83D6EC9D5EFCB93E1071D20124E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5b0e74.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 15KB
- SHA256 2ba8992bf6de8969d4b951273fa16b4caaca061b30270a231c188cb7965f84ee
- MD5 fbe4c3b2e8ac0afec07818eac0e15afb
- SHA1 4555b144f7cb32f2e5afe9b5f85667efa914672e
- SHA512 9071c4f16a220ecbb81578fed8a64c6b9641f6476b2e46cf6ce818230b07f542b96b7afaa48bb63423797ee5545ebaf5c382141322b4adb545889a2fd8b23574
- SSDEEP 384:B+aQikB+z/xvxjg/qhEFNBSLqmdRAVdph9zs:M/UxvxjgC+zcRUhFs
- TLSH T18572AF2759783E33A5F7EA09794D1B4BDBB884B390C16E788AFD5F1D06D72980302C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 2KB
- SHA256 04e1e49b13b8aeb34a5cc1c101653e2ad2c28316681dd8c6aa7e0c72eded2f02
- MD5 44f9df549e424b934e57ce418d549278
- SHA1 2eb717d64530c871a1f5d71d8a3f7418cc272725
- SHA512 e45ee1784b07d20d1b8fecda0a8ac85a5d3f6dcacbd322edf539295d5d4bb4a79943831e7a4d79dd18d9ad60b0df632b2bedf19dd9ac87d562470ae2b8f0a6e0
- TLSH T10051B773BD106B7798E29B0CB94A3F278E3541E296922F60D6DD0B2C00E765E1306C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 3KB
- SHA256 dfe5df70e4e4006cb1f7d23eddaf1281e925c6b86c6d7eab8032fad3379e51d9
- MD5 9f790b1beeda0a1c9d9e74837f0d1d11
- SHA1 298ad2e8a638dc2ee5c3aa890620ba05dcbab7c5
- SHA512 937aebdc078f65f9fad494f3f61959e96f61237cd1ccb2e3ae8d272584f6d02d62309211e2b5574bd37a1eb033a7cb09e0453f50c5d8b47c896951a956f5f462
- TLSH T1276185376D74AA374DE2DA09B9863B16AB654163D5C13FA4D6EC0F1C01E738D1342C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe59f9d7.TMP
- Size 1KB
- SHA256 e0b41c7f40060407d64e19a4798c0ea7c76c326ea8f079d14ed4ab4029537042
- MD5 8b921ea65cdacb0d3d23c5b293d53652
- SHA1 6957a03d5ef447a4dff872221dd4ef9f9ea373e4
- SHA512 9f4256e2f050082eee784586718a49a712b7e7b284f72f93696efa4efa178d6d194f4dd22e07086dcb9b3630a35fa4f50ca4eb3e8f0251f48c15e8c41d5d2d88
- TLSH T1DA2165B3E9641B72AC86674E72463F1B1D3101AB82910F10A1DE4B3C45E214E562FC32
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e59dc8b.msi
- Size 6.0MB
- SHA256 ea003af9543a0300e61e0e4df3ed6347fc4eb89fa79a110467581be59f9780c5
- MD5 5d1dcad60da204b74e2edc56605a2004
- SHA1 91262fdbc9e31d12c7df97c65f20a273ac27e371
- SHA512 4e4b9b20a0d53c26dd4396c3811466b152fe20f95d27f278e5d1dc2078de349086afd6973c94b42b05b42b62ce004c82d794b278d7efe131e9e625dc57faebb4
- SSDEEP 196608:U05+XgdXVfoLhOumykPBnjfdhYm37t+oS/N:f5IgRZolOAkPBnx6mLt+tN
- TLSH T12056331F7EA08A32D0620DB2483E5BA1D938BC300A56A5A727E9775DDDF25D00FB0DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 449140390cd39ba9f75ea8df5ad80ed16559400bddf6acbee0e1ec86b1550778
- MD5 ec5accbf8d3806773f985d878e921454
- SHA1 47cd174a1b4b6f2a48ebfacf656d2ffeb1bd225a
- SHA512 6c4986eef5d8180b565d6053078bb49075b3ccb7f8ef5a5c0cf450fbfb6b859ffce79fba1a4b115ebc12b3061456c2f9ff00d129ebf13da4fb4586f1ca6e348d
- SSDEEP 24576:CFo3DMPbdoO/vvTL/yghRClw/LubKr2iEMHD9MvZHkP6pWQRsYx2RILAVet:oHc
- TLSH T15457D12436F92210E7B79E7CB8F06A634D3A7D5B9C15DE8D05411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{db801f84-04c7-45e1-a083-bede99863841}_OnDiskSnapshotProp
- Size 6KB
- SHA256 6172dbafec64965c885235397404a59c84c7cbe8ce1db37f691ebb619e8f4e8e
- MD5 1a0becde37a826bb53659b88cfcdf73c
- SHA1 989a6468315c2546176fe4eb6277c5a2f5d34c98
- SHA512 b3ce55df3420c29577c78e99fe748775f9d70c772941bfeb1388c94fdca42b33923e96e421d12204318f1bb4705cc7b3194ea2c200b18e756cbefbf262cb6e6e
- SSDEEP 96:Fjiheu8vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:MhOb++uVmN
- TLSH T1C3D188081AF54711E2B3AB3229F18557A877B911EF33CB8E0198238E6631910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH