836e40ceb7f9172d7da29a32ab232e11795cf2cd73a217def60cf81c21dab299

Analysis

user interaction
yes
max time kernel
900s
max time network
904s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jjsploit_8.16.15_x64_en-US.msi
Size 5.1MB
Sample260809-1q6xascf65
SHA256 836e40ceb7f9172d7da29a32ab232e11795cf2cd73a217def60cf81c21dab299
MD5 8ee74a53af1e3ead8211d9a245f33391
SHA1 f15638441acc3b5e2b0c21d05ff1579d99d2ddcf
SHA512 ef3326abc480ee73f94a39ebc79a820841129649e3355600a2ea0b9c0d3364e99522ba8fb1a7fe5e8d7195e1fbf80a80ce37f8232e61346c7ef60bcccc3b988a
SSDEEP 98304:uT9Y/t/W7KqHjJ3UM5zxCHI2FFgNKr35rWjgH8PZxuTnI3bnQC/+GiQdQm:Ow/CKqDJ3HNxkXgEKjgHIaI3bQy+
TLSH
T1BD36331BBE86D532E8575F7A083ED3918A2F7C20850684433669375DCCF26C26D74EEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2744	jjsploit.exe

Loads dropped DLL 1 IoCs

pid	Process
2436	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
96	raw.githubusercontent.com
1	raw.githubusercontent.com
87	raw.githubusercontent.com
89	raw.githubusercontent.com
91	raw.githubusercontent.com
93	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\magnetizeto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1377464671\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_32427848\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1827233162\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1827233162\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_32427848\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1827233162\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DFFF43D4369A5B10A2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1626268682\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1562544360\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-or.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1377464671\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1562544360\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1827233162\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1827233162\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1280228934\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_32427848\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF56E00CB1CE4DB74C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1562544360\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1827233162\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_481827805\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\Installer\e59cab9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1827233162\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\Installer\e59cabb.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1562544360\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1827233162\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1827233162\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\Installer\{CB05735B-3529-40FA-A622-D81A797FC7DA}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_1562544360\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-lt.hyb	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5016	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B53750BC9253AF046A228DA197F77CAD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B53750BC9253AF046A228DA197F77CAD\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\PackageCode = "8F599B479AF6A2248A4624EA756E8882"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\Version = "135266319"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\SourceList\PackageName = "jjsploit_8.16.15_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\ProductName = "jjsploit"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B53750BC9253AF046A228DA197F77CAD\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B53750BC9253AF046A228DA197F77CAD\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\ProductIcon = "C:\\Windows\\Installer\\{CB05735B-3529-40FA-A622-D81A797FC7DA}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\B53750BC9253AF046A228DA197F77CAD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B53750BC9253AF046A228DA197F77CAD\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B53750BC9253AF046A228DA197F77CAD\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3440	msiexec.exe
3440	msiexec.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe
2744	jjsploit.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5376	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5016	msiexec.exe
Token: SeSecurityPrivilege	3440	msiexec.exe
Token: SeCreateTokenPrivilege	5016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5016	msiexec.exe
Token: SeLockMemoryPrivilege	5016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5016	msiexec.exe
Token: SeMachineAccountPrivilege	5016	msiexec.exe
Token: SeTcbPrivilege	5016	msiexec.exe
Token: SeSecurityPrivilege	5016	msiexec.exe
Token: SeTakeOwnershipPrivilege	5016	msiexec.exe
Token: SeLoadDriverPrivilege	5016	msiexec.exe
Token: SeSystemProfilePrivilege	5016	msiexec.exe
Token: SeSystemtimePrivilege	5016	msiexec.exe
Token: SeProfSingleProcessPrivilege	5016	msiexec.exe
Token: SeIncBasePriorityPrivilege	5016	msiexec.exe
Token: SeCreatePagefilePrivilege	5016	msiexec.exe
Token: SeCreatePermanentPrivilege	5016	msiexec.exe
Token: SeBackupPrivilege	5016	msiexec.exe
Token: SeRestorePrivilege	5016	msiexec.exe
Token: SeShutdownPrivilege	5016	msiexec.exe
Token: SeDebugPrivilege	5016	msiexec.exe
Token: SeAuditPrivilege	5016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5016	msiexec.exe
Token: SeChangeNotifyPrivilege	5016	msiexec.exe
Token: SeRemoteShutdownPrivilege	5016	msiexec.exe
Token: SeUndockPrivilege	5016	msiexec.exe
Token: SeSyncAgentPrivilege	5016	msiexec.exe
Token: SeEnableDelegationPrivilege	5016	msiexec.exe
Token: SeManageVolumePrivilege	5016	msiexec.exe
Token: SeImpersonatePrivilege	5016	msiexec.exe
Token: SeCreateGlobalPrivilege	5016	msiexec.exe
Token: SeCreateTokenPrivilege	5016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5016	msiexec.exe
Token: SeLockMemoryPrivilege	5016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5016	msiexec.exe
Token: SeMachineAccountPrivilege	5016	msiexec.exe
Token: SeTcbPrivilege	5016	msiexec.exe
Token: SeSecurityPrivilege	5016	msiexec.exe
Token: SeTakeOwnershipPrivilege	5016	msiexec.exe
Token: SeLoadDriverPrivilege	5016	msiexec.exe
Token: SeSystemProfilePrivilege	5016	msiexec.exe
Token: SeSystemtimePrivilege	5016	msiexec.exe
Token: SeProfSingleProcessPrivilege	5016	msiexec.exe
Token: SeIncBasePriorityPrivilege	5016	msiexec.exe
Token: SeCreatePagefilePrivilege	5016	msiexec.exe
Token: SeCreatePermanentPrivilege	5016	msiexec.exe
Token: SeBackupPrivilege	5016	msiexec.exe
Token: SeRestorePrivilege	5016	msiexec.exe
Token: SeShutdownPrivilege	5016	msiexec.exe
Token: SeDebugPrivilege	5016	msiexec.exe
Token: SeAuditPrivilege	5016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5016	msiexec.exe
Token: SeChangeNotifyPrivilege	5016	msiexec.exe
Token: SeRemoteShutdownPrivilege	5016	msiexec.exe
Token: SeUndockPrivilege	5016	msiexec.exe
Token: SeSyncAgentPrivilege	5016	msiexec.exe
Token: SeEnableDelegationPrivilege	5016	msiexec.exe
Token: SeManageVolumePrivilege	5016	msiexec.exe
Token: SeImpersonatePrivilege	5016	msiexec.exe
Token: SeCreateGlobalPrivilege	5016	msiexec.exe
Token: SeCreateTokenPrivilege	5016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5016	msiexec.exe
Token: SeLockMemoryPrivilege	5016	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5016	msiexec.exe
5016	msiexec.exe
2744	jjsploit.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5016	msiexec.exe
3440	msiexec.exe
2436	MsiExec.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2436	3440	msiexec.exe	90
PID 3440 wrote to memory of 1448	3440	msiexec.exe	96
PID 5016 wrote to memory of 2744	5016	msiexec.exe	99
PID 2744 wrote to memory of 5376	2744	jjsploit.exe	100
PID 5376 wrote to memory of 4404	5376	msedgewebview2.exe	101
PID 5376 wrote to memory of 3540	5376	msedgewebview2.exe	102
PID 5376 wrote to memory of 3540	5376	msedgewebview2.exe	102
PID 5376 wrote to memory of 3540	5376	msedgewebview2.exe	102
PID 5376 wrote to memory of 3540	5376	msedgewebview2.exe	102
PID 5376 wrote to memory of 1800	5376	msedgewebview2.exe	103
PID 5376 wrote to memory of 5784	5376	msedgewebview2.exe	104
PID 5376 wrote to memory of 5784	5376	msedgewebview2.exe	104
PID 5376 wrote to memory of 5784	5376	msedgewebview2.exe	104
PID 5376 wrote to memory of 2868	5376	msedgewebview2.exe	105
PID 5376 wrote to memory of 2868	5376	msedgewebview2.exe	105
PID 5376 wrote to memory of 2868	5376	msedgewebview2.exe	105
PID 5376 wrote to memory of 2868	5376	msedgewebview2.exe	105
PID 5376 wrote to memory of 2868	5376	msedgewebview2.exe	105
PID 5376 wrote to memory of 5616	5376	msedgewebview2.exe	108
PID 5376 wrote to memory of 5616	5376	msedgewebview2.exe	108
PID 5376 wrote to memory of 5616	5376	msedgewebview2.exe	108
PID 5376 wrote to memory of 3384	5376	msedgewebview2.exe	109
PID 5376 wrote to memory of 3384	5376	msedgewebview2.exe	109
PID 5376 wrote to memory of 3384	5376	msedgewebview2.exe	109
PID 5376 wrote to memory of 3488	5376	msedgewebview2.exe	110
PID 5376 wrote to memory of 5228	5376	msedgewebview2.exe	111
PID 5376 wrote to memory of 5228	5376	msedgewebview2.exe	111
PID 5376 wrote to memory of 5228	5376	msedgewebview2.exe	111
PID 5376 wrote to memory of 4892	5376	msedgewebview2.exe	112
PID 5376 wrote to memory of 4892	5376	msedgewebview2.exe	112
PID 5376 wrote to memory of 4892	5376	msedgewebview2.exe	112
PID 5376 wrote to memory of 3504	5376	msedgewebview2.exe	113
PID 5376 wrote to memory of 3504	5376	msedgewebview2.exe	113
PID 5376 wrote to memory of 3504	5376	msedgewebview2.exe	113
PID 5376 wrote to memory of 4000	5376	msedgewebview2.exe	114
PID 5376 wrote to memory of 4000	5376	msedgewebview2.exe	114
PID 5376 wrote to memory of 4000	5376	msedgewebview2.exe	114
PID 5376 wrote to memory of 5636	5376	msedgewebview2.exe	116
PID 5376 wrote to memory of 5636	5376	msedgewebview2.exe	116
PID 5376 wrote to memory of 5636	5376	msedgewebview2.exe	116
PID 5376 wrote to memory of 1192	5376	msedgewebview2.exe	117
PID 5376 wrote to memory of 1192	5376	msedgewebview2.exe	117
PID 5376 wrote to memory of 1192	5376	msedgewebview2.exe	117
PID 5376 wrote to memory of 1456	5376	msedgewebview2.exe	118
PID 5376 wrote to memory of 1456	5376	msedgewebview2.exe	118
PID 5376 wrote to memory of 1456	5376	msedgewebview2.exe	118
PID 5376 wrote to memory of 956	5376	msedgewebview2.exe	119
PID 5376 wrote to memory of 956	5376	msedgewebview2.exe	119
PID 5376 wrote to memory of 956	5376	msedgewebview2.exe	119
PID 5376 wrote to memory of 2312	5376	msedgewebview2.exe	120
PID 5376 wrote to memory of 2312	5376	msedgewebview2.exe	120
PID 5376 wrote to memory of 2312	5376	msedgewebview2.exe	120
PID 5376 wrote to memory of 3152	5376	msedgewebview2.exe	124
PID 5376 wrote to memory of 3152	5376	msedgewebview2.exe	124
PID 5376 wrote to memory of 3152	5376	msedgewebview2.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.16.15_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files\jjsploit\jjsploit.exe
  "C:\Program Files\jjsploit\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2744.2884.11193777521405843678 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5376
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8bc895fd8,0x7ff8bc895fe4,0x7ff8bc895ff0
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2028 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2348 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3280 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f /prefetch:1
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4708 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4896 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5004 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5088 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5116 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5100 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5056 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4916 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4620 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4584 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.16.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4844 --field-trial-handle=1788,i,6628850483408777181,467852999097970863,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f
      4⤵
      PID:3152

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B043A606AFA31E51DE4A3313439C17B6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2436
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1608

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59caba.rbs

Path C:\Config.Msi\e59caba.rbs
Size 21KB
SHA256 949f6b07541a71ac0668a6345fb369236635c361590d8319bc32242346d52d16
MD5 c73fa3b5d43ae88bd549a6f5a89d991e
SHA1 8362e5833cd220cd75033290342f49ff940e3119
SHA512 62d088cb73ba98e40db44a277404557be461ee32849bd7346720db0ab0c4f8df0efaa00d804c648e09b08deea71e2bbb0c07a9ab4ece5b3e2f4b3e89c6ac5e23
SSDEEP 384:RsAl7bh3tsokoTiYy6wxVSXtzT6WzIst8t8t8t0tststststststststitztzt+8:RsAl7bh3tsokoTiYy6wxVSXtzT6WzIs4
TLSH
T166A2F1865E00C292E25B1774DAAB93083732C99EA3D8921B42CD933A9D937C43FF595D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 15.6MB
SHA256 7132ef7991e6395629e6ebd80742ff8c800303001005a554940677b8e14d12d8
MD5 1d2b064c3d4b8cdea1de675843ae6d7d
SHA1 59dc742cd5d6626c6e36cec6364bf76db8dae9de
SHA512 68846180168880ad289c77fa15b3316bc15b633933ba8b3bd74ec0b45112139f0d371d8e7a77a98163fc53084f1ad28ddae18c8117e5b52cd61558d6007bece7
SSDEEP 98304:iy1tisBEm59sHJMhtjp0uMNLHVoznkEfjqkneSdPiuZZIPezRWP8972qfSwkVkpY:iQrsHJItj+Or7gkpRGtuvZokaRp
TLSH
T1BAF6D664BE9F99ACD05EC470824B8A72093574CB0B35B9BF84C556382F6EBF41F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 7143f75daaea11b4b483d29e9feea831f76af5010a68a5b37bf3d7e0536e23dd
MD5 13b6e2819b467f559acb074fa810304b
SHA1 89cef2e45da576583cbbbd670662c3bc864082db
SHA512 a47091a751da713cf2f1bf882cc58c973be0083070b053f4ca732b89fba6ead574fdd84971fb1c4f5f3bf878684ca0bbb5335ab5e919566b21bd1837d60352df
TLSH
T1FA41381096F01335E3B69A7A2FB20321C67BFC25E9B49F6A80C6458D1864000E9FDF7E
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe59d577.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe59d577.TMP
Size 1KB
SHA256 b9277fca2f6902a6132037f2dc49af2884c445c03f0420d33977b7ab53b82a3e
MD5 115db419bb3dbd06b433c5e830d9ae21
SHA1 1b07456e2f42e6577ffbeedabe526229828d93ab
SHA512 056dcb100a404e62cd994b4c07842548f451f6c49494e3d6f8899adf651ae067e6492d8b1cb7f6f90e566bda5b8d9df959157a3cdccda0f55eca75bf30a6382a
TLSH
T18841F11095F01326E3B69A7A2EA20321C67BFC25EAB49F6680C6458D1864504E9B9F3E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6C5C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6C5C.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 df30bc2d87cde34d9ee7c4a13f0c50c052e4d2b241dc6d5794900a4ead53fe06
MD5 20cd8c88464c63fe4570ee6b22956bd9
SHA1 893582004700215a32603e041f37749e70b84983
SHA512 a574239e7d785e3719daf4ffd74d5e01c9295763874b86d5c0fc27a30f97d6fdb13d80aba25d7bd96819b90c6b38296c41192931ad4a596b5ddf662f26fe5b53
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ab690f4a1980b1e34aab50a6b81cb59de513e5fec0531b597a2f2e7f957ced9f
MD5 b997302e0d389141bf5fbef94377a02e
SHA1 3b2e996982d3e4338410693b474087a2f63959a1
SHA512 bac110928dd4bcaf3824ef08b33cf7f7386a7a43f259c80f06709abd43a6813805d5d5fd88c9b592032b07cc2ce458d3c8c3778f8bdcdf4c41c9ca2ca8d79af6
TLSH
T148D0129F76428134C41020330002760C0800D10F805991045838962E7A040941D16842
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

78dd8dd9-c68d-4696-a790-f15b9bdef87a.tmp

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\78dd8dd9-c68d-4696-a790-f15b9bdef87a.tmp
Size 6KB
SHA256 524961df9ac9c7b94dd558b2f8db8dcc7ad95e43c1eb446327cbd47f1e81d17e
MD5 3b741c0d5ca834dc5cea49362d06438e
SHA1 370d2767ac7f0088fdaa142fdf632f7373850e88
SHA512 9d69a582dcae0ab699174c2d35351932a77715ba49726cd16a735194f691fc23b04f5c42d2497a698580d191e7f5e084c3fd0b58bc7c177859222ecc42038dbe
SSDEEP 96:sth/dcoy8Eb9Ekno5h16ZPAs7/x+6Mhmuecp8Cj0nG/0G/OeAK+gy28XM1C7K:stVm3Kwo+AsV+FN8C4oJO8MG6K
TLSH
T1A9D195025E247DBB4CD6F119BA36FA17E2F9603264D51E68EBF8451C04EB6DC630390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 77c258656e865c8a5248a2911cfb242211a5e5d0ccb811237af86eeb25bbda7b
MD5 c292503e6e9e7015aad705e046ba5656
SHA1 40747fb4360c36fd28f9bab6edd4f2b82c04bb6e
SHA512 a241bdbc3e471d7693f503ced527f36409c9e732638e54df2ac4a1a21e55d7c2dbcd337eebe0bc0947c96b4ccb94fa45c15a71735678517e7541c0a41a2fc8be
TLSH
T164C09250A13404A8DA4196F160C6781935301461848B0C881F801FF4E023791692B018
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4bfe.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a4bfe.TMP
Size 48B
SHA256 c01693d2c069f40be8903014b5c7ba9897d5478396f869766cdc7aea4734052f
MD5 d0b948fdab448ff02713a22934fcf7a0
SHA1 86892008c795c2e955b0932989fedf22fb34ae1c
SHA512 56522ad303e54469a68418ab024fda9b57766d7d3c28fb42f2496a04449c484c6c872d6c03e3ba8b67245de5952612aa360394352005801f87d9862c9776b387
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 273441fb5dc107252ccca8ac96e02af7d847edb981f55cc186d26bfd17f6f295
MD5 e5970d03e9a4d752b7afadc62912b8fb
SHA1 ebce3fa2eaf2412827d6f2896c711a1d7419cfb3
SHA512 83ba841bb468d718ac3b92679c68ed78df3a5c67241bed8c9b8c3d222bec5f5347b6e45ef68d364195bfacbc263062e30927265ca9ab7ccb3c7297f411e83fbd
TLSH
T18E518AB786E48A6DC95152F91A203D2BCF5D091C46B87D69C9D5EFCB97E1070D30024E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 a2e9957745c92dd60e04064dae0c46a769331ef3146c5bf04e4bc0b4b0dc7f9d
MD5 d7060c329927028690dbd0b8432f374a
SHA1 d426d98c014a0429dd38770545d2ad9343c7a665
SHA512 b2c49e384f394b630aad758f1bf1eec1aeba57e5d7cee1aa6c2ceb1ca0749534d4486b46d2929999e59652c320387d490ef02533829c9fbe4d3aff09ff7cc8e5
TLSH
T1A6214FE382BEA47B202D0E6B0E493C15157EA435115158F5DFA6427CF0E45F72F0B43A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 cf91f74e43f361b277db20cec688a40e210291af09094563b1a864ef0a45e427
MD5 fbb625827df6469f31a54bacbf2d7868
SHA1 0d1d7b6e87a4b81efc5da8a4806a30bdbb6c152b
SHA512 06b45159b4828143cd1a2ba5d983fd87ceaaa357c7be5acaac6abfbd1e17daed3c4ab4580a7be76cf69b871c00c316038c6329f250afdc0747cb841fccca1189
TLSH
T196212CE382BEA83B202D0A6B0E497C15257EA435115158F5DFA6827DF0E49F36F1783A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5aa4dc.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity~RFe5aa4dc.TMP
Size 1024B
SHA256 9dff19e1e4e421a105cead2ef23c7de27e0cfd72af5f86d67d6c21d268245649
MD5 4d271cd0ce54f36600d08960d7f58db6
SHA1 554cbce319bb05fb5f9379216b10ecd034a00d07
SHA512 967c4d3e64069974ed97c471db5d19ea54c40a02baa57f3cd69bbdba41db023bb0f5116916dcc7ea850549f932dd3986c03782cd0bd56bf3f6699e5b24b6f6d1
TLSH
T1D1110FE342BEA43B201D0A6B0E497C15257EA43511515CF5DBA6827DF0E48F36F0B43A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences
Size 6KB
SHA256 631fef1cdb8cae3199b82a15da1caf02c0b20b32e70b2a67bbdd40294d6b7dde
MD5 63903c5be48abd6af43bff48195ef2bd
SHA1 a43a26c48499687ea5cd315f308289ba1c922afd
SHA512 e59af32f6b6cd957faae2f15d59efed4054a225c69615e20ad8f1f1637e870ba622cafcddc753622b4d61dd2845491450bd26e2991168f1cb7f820808e1258d9
SSDEEP 96:sth/dcoyTGEb9Ekno5h16ZPAs7/x+6Mhmuecp8Cj0nG/0G/OeAK+g228XM1C7K:stVm3wwo+AsV+FN8C4oJO8cG6K
TLSH
T193D175025A247D7B4CD6F119BA26BB17E2E9603265D41E68E7FC451C04EB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 15KB
SHA256 a0a687dd677365b62ee248ebdd5d55e807ea569ecbe09019a7fbf842085af31e
MD5 e1c732738d0b4732c48a11cdb075a93e
SHA1 87e966b73ac7740230e5c9ccc714380caee1c4b4
SHA512 81170a11475b31b024cdabf417c339dff3fa19d65f036bdb0085bf26b4398ff0ddbd28322d35de9b336bbaaac5aa2ca2baa1250cba9f540dcd4f599ed5c9fbd5
SSDEEP 384:6+aQikB+z/xvxjg/qhE5NBS1z+SEcsAVdp4Am9zA:F/UxvxjgC+besU4AmFA
TLSH
T15F72AE2B95393E3795F3FA05795E5B4BCBB894B390816E684ABD6F0D02C72A81302D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 d4d6f3fb5f5b1a73a5819fadfe2fecd90e4421d02aef1183651641d204030d46
MD5 67f1bc880be4603d3041c2633311982e
SHA1 26a00d6eb119e42e15137ebaf83dd21b52f215e5
SHA512 de5d7d3998fd0676363b8fb4ab66e1256aa4324b354b6b264dc11fee54064c42e478c60657d470819dcf55d89b94aa81ae7accc22d94d8196a76c72ec4af6f53
TLSH
T13C519733A9146B7B89F2D704B98BBF239BB5906296522F10D9DC1F1C41D755C1702C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 f33e947b0958e6dc619f54e2d51486ddf7d4ad36ea465036a490d6e63fc7976b
MD5 75b2fcc4974fb4352a1c129729b48e6d
SHA1 76789516f6e2f6d32f30fe1a1b43f1b48aef2ecc
SHA512 19c546c5e04044cb71f2a76f556f7fc65c71cc63a643b0dcfd129f376bee263b297575cfd6dea528cea49865dfbb09ae09b5037c01e26ef22e27e17ee3d9c9e2
TLSH
T17D618337AA64AA3B4DF2DA04B9877B16A7A59023E5853F65DAEC1F0C01D729C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59f5ef.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe59f5ef.TMP
Size 1KB
SHA256 14186d4aa9b9e80a6d048ff36d90a9853556d63b26a3556fd6b267f59e6275dc
MD5 c5eb09a8d8b707b0e91d4825296139c8
SHA1 ff0e80be72b4e4d5b15a871bd961a1807c83c6d7
SHA512 f7ce9ce96d490a28a1c3a610d3e778b1b081dbb7db181dae27aec935fde307e4b38d6ae2f0fd87d7f84fc1939e555a7aa8f221f2d0472ec3659c1d7dd8500dd8
TLSH
T1062165B3D5642B7B9DA1A7067197FA1B6FB0906782018E00A5ED4B1C42E214C9A17933
MD5 SHA1 SHA512 TLSH

Submit Download

e59cab9.msi

Path C:\Windows\Installer\e59cab9.msi
Size 5.1MB
SHA256 836e40ceb7f9172d7da29a32ab232e11795cf2cd73a217def60cf81c21dab299
MD5 8ee74a53af1e3ead8211d9a245f33391
SHA1 f15638441acc3b5e2b0c21d05ff1579d99d2ddcf
SHA512 ef3326abc480ee73f94a39ebc79a820841129649e3355600a2ea0b9c0d3364e99522ba8fb1a7fe5e8d7195e1fbf80a80ce37f8232e61346c7ef60bcccc3b988a
SSDEEP 98304:uT9Y/t/W7KqHjJ3UM5zxCHI2FFgNKr35rWjgH8PZxuTnI3bnQC/+GiQdQm:Ow/CKqDJ3HNxkXgEKjgHIaI3bQy+
TLSH
T1BD36331BBE86D532E8575F7A083ED3918A2F7C20850684433669375DCCF26C26D74EEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_2046205305\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5376_479964301\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 c1df0fecd6a3f225d41d9911d2cb3f0f4aebf4d28406315490f18d31a1e85f2b
MD5 dc645d6f2a02d7589710322aee4807dc
SHA1 2db14fe3e5c19cf1dbaf9836ee0df47542fcdc59
SHA512 5ec1b66b7c5599a791a390f5a429f584d083164ab5c094d36f3d1b5837ce8c56e28b1a3d1442ee6ae46a091700727f187c31966bf4832d17ad97ac4f8e6fc2d5
SSDEEP 24576:/Fo3DMPJdoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGu0:PHA
TLSH
T1AC57B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d831c7b9-513a-4f2a-998b-0bae6326755a}_OnDiskSnapshotProp

Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d831c7b9-513a-4f2a-998b-0bae6326755a}_OnDiskSnapshotProp
Size 6KB
SHA256 fa6b8efc706675c77a6f4011e08cfbd7bcd7fb21bfd8f1d3e0b4ee3dfced6d82
MD5 b50100c6ee3ee35e069705fd26dde530
SHA1 d89ac2b1586cd898c4d8c426a8f99ad609e79cfb
SHA512 d2467abc0f5b36e43440d04f800a6f0ba15a55c3d2ffc68f74b759b04f905c50dca3fb1e8f98cc7df124d864c3543b9b4dc1baf89762e0df1a874713690a14a9
SSDEEP 96:Fcrhel1vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:8heb++uVmN
TLSH
T1F8D178185AF54711E2B3AB3129F14557A877B911FF33CB8E0198238E6631A10F936F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2868-248-0x0000025C0B340000-0x0000025C0B3F2000-memory.dmp

Download

memory/2868-702-0x0000025C0B340000-0x0000025C0B3F2000-memory.dmp

Download

memory/2868-109-0x00007FF8DED80000-0x00007FF8DED81000-memory.dmp

Download

memory/3488-401-0x000001E71CFF0000-0x000001E71CFF1000-memory.dmp

Download

memory/3488-404-0x000001E71CFF0000-0x000001E71CFF1000-memory.dmp

Download

memory/3488-403-0x000001E71CFF0000-0x000001E71CFF1000-memory.dmp

Download

memory/3488-402-0x000001E71CFF0000-0x000001E71CFF1000-memory.dmp

Download

memory/3488-397-0x000001E71CFF0000-0x000001E71CFF1000-memory.dmp

Download

memory/3488-395-0x000001E71CFF0000-0x000001E71CFF1000-memory.dmp

Download

memory/3488-405-0x000001E71CFF0000-0x000001E71CFF1000-memory.dmp

Download

memory/3488-406-0x000001E71CFF0000-0x000001E71CFF1000-memory.dmp

Download

memory/3540-456-0x000001F1BCD60000-0x000001F1BCE12000-memory.dmp

Download

memory/3540-247-0x000001F1BCD60000-0x000001F1BCE12000-memory.dmp

Download

memory/3540-89-0x00007FF8DED80000-0x00007FF8DED81000-memory.dmp

Download

memory/5616-342-0x00007FF8DF830000-0x00007FF8DF831000-memory.dmp

Download

memory/5616-341-0x00007FF8DE810000-0x00007FF8DE811000-memory.dmp

Download