8e269f69cc241af31098d086c02d3d5d37b172d6ef85f8a43f0e13a8e166fa1b

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jjsploit.msi
Size 6.1MB
Sample260815-dj4r2axeng
SHA256 8e269f69cc241af31098d086c02d3d5d37b172d6ef85f8a43f0e13a8e166fa1b
MD5 ad1d89c3147f24d3bd43c24761cbf24b
SHA1 7f712d7c75926aa378d764cc965242a04d5fcfab
SHA512 8625aa4bb1a2786ed8e17571649dca412f780093b0f45402102bb9d10c01d4d7d80323d1e9dcaebddeeab1aec4c4229fd1e8ebc5b8c1ced903326449f2559130
SSDEEP 196608:KsiCEa1wAWUBqwcxJ0zWD+qPoLoXXCaLn:KrFiwAWUQwcMKHAcXNn
TLSH
T126563327BE815B26C0EB1E752879D3514B7DBC245F9688132292366DEDF23C08EB94D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5000	jjsploit.exe

Loads dropped DLL 2 IoCs

pid	Process
1064	MsiExec.exe
1064	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a85ac.msi	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\general\god.lua	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86B6.tmp	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Windows\Installer\{DB57A607-BCE3-4609-9E06-7FC77899C403}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{DB57A607-BCE3-4609-9E06-7FC77899C403}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5a85ae.msi	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Windows\Installer\e5a85ac.msi	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DB57A607-BCE3-4609-9E06-7FC77899C403}	msiexec.exe
File created	C:\Windows\doznlod\jjsploit.exe	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Windows\doznlod\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Windows\doznlod\Uninstall jjsploit.lnk	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
600	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\PackageCode = "B88BD9D59AB4B1A46A412BBAA3D0B3D9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\Version = "135331848"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF\706A75BD3ECB9064E960F77C87994C30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4B2484A816E553E46810E7349D0703EF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\PackageName = "jjsploit.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\706A75BD3ECB9064E960F77C87994C30\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\ProductName = "jjsploit"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\ProductIcon = "C:\\Windows\\Installer\\{DB57A607-BCE3-4609-9E06-7FC77899C403}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\706A75BD3ECB9064E960F77C87994C30\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4864	msiexec.exe
4864	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
600	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3632	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	600	msiexec.exe
Token: SeSecurityPrivilege	4864	msiexec.exe
Token: SeCreateTokenPrivilege	600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	600	msiexec.exe
Token: SeLockMemoryPrivilege	600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	600	msiexec.exe
Token: SeMachineAccountPrivilege	600	msiexec.exe
Token: SeTcbPrivilege	600	msiexec.exe
Token: SeSecurityPrivilege	600	msiexec.exe
Token: SeTakeOwnershipPrivilege	600	msiexec.exe
Token: SeLoadDriverPrivilege	600	msiexec.exe
Token: SeSystemProfilePrivilege	600	msiexec.exe
Token: SeSystemtimePrivilege	600	msiexec.exe
Token: SeProfSingleProcessPrivilege	600	msiexec.exe
Token: SeIncBasePriorityPrivilege	600	msiexec.exe
Token: SeCreatePagefilePrivilege	600	msiexec.exe
Token: SeCreatePermanentPrivilege	600	msiexec.exe
Token: SeBackupPrivilege	600	msiexec.exe
Token: SeRestorePrivilege	600	msiexec.exe
Token: SeShutdownPrivilege	600	msiexec.exe
Token: SeDebugPrivilege	600	msiexec.exe
Token: SeAuditPrivilege	600	msiexec.exe
Token: SeSystemEnvironmentPrivilege	600	msiexec.exe
Token: SeChangeNotifyPrivilege	600	msiexec.exe
Token: SeRemoteShutdownPrivilege	600	msiexec.exe
Token: SeUndockPrivilege	600	msiexec.exe
Token: SeSyncAgentPrivilege	600	msiexec.exe
Token: SeEnableDelegationPrivilege	600	msiexec.exe
Token: SeManageVolumePrivilege	600	msiexec.exe
Token: SeImpersonatePrivilege	600	msiexec.exe
Token: SeCreateGlobalPrivilege	600	msiexec.exe
Token: SeCreateTokenPrivilege	600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	600	msiexec.exe
Token: SeLockMemoryPrivilege	600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	600	msiexec.exe
Token: SeMachineAccountPrivilege	600	msiexec.exe
Token: SeTcbPrivilege	600	msiexec.exe
Token: SeSecurityPrivilege	600	msiexec.exe
Token: SeTakeOwnershipPrivilege	600	msiexec.exe
Token: SeLoadDriverPrivilege	600	msiexec.exe
Token: SeSystemProfilePrivilege	600	msiexec.exe
Token: SeSystemtimePrivilege	600	msiexec.exe
Token: SeProfSingleProcessPrivilege	600	msiexec.exe
Token: SeIncBasePriorityPrivilege	600	msiexec.exe
Token: SeCreatePagefilePrivilege	600	msiexec.exe
Token: SeCreatePermanentPrivilege	600	msiexec.exe
Token: SeBackupPrivilege	600	msiexec.exe
Token: SeRestorePrivilege	600	msiexec.exe
Token: SeShutdownPrivilege	600	msiexec.exe
Token: SeDebugPrivilege	600	msiexec.exe
Token: SeAuditPrivilege	600	msiexec.exe
Token: SeSystemEnvironmentPrivilege	600	msiexec.exe
Token: SeChangeNotifyPrivilege	600	msiexec.exe
Token: SeRemoteShutdownPrivilege	600	msiexec.exe
Token: SeUndockPrivilege	600	msiexec.exe
Token: SeSyncAgentPrivilege	600	msiexec.exe
Token: SeEnableDelegationPrivilege	600	msiexec.exe
Token: SeManageVolumePrivilege	600	msiexec.exe
Token: SeImpersonatePrivilege	600	msiexec.exe
Token: SeCreateGlobalPrivilege	600	msiexec.exe
Token: SeCreateTokenPrivilege	600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	600	msiexec.exe
Token: SeLockMemoryPrivilege	600	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
600	msiexec.exe
600	msiexec.exe
5000	jjsploit.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1064	4864	msiexec.exe	97
PID 4864 wrote to memory of 4496	4864	msiexec.exe	101
PID 600 wrote to memory of 5000	600	msiexec.exe	104
PID 5000 wrote to memory of 3632	5000	jjsploit.exe	105
PID 3632 wrote to memory of 2364	3632	msedgewebview2.exe	106
PID 3632 wrote to memory of 3980	3632	msedgewebview2.exe	107
PID 3632 wrote to memory of 3980	3632	msedgewebview2.exe	107
PID 3632 wrote to memory of 3980	3632	msedgewebview2.exe	107
PID 3632 wrote to memory of 4788	3632	msedgewebview2.exe	108
PID 3632 wrote to memory of 4556	3632	msedgewebview2.exe	109
PID 3632 wrote to memory of 4556	3632	msedgewebview2.exe	109
PID 3632 wrote to memory of 4784	3632	msedgewebview2.exe	110
PID 3632 wrote to memory of 4784	3632	msedgewebview2.exe	110
PID 3632 wrote to memory of 4784	3632	msedgewebview2.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\doznlod\jjsploit.exe
  "C:\Windows\doznlod\jjsploit.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5000.420.15308625223296136121
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff9a396b078,0x7ff9a396b084,0x7ff9a396b090
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1704,i,11210169599927813261,10159583714844523920,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,11210169599927813261,10159583714844523920,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1736,i,11210169599927813261,10159583714844523920,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.17.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3636,i,11210169599927813261,10159583714844523920,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:4784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9877E38453F670CBA9EC572A11D5BDBA C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1064
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4496

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a85ad.rbs

Path C:\Config.Msi\e5a85ad.rbs
Size 20KB
SHA256 7cfb4016fc580b8aacaa608c64017060d7bd9b80506ff290bba9fc02afb9cbd1
MD5 74ed7c9406db53e3c4d61da411baa6fd
SHA1 00c95d7d8d9837d6860afad81def02fbc5b117c6
SHA512 d8868897dbd0f28c181f575ef8a4d0ffd072bb0346bbc68a819fdcd00f2b96b2df911cdc7e53f4b267a40de9cc2839fb6060fb4339d9bc1bcd8207d79790e38b
SSDEEP 384:tzi3A2zoGymjVA1+AIhWZ/oAWVqctCtCtCt6tmtmtmtmtmtmtmtktRtRt8NR8Rxn:tzi3A2zoGymjVW+AIhWZ/oAWVqctCtC7
TLSH
T1E49220466B10C6A2C27B4739EDEB535937B2E9CDA398820B41CC4260DD573C62FE2D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk~RFe5a8936.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe5a8936.TMP
Size 1KB
SHA256 c15e0094285db15f731b4cae1eba6b5da454ea78d2a5fc4453ddc4e2d5f2c781
MD5 8da43d31bff1558d4774f58de4c9113f
SHA1 d61e47ec0c77b8b24757095cb9da479635389838
SHA512 cc5ffd4c842668eee860791b987dd2b59099d962a5cbebf32eb90139da8b98747752fb1a334c8c784931918717f313d008d5627b15f86dcca2e8fbacd19b0d9d
TLSH
T1D9310D2419E50BB9C3B10B7A9DDB5323D6BAFC24A9609F6A015442840C44681D8F4FBF
MD5 SHA1 SHA512 TLSH

Submit Download

~jsploit.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\~jsploit.tmp
Size 1KB
SHA256 1a7c2b9f4dc43ee26399d1ef522c5a44d404204fdff2542eadf06dfbf0171c79
MD5 c39aa95b4aeb0d34fca9fb9eb4e9a516
SHA1 3325987cec2224a70d44408d0d2386a42ca79218
SHA512 281cb686f10c144d0e4bb5588abf7d0a7aaf010813a4126e9171f07f160325bf82208491aabdfa9f8cefbef23918bbbdb7ad7f69c658e5d7d3b2a7c8c604f96c
TLSH
T1704163205AE50B78C3B10B3A9CEB1323C679FC25E8209F2F014442840C48680C8F8FBF
MD5 SHA1 SHA512 TLSH

Submit Download

MSI39CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI39CE.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2ae84713067a081aa4a0971775151f9ea4f94ef9da5fb51f7681470e405a5f01
MD5 b70d947f4baca7d1c11906aaf384f601
SHA1 7afe826872dfd1c1cf2703e93a586aaf7248a83f
SHA512 4d6c3706b14bd6fdd9d3c2e2b0c6a48bfcfb3cfb5c0836a8b1fa0c1f5dfebdae7a3187c82334ee765a44a8377c63145a1d3d41fd0e380c4f27cf97b188312eca
TLSH
T1F5D0121633120974C1102033004371880400C11F80454445D83C89BE2E480540A03481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d6359c6dc04c6ad530a73ffbd0f591a04f6e46a66d82e1ddb5943cdc87d9f058
MD5 99b828b32dd65d8efe827fcfbebdca7a
SHA1 c889a4134f1adcaf7a0a16b6f40bfda80072cf74
SHA512 f060a62c482a8d3b50e77637361389d64a4fea1d2cd2569c05f8663bdcfa4b38eaba9599960f0581439a5cf3a4b1cb52da5103ae7e007ae1a87c9af5bc8993e8
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 61d35105776f3df42f578c3f04f47df1c3a56da47a7d9bd7c4fd1e40c7d6718c
MD5 ba56337f2c2c54949386c02675bbf2ea
SHA1 9a391a87ea6f03acf3c4c161ff8ccf56e7c77d5a
SHA512 282720e79d7e5a799c3de6eb8d7ec1f3dd8ad50d76c4750cf13359cee579995bc94d32ba3d7b9d8c9ddf94017b3c122d820f0980d857b66ec8c8cfdff6158ec6
SSDEEP 3:LstlNllkll/lOaFql:LsX3lEtOawl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 1KB
SHA256 3517d59f666b4a20ece34cdb66b552b0ed3bcd808dd6a87710ccd99ff476cb1d
MD5 02d1a7dbce2fa1541d35b4311f51cc1b
SHA1 ebdec9db48cc1504b9fd9aef93dfb94e3e7805e8
SHA512 48c0da3a13386787d55ce20fd234c606132f0e8b234530b0df26e5a082b87addfbbff2fe5c447f370f55394ce9dc5e25686d68f371a8b9ec296ccaff68be4299
TLSH
T1E1318773D0942B335CD7BE81B3817A976E50103981249E88BADD0B1C02F738DB119D23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 d0c8a707ea1e1cbf3f6fa870556d17fb24fa70c6aa543be254014f57e7b548f7
MD5 1e86b579baacdc1052bdcabdc1c01c30
SHA1 af6a1bf38df720c1c383b2ee8bc5a3571f88addb
SHA512 c2bb352a38aaa9f74e3fb2d1dcfef2f1727c60456eb9d6d1dc03e2b44ff60aa4f8bfb1595e508ac159496e13cca5faf09de8c367c0f65c0346c665c4720f35ce
TLSH
T1C351E973B448AA3389F7AE44B6453F639B79506596652FD4AEEC0B1C01EB38C3306C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 29d847216da89ec85782c7345395f4ac5be1afc548f28770ad21e5dbb6bf94cd
MD5 24e931e0fa03f69c3b7474d8f94fd842
SHA1 702a002123601bf4a26c4ea5647e147eb5bc063c
SHA512 10173919b946f0042d8a836368e8234be9a86812b786900fec0c08910f72ae22902b942d68736c64ba0ea9f7f335a019739a9918d94c00c905c0872de80da864
TLSH
T10A719572A5A8A9374DF7AE40B9852B16B7A55137E5953FD8DAEC0F0C01EB38C2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5aa828.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe5aa828.TMP
Size 1KB
SHA256 f32505ba4ad441e3b891bab8023c38bf349d5f23b141aeec65d308dd767bcd7f
MD5 d6ef6942a2cf9d81878f5d67ae6f224d
SHA1 d343a93179d8078bf0fd75961aade4a71d6f1815
SHA512 e5ab2da0af8efe26b0e8c7dc68620ea57137fb982298c6450d9124afabd322cc73be446adfe68d57c39dfd583608ae7fc706dabca4b25384919200947155bb50
TLSH
T1F5215773D0D87A3368D76D85B3817A9A2E90517992285F48FADD071C03FB7CDA21AC23
MD5 SHA1 SHA512 TLSH

Submit Download

e5a85ac.msi

Path C:\Windows\Installer\e5a85ac.msi
Size 6.1MB
SHA256 8e269f69cc241af31098d086c02d3d5d37b172d6ef85f8a43f0e13a8e166fa1b
MD5 ad1d89c3147f24d3bd43c24761cbf24b
SHA1 7f712d7c75926aa378d764cc965242a04d5fcfab
SHA512 8625aa4bb1a2786ed8e17571649dca412f780093b0f45402102bb9d10c01d4d7d80323d1e9dcaebddeeab1aec4c4229fd1e8ebc5b8c1ced903326449f2559130
SSDEEP 196608:KsiCEa1wAWUBqwcxJ0zWD+qPoLoXXCaLn:KrFiwAWUQwcMKHAcXNn
TLSH
T126563327BE815B26C0EB1E752879D3514B7DBC245F9688132292366DEDF23C08EB94D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Windows\doznlod\jjsploit.exe
Size 17.6MB
SHA256 a0d82c2d365045d1f2fc0e488fa1bdfccd43e3ddc130792a33e3727015f1b7a7
MD5 8a5526391fd33cb9b95b1d5ea2139990
SHA1 039f817b301f3386d3755f483831d171ed65bbab
SHA512 d32f486aea88569453d04e61327eb9f6c39a5635b90ef0248fe9320b35337dd2c650798284b2cad15d39c216fc0b80b323b485f266177e8386f5eecfd79cc075
SSDEEP 196608:++8tPU28DotIl6NxJ/LAF7OsvWquL41Z:R8tMBD7yxJ/LI71puLAZ
TLSH
T17307F821BE8B996CD05FC474834B8A724A7570CB0B35B9FF448596382F6ABF45F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 080445b98710e9a1645c5b9f7c71e964f86211050d0f61679d782cf140f4c867
MD5 db5c565be35b75f391e832b9e61004e5
SHA1 932a15025ae1c09e8f9d09447f5c9ec99b103a76
SHA512 70377402b302adeafd7595fbea80984f697fab744645eb73d2f2110785ab3434f5e4239a581596e00af9259f03a88411b88d6f58a43d521313aba0ec5317d7a4
SSDEEP 24576:3u8m+1z2doO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:C
TLSH
T1AB47B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{313f276d-e742-4758-b4d6-b99dfe6b196c}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{313f276d-e742-4758-b4d6-b99dfe6b196c}_OnDiskSnapshotProp
Size 6KB
SHA256 bc34bc3fdca29ef627a4bfbb69d53b26d90e431695bd555bfb7f694631f9da1c
MD5 17c834697c2dad3a39708cf4c8a6b461
SHA1 a547c82fe3cf14d83f0109bd9c2b619ae7fa91a0
SHA512 8938c2f2c130b42c39f8236e7c36e797268211e20d51703314a5131164019686bae3d1f85ce5b8b701c8a60847a1c66ef256555cb2c7d2024a07bce1c598e9b0
SSDEEP 96:FgQeJSGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:qQrGPGnb++ZVmN
TLSH
T159D18A085AF54711E2B3AB7129F14557A477B911EF33CB8E0198638E6670910F836F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3980-92-0x00007FF9C2600000-0x00007FF9C2601000-memory.dmp

Download

memory/4556-117-0x00007FF9C2F30000-0x00007FF9C2F31000-memory.dmp

Download

memory/4556-118-0x00007FF9C30F0000-0x00007FF9C30F1000-memory.dmp

Download

memory/4784-208-0x00007FF9C2600000-0x00007FF9C2601000-memory.dmp

Download