2dd029d516d94a29c896749a61286d5a69b730aecfcc73084f0d15e02e7c1412

Analysis

user interaction
yes
max time kernel
134s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gfugyA89z3o.mp4
Size 29.6MB
Sample260818-tpbansab48
SHA256 2dd029d516d94a29c896749a61286d5a69b730aecfcc73084f0d15e02e7c1412
MD5 aeaa19eb9d881215706e164a59226429
SHA1 0ecef6aaee57f8ea65f3afcd2ea493da7fad02e3
SHA512 6cab0b87ccc8da4eb131c268b2ef3835bdcd38b01fd35f59b733a53c39ee596e9865f9f992ec8acc4e8578c285ec60e3a537ab52f82006ae662ab2b33a154523
SSDEEP 786432:JG8pMvO0dUk5ObYAQjyFzGljq8BIGSLGW4j/XyQ:J3pEDSsyasaB04j/D
TLSH
T146673378A3E5A987DB2193B5ACD267193BBDE834277B53CF890493B1DA413807D821DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5924	jjsploit.exe

Loads dropped DLL 4 IoCs

pid	Process
2124	MsiExec.exe
5924	jjsploit.exe
5924	jjsploit.exe
5924	jjsploit.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
374	raw.githubusercontent.com
384	raw.githubusercontent.com
388	raw.githubusercontent.com
390	raw.githubusercontent.com
392	raw.githubusercontent.com
260	raw.githubusercontent.com
261	raw.githubusercontent.com
373	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua	msiexec.exe
File created	C:\Program Files\jjsploit\jjsploit.exe	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\god.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua	msiexec.exe
File created	C:\Program Files\jjsploit\resources\luascripts\general\fly.lua	msiexec.exe
File created	C:\Program Files\jjsploit\Uninstall jjsploit.lnk	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F8ACBF48-B974-463F-ACCB-31C538CEAC82}	msiexec.exe
File created	C:\Windows\Installer\{F8ACBF48-B974-463F-ACCB-31C538CEAC82}\ProductIcon	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{F8ACBF48-B974-463F-ACCB-31C538CEAC82}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e59a253.msi	msiexec.exe
File created	C:\Windows\Installer\e59a251.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a251.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0008000000024791-911.dat	embeds_openssl

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4344	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee28096e8f31db0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee28096e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee28096e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee28096e000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee28096e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315432372756711"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FBC33B95734F0734DBBE0F16324DED99\84FBCA8F479BF364CABC135C83ECCA28	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84FBCA8F479BF364CABC135C83ECCA28\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{54F481A8-D538-474F-8913-DDC4FCDB7507}	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84FBCA8F479BF364CABC135C83ECCA28\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\ProductIcon = "C:\\Windows\\Installer\\{F8ACBF48-B974-463F-ACCB-31C538CEAC82}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\SourceList\PackageName = "jjsploit_8.18.5_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84FBCA8F479BF364CABC135C83ECCA28\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\ProductName = "jjsploit"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\PackageCode = "3EF603310298948489553C963C81597C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FBC33B95734F0734DBBE0F16324DED99	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84FBCA8F479BF364CABC135C83ECCA28	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84FBCA8F479BF364CABC135C83ECCA28\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\Version = "135397381"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84FBCA8F479BF364CABC135C83ECCA28\SourceList	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3840	msiexec.exe
3840	msiexec.exe
7096	chrome.exe
7096	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
5920	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3864	wmplayer.exe
Token: SeCreatePagefilePrivilege	3864	wmplayer.exe
Token: SeShutdownPrivilege	3012	unregmp2.exe
Token: SeCreatePagefilePrivilege	3012	unregmp2.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3864	wmplayer.exe
Token: SeCreatePagefilePrivilege	3864	wmplayer.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3864	wmplayer.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
468	msiexec.exe
5924	jjsploit.exe
468	msiexec.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4052	3300	chrome.exe	87
PID 3864 wrote to memory of 3196	3864	wmplayer.exe	88
PID 3196 wrote to memory of 3012	3196	unregmp2.exe	89
PID 3300 wrote to memory of 4344	3300	chrome.exe	91
PID 3300 wrote to memory of 452	3300	chrome.exe	92
PID 3300 wrote to memory of 452	3300	chrome.exe	92
PID 3300 wrote to memory of 216	3300	chrome.exe	93
PID 3300 wrote to memory of 216	3300	chrome.exe	93
PID 3300 wrote to memory of 2608	3300	chrome.exe	95
PID 3300 wrote to memory of 2608	3300	chrome.exe	95
PID 3300 wrote to memory of 1044	3300	chrome.exe	96
PID 3300 wrote to memory of 1044	3300	chrome.exe	96
PID 3300 wrote to memory of 3880	3300	chrome.exe	98
PID 3300 wrote to memory of 3880	3300	chrome.exe	98
PID 3300 wrote to memory of 1604	3300	chrome.exe	99
PID 3300 wrote to memory of 1604	3300	chrome.exe	99
PID 3300 wrote to memory of 1792	3300	chrome.exe	100
PID 3300 wrote to memory of 1792	3300	chrome.exe	100
PID 3300 wrote to memory of 2380	3300	chrome.exe	102
PID 3300 wrote to memory of 2168	3300	chrome.exe	106
PID 3300 wrote to memory of 2732	3300	chrome.exe	107
PID 3300 wrote to memory of 3204	3300	chrome.exe	108
PID 3300 wrote to memory of 5096	3300	chrome.exe	109
PID 3300 wrote to memory of 5096	3300	chrome.exe	109
PID 3300 wrote to memory of 2320	3300	chrome.exe	110
PID 3300 wrote to memory of 2320	3300	chrome.exe	110
PID 3300 wrote to memory of 1060	3300	chrome.exe	111
PID 3300 wrote to memory of 1060	3300	chrome.exe	111
PID 3300 wrote to memory of 2180	3300	chrome.exe	112
PID 3300 wrote to memory of 2180	3300	chrome.exe	112
PID 3300 wrote to memory of 3400	3300	chrome.exe	113
PID 3300 wrote to memory of 3400	3300	chrome.exe	113
PID 3300 wrote to memory of 4056	3300	chrome.exe	114
PID 3300 wrote to memory of 4056	3300	chrome.exe	114
PID 3300 wrote to memory of 740	3300	chrome.exe	115
PID 3300 wrote to memory of 740	3300	chrome.exe	115
PID 3300 wrote to memory of 4352	3300	chrome.exe	116
PID 3300 wrote to memory of 4352	3300	chrome.exe	116
PID 3300 wrote to memory of 4528	3300	chrome.exe	117
PID 3300 wrote to memory of 468	3300	chrome.exe	118
PID 3840 wrote to memory of 2124	3840	msiexec.exe	120
PID 3840 wrote to memory of 6012	3840	msiexec.exe	130
PID 468 wrote to memory of 5924	468	msiexec.exe	134
PID 5924 wrote to memory of 5920	5924	jjsploit.exe	135
PID 5920 wrote to memory of 6052	5920	msedgewebview2.exe	136
PID 5920 wrote to memory of 5756	5920	msedgewebview2.exe	137
PID 5920 wrote to memory of 5756	5920	msedgewebview2.exe	137
PID 5920 wrote to memory of 5756	5920	msedgewebview2.exe	137
PID 5920 wrote to memory of 2144	5920	msedgewebview2.exe	138
PID 5920 wrote to memory of 4108	5920	msedgewebview2.exe	139
PID 5920 wrote to memory of 4108	5920	msedgewebview2.exe	139
PID 5920 wrote to memory of 5852	5920	msedgewebview2.exe	140
PID 5920 wrote to memory of 5852	5920	msedgewebview2.exe	140
PID 5920 wrote to memory of 5852	5920	msedgewebview2.exe	140
PID 3300 wrote to memory of 7096	3300	chrome.exe	144

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\gfugyA89z3o.mp4"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x11c,0x120,0xf4,0x124,0x7ffa3cc4c728,0x7ffa3cc4c734,0x7ffa3cc4c740
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,13235068763654620003,15113453498394544350,524288 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,16245441607557096029,2693509018595158597,262144 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,14871594284273608890,14500600430396957828,524288 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,16483653478329864047,5691454829279311329,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,14869464412572321267,13086096161788396643,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,951954435233747194,9389926791705170353,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,11618193158384454778,6160885102745088158,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4940,i,13179365813664019121,16236751256987817645,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,1079152058614957506,726994116741400049,524288 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3212,i,455395424375942192,7590899236830081657,524288 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,5834322958083062112,18297077308004528392,524288 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,17281541680803691984,8694565608206260364,524288 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5804,i,472272400663624692,8148470155659829108,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6096,i,1363689259567107267,13147488355479468081,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6140,i,3650923229999783308,7628944731440729355,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6296,i,1246887942179219450,328492059459804073,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6516,i,17351923749371636442,4840683864601207113,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6528,i,7918670893786248178,9888702244811095837,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6504,i,13472640469953160589,3073669151047032108,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6448,i,3906747588711784509,14923894228526250913,2097152 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,18206491812877263927,14530277698566120080,524288 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4528
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\jjsploit_8.18.5_x64_en-US.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Program Files\jjsploit\jjsploit.exe
    "C:\Program Files\jjsploit\jjsploit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5924
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.5 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5924.6024.11994268052052975591
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5920
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa2512b078,0x7ffa2512b084,0x7ffa2512b090
        5⤵
        
        PID:6052
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1736,i,12867829632965912734,9067476150324509652,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
        5⤵
        
        PID:5756
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1912,i,12867829632965912734,9067476150324509652,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:3
        5⤵
        
        PID:2144
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2340,i,12867829632965912734,9067476150324509652,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
        5⤵
        
        PID:4108
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.18.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3572,i,12867829632965912734,9067476150324509652,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        5⤵
        
        PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7132,i,2845731063828988808,14338976700861789995,262144 --field-trial-handle=2132,i,755577932020811637,5060486734815660226,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D214B6CD860833DDB8EF27546D03C42B C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2124
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6012

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59a252.rbs

Path C:\Config.Msi\e59a252.rbs
Size 21KB
SHA256 06773552216a244acfe55897a0c3d1408eaa0a1e41b6eb97faa49979284ffbf5
MD5 7641c2470911d82eb54d00a28db9fb7e
SHA1 61132f9924ef4ee63556b35de8b05b6c1e839f9e
SHA512 1863e5d273d01f10bd0fd629e883721f44b446c3e5408f7a1ad464f802cc4f6fd4fa1fd20dbf58e2bf5274b99e27cad1638dbbbddb98e00c6b3e8dfefe61e0a1
SSDEEP 384:TqTWaL4oCIA+sLNR0XjtayOaA+WUbkt8t8t8t0tstststststststitztzt5crct:TqTWaL4oCIA+shR0XjtayOaDWUbkt8tc
TLSH
T1B8A236424F10C6A2D16F0775DE9B57043772C99FD388820BD68C92378A937D82FB9A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe

Path C:\Program Files\jjsploit\jjsploit.exe
Size 17.6MB
SHA256 6c2e9a774bf35931a8d0b81956a2db024bc965a835b6ddc89251daa5ccdab2c5
MD5 0ae0487af5c5c1187c3ecba3920f7248
SHA1 98f56cf0c02b6dcad75eddd2a41221a8df3f9c05
SHA512 e816170386104a57713156e30c966219da730379623aed4deb51e3b6fcf5fc5061705decf68e2a2f853b52647cd78978c82606094938c44dec74a26f8ef6d2ca
SSDEEP 196608:Rynx9OOpLUPue+avZHsR1lBVtXcIWHvOQ044:Ry3OOphAvZMvlBbcI8vOv
TLSH
T14317F725BF9B996CD05FC470824B8A724A7570CB0B35B9FF448596382F6ABF41F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
Size 1KB
SHA256 c53dff0a89c9822d9ab22c5059de59f89873b507dc4b0bbef03aa560f49f43c9
MD5 47cde84c74d56b20c8ccfa0a91eea768
SHA1 624591314ace3382383687f6b4eaf45cf8cc9cf1
SHA512 955c2b86cc7497d9b1369c0daa8e851bd31c3445edbd80648f3171f75b4a057b564c03dee45cac5d71d0de30bc4b8b8928726cbce1c222df5fb2ad86841d77a5
TLSH
T16F41DD1092F51725E3E18ABD7DA20721C67AF8769DA88F6B8084408D8A65140987DFBF
MD5 SHA1 SHA512 TLSH

Submit Download

jjsploit.lnk~RFe59a81d.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe59a81d.TMP
Size 1KB
SHA256 41900d69daa0e4f885415ab519c0ba5529e94a4b4d68d8f487d875bc07f2afa5
MD5 c5ad47ebf6e5b827edbdf1e095b580dc
SHA1 a440c17fd4b5c06ade16a386efaa804f053b33db
SHA512 86666444aaed3efc566095ccae212c7d576b8815dfb68aaf32a3199b50a5248c7d9342e223d67c8a615db21d158fab0e64a5970c39f99350652399a24d883d62
TLSH
T16741DC1092F51B25E3E18ABD7C930720C67BF8369DA88F6B8084008D8A65140A87DF7F
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0ae667a91bb7a0f59a416ba98e5c75d70b927b2c9bc3cd0cc8b5fdb45ec3ffd5
MD5 09837d9516966761051ff5d277fd0703
SHA1 f96374c814526d2405e50396d12e81d166bd5f8a
SHA512 c603c4ec3a12721ebdc52f8a146e57f3be72acbcd99e12897c4b6328044c2c18586b0b6448f351fe118a2b3ceee14a018ef58295f367602f41fad8d057d63671
TLSH
T17BE0ABA6C864AC371CFD073C50990B4AEB1113562EC0481F3A3CC20C4FB1A2A0186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004a
Size 21KB
SHA256 485b19a448838d7e03c61e8d6d7f7f20c9f7f234d87ae12811441ed648ca2b11
MD5 7321fa7278264b45ef2351b1adb19ef6
SHA1 df47f2b3bcbe09d1443308522699a1c890269846
SHA512 f704ed4a10f62af659e177a2babd1d32f562fdb05d169b54af9a321cde6b84c0c0005e3c79a3766201efa3644a2c3ddc54bd6591b526c07deb1cadd57bd854e2
SSDEEP 384:D4eM/XmoXDFDt1xoDi3uqD4Uylqz9Jrrh8uYDJlxJaA9zxjWdJdfpFfIXL4C:D4e5ozFDDaDi3Ed0JyzlSA9zxjWdJ/FY
TLSH
T15FA2E0AE2955BACA381031F527F69C3C30449133215559333923FF8EDB38DAA654D63A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 3e647c6f1ae41e6b1d6a026c048bd9199c2eb4c93896e8559fbb7f3ba8d0c1c0
MD5 07a92d683fcc430a97dc13bcb62626aa
SHA1 f6e1711a56478210871142f50d84318f4f1adc30
SHA512 c3adf02e195f534fc0878f7711caa96777f6b89db4f3ee3d1987aed575749b294c2d1d8ad0d6373218c4ae61957cc979b82ccbd60eb6a5c0a0fee154cd4b3629
TLSH
T1A5C09218E5811206D7E857B028A108A026B769B911AAA6D685E00C89B8E3BF1E008E01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ee491eb35be86f84ed52283f2da0a2ebc0aaf481aebfdbff41345a1ec05da13d
MD5 e9d6224467f46cb36d8c69c1cd5bd8b4
SHA1 64e6603a84254ba61f5b029bef652b7916924527
SHA512 cfa8edcfd2d2835b359bc2675288724620c4086d345f062263f29b38471114ee81480332ede641b9b616487c9fead3d6df1b7458deba5ff0c8c3d66d9b2eb4dd
TLSH
T1AA41C000A0CAC8F1EFE80A3190B8983D62E743AF05495FDBD6A5FE6881DF7F4446E510
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 9637a8544ade0e4e829c206a9829ca86ca46176d5b6728276e3203cf625938ab
MD5 7b129293b4455d492e91f41e24eead02
SHA1 1122c2c3138d6de14a7592bd278d1609061a1c47
SHA512 39c37932e130a00b9c86fb3396eef31e55aef5bcc0b3c0b67c92caeafec23a4cb0255a0fd5ccf8ce5ed93bf18828e94997746e3dd7acecf18b44094c24024339
SSDEEP 384:D6wBNQ35YDF6otnNkebTE2NcZlBeUJTUvseezRaIa3l78AOCuUWNJwNWBav+WUWI:5HhKF75RcvRiuTzDu
TLSH
T1A282E0F7C3E8897D985155F897242E2BCE5E191902183D66CDE8EE4F93F1832E21164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5c593a391e344f6c1a3baf77f6d964b03e7a4e702f6f3ec513178ca8c185021c
MD5 1eaf7a18403d503dd157fd70da078217
SHA1 eef4cb1d485d1723a2d1fe054f28f894c8f135e6
SHA512 0c2fcc2b340ebd06ffa0e62cb450cd72e0db92b18f0cc5b20c84ad2ab6e3a735f05e018b0777e61c212bc5cba3bee12cb3aff48f708aaaf76e724d2456d5421a
SSDEEP 192:qRPUL/zv9Kxfv7hpAPRp2HVl95Hsb+WNn9p44E2twWhkwvaWZVyIsnAUge:qRPS7639UXKrwfw2fPaW/e
TLSH
T11542D62EB914353B5CCAD329F9267717D7F6142225E41E84EAFC896C15EBACC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 55611f820c9c1a5225746ef76d8b1fab676a594a9936a7fe248efd3d8359fadb
MD5 84cae6e1e90b0f745e3c4ec5e84466b6
SHA1 5e45e297cf59d8e7084dae7ebb4378acfa00276d
SHA512 039b03bf28afdd01a980cdc53bca89453bf557345ee48149a2d6f95d825916584da379278f725eac8a1d05f34a0210f4ee3ff7a23f3ff1e4f98e24fd9e53dc7f
SSDEEP 192:qRTcBzUL/zv9Kxfv7hpAPRp2H14+95Hsb+WNnK9p4woxEgIwWhkwvaoZVyIsnAUp:qRTmzS7639UXurwetuEgoPao/e
TLSH
T19252D72EB914353B5CDAD329F9227717D7F6142125E41E84EBFC892C25EBACC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 bf60b5493c7c68b712bb88de508c6ca6a3d5670146e4a03de1def39aca16fce8
MD5 5ba7c84d89e24e2f77da19e0f4d442bb
SHA1 f7d70ff11add8dbbea56c7ec92c1e6139a5bb225
SHA512 5e784937e44795ef5623b8d2762cf8a60fe71525eb5916d6d92d4954e6a5199d92736fa9e3c20846e2507ee389c4c7fb0690962200fdc542c6fff30a463c8b8c
SSDEEP 192:qRTcBzcL/zv9Kxfv7hpQPRpuH14+95Hsb+WNnK9pKJF+woxEJwWhkwvauZVyIsnB:qRTmza76390X2rweivuE7Pau/e
TLSH
T1C152E72EB954353B4CDAD329F9267717D7F6142225E41E84EBFC892C25EB6CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 aefd0ce1c5eeed5801c254dde0573fb747cbf649708ddfe40170f5f1ad7f44a9
MD5 06b36446200f3752d8b3d8ad04f74e66
SHA1 5d2dec2a60ec7bf07a7b3c35d0e419b9171e31ef
SHA512 f73423a597f8f624f640d867ebae986c97abc266502de5a691d8a98f16a46bb866a2d6e55ea8c646283e9f7fc76a1bad2d3fb77c3a63ee5918297eaa95274613
SSDEEP 192:qRTcBzcLnLNnJKxfv7hpQPRpuH14+95Hsb+WNnK9pKJF+woxEJwWhkwvauZVyIsB:qRTmzaxnu390X2rweivuE7Pau/e
TLSH
T17E52D72EB950393B5DDAD329FD257B17D7F6146221D42E84EAFC892C14EB6CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 241dde6780287c1251c29aea94ed241720cd39bab9954fee288db5b2c75329e0
MD5 0c390fd7f9a58af8da9b69be98c33997
SHA1 d4255e238c9b81cdf227f5e37741e69604074728
SHA512 d256c899d8da0a559b8802e0cacee2b88a54d2103fdf2d66184deba9d15b773949623c257635f7e07304eb4be48f5664a7306fc71cb99c48ad8ec493b863df2b
TLSH
T168C01205C203B211C0D603F01053D8ACB1759F20EA5E238C82E4FE26EC75222E02A179
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b9643289e8719d37fbb368189df9792e7f10acff5cdbc45a3c0a8ebbd363dd76
MD5 e64c4cfd87f6ef123bb126df58b6e7a4
SHA1 3236eb43ec4c43af8c29e7fdc275008eb151de54
SHA512 75b0279b31feefb2885cc46e5b103c11bb262dba7aeee0a16e28f1f2bda662ac9720752e304e00b6acc6c946fbbe607c458b374458a405d10faa3c67dcc0112d
TLSH
T176B0120084415151C48202B05646148871645F10960B270693F0A932D835361C114090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587f2e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587f2e.TMP
Size 120B
SHA256 1eba449747d8217d8d2c9648aec1b7b295c868b22540a39f3419d6bb6ce62301
MD5 647298c4de9559637a8f646c2eaa84e1
SHA1 52a17ea8813b41b4faf152be152b0f7a2a1c1ecc
SHA512 4c7c221d280e268c64b57d0b5524c5479790808f1058b8fae6c83d0558472b6822ffcf4a849e08c625c2efa97476ec578c1489a1f8a62e3ee9ce252f7ecaa3e4
TLSH
T188B01253C081D210D01302702D00C4CCA156BF21C5070337B1E0074698765600114190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 33802f512a10b59c7f0032cbe226b1bd8592bda50a2ac2835f0237174991530b
MD5 884046a3dad56821030daff0e4198e81
SHA1 663b3c16deb0e456717fd3a32fd6266037974d3f
SHA512 153dcf87564b10b8f0af93f148ad52a0eda10987cc64cfeca7a73fafce08b5a65b2bffc9b98e532ef7101bbf5ea34f2790ee640669201b512172eb556440deb9
TLSH
T11CB002906D10117ED0382B7466EA708D36A59C27935252D248959898A4B579CC66A881
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 281KB
SHA256 10ccc93d791397bb0c525cf6d08d0c3c876428ff6f6340bef37ce9edef0fe3fa
MD5 6729d54fe4cb4c257b50b990e074d23f
SHA1 21cc68224f6b1023dfa59b4ff11da97eeeb23d19
SHA512 e5ca8962a61157f9aaf109b31a262906e537725433a0aacf5925c6196a60bad3cfd274ecc1e0000d912a9b3589834864176f347b57ae47ea0f25a85e20653548
SSDEEP 6144:z3Pkd461bZ9wg20MtriHc2aqZ/ZLW3Ex9:z3846r9wlqcBqZ/piQ9
TLSH
T1E6542373AB961E320FC8D774B6630D417FFA81CB9038A249AAFE37B77C519A10412C94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 ac1b94857d9b8438ef47973481008ce903754a6e3e560154fda6dfc2344ffa03
MD5 2176e98da9088531be4af2f0a39471b5
SHA1 fc367cb3eda6a033c3b380c76838f1ef2919383c
SHA512 6bbb6a1754e2364f4e3f21ea0d066c0f48f65802423965162f0024ee5a788253aa9849e31c15e3fe2d25784782c51bbce09f4ffda7dbcd4c12646963554e70d5
SSDEEP 3072:G5ycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKjqfd7NtZL8cHQRZEQ6Sps9:GL461bZ9wg20MtriHc2aqZ/ZLW3Ex9
TLSH
T1D5341373BBD55E321FC4C768BB631D423FF6C0CB942CA209A6FA73A76C819650842C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b7e40764f45083cf3be33ad3e011361fcff1a6306ebb0bcea0cc19e8b9cb1a90
MD5 3fc16a4f4663987167657d7874c29fe6
SHA1 08caf88980ce8923d271d3de0460e8ac5a5ce32a
SHA512 03fb74e18a4795e585882371243e3026de431d6e55e6967d27431bedba45ed78fb7f1c0384d7c98fdfc9c46e82081eec67c338be683e4556dd2f328535356396
SSDEEP 1536:69yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:uqfd7NtZL8cHQRZEQ6Sps9
TLSH
T154C30237EBC21F335D82CB64BA534FDA97B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 5b351f34467f1a502afb2b2ed4ea039c40d65199d1b9b266d1dc58a01ce496b4
MD5 b02251ff206c35e5380bd1647a2afa3d
SHA1 d3c1e4029ce55b3e2ce82475f0f9dbb703cb2bc9
SHA512 387055091bd367a983f7fbf1c67c21a788cd20718cae9039f0eff6de69fd8e3f5133ee27d234b4f5faec87b21327e1a3c7f9f98763aebbcbf821ba0fe7e5cdda
SSDEEP 3072:Iqycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKjqfd7NtZL8cHQRZEQ6Sps9:H461bZ9wg20MtriHc2aqZ/ZLW3Ex9
TLSH
T1FF341372ABD55E321FC4C778BB630D423BF6C0DB902CA255A7FE63BB6C819A50451C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 ae2f4915b27eeb8d052c3800049afdf1f77e6079a9199db64bbfdf2089b49b97
MD5 fd2562085d489d0e8c7371cc3efedb6c
SHA1 6da7efdf71b420f218ff1fda7b8484c9885dc838
SHA512 2bae51949cde4733750ccb2d0acf94fce6d41f342c1930a8ce57246fb723593c34184cc00c97b438aac289bec43022bb93e5e46dcaa6aaff7eb71a1d9d8e7e5e
SSDEEP 3072:bqycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKjqfd7NtZL8cHQRZEQ6Sps9:s461bZ9wg20MtriHc2aqZ/ZLW3Ex9
TLSH
T12E341372ABD55E321FC4C778BB630D423BF6C0DB902CA255A7FE63BB6C819A50451C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 704KB
SHA256 f3a2a99d799db33f1bfe620ce99b74a45dc04ceddebdfdf9447547401d8eb68e
MD5 ec2da877203e9f89608968e0d3988480
SHA1 ef8a8d7e5df123435c9c7f6a76dbf19af1628730
SHA512 167e0835c06809b32cbc073c90cf8f00394b3a4e00e434a1a0522e6ba86e959ee243d40c8f4c074457669738059484cd7d1c958476abc9e785537c3f0b3d05f3
SSDEEP 768:Kf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3o:K69tQeoVYogYpktMGAKt2hZCDX
TLSH
T13FE42D37A470A098DF3C35B1E1AC6F4DBD72640A12E006421F70B57F7A237D9DA4A5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 6bea1d9813173226fc02de4ab73d218da3d797d92bbf55da9bb0a5fad8694989
MD5 84b44f356f07a664d0ef0d1db3b105f4
SHA1 6d1c5d4e3edb0ed5f76fc8d8c10e1198b83b5d2f
SHA512 0108ddd8433542fac5c979f32ebc3c29c3a9420fdb6e1193b6e764305efe3e6c07e820b0df47782b071d56a90a1feda67a113715ad9e4925e734c8d1e0a59c97
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaO:rZP2tFP3vqY8bqEMyTaBacg
TLSH
T1C5257437D190B0C5CF2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI43C6.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI43C6.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 f8b0e320175a4e007812e3410219b02e7e66ee161cf45e8524ed557d4c319798
MD5 bd149943216a95b7e952547ee6395933
SHA1 e97e7bd36c660768c915416f05514896a238f0c6
SHA512 cc2b0e84797bc027aa3d61f0fac6d956d3fba4ff7c34240c7bc89f2954884f492d384511604f2f96db2e0c75951f598c858639b1fa230e7d0bbad915edc72036
TLSH
T1D8217D5B1B8DD87089E01BE75DEC8E2573B7C7CA87A0E065B38D9039480362D5B3D45D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 34d84daeb7297dd36361b8ad314ad22a8efb23d618ed99c83b3f47e17cf0af86
MD5 7470720693ea01820281bea67c34dd0b
SHA1 36f7a42c52fdacda392e6489f669aa7a5fbb8e46
SHA512 4bfbffbacd7ac3154d148afa9c2a19ee199bcc9bea071bb0fc1002c5582a6ab99325a292679e5670dde9922b70de21c8a20d761e6a17c793bd5a213c843602b0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 efc579936deeefcc1e45edab91117e1f156ba581cb9e528337b2acb719db7020
MD5 0af0b1dafe8dfe9d0b82f4f3492c3175
SHA1 a21d4679eb38035065a5535d232437f5f6abe87a
SHA512 43c3528525bdaebf3fe93b8beb4c86fb8ccf98a82f52920bec5281365ac5241d825ffe7ab9079f30778349ff63bc8c87b052bf8ff0e3394a456b38ca083cfe03
TLSH
T1F5D01212B6010534D0503173200361480B00C10FC0064000E83CC95E2A484701A0E481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 1KB
SHA256 b931ca9c231ada01b87db645c0a61629d92250fa450800f99c8d81c00edc6cc2
MD5 63fc93c863acce7730ec7813ac1d4a20
SHA1 baf17c43a331076b2fa8aa72f2198cc19be8d996
SHA512 58f23afe0f30b454ace9545fe442219e9358f2e9fa9c96c05e566e583504f2ae18a2130c3579ee65e939a882f4c39f87a7213011bef25635b29d49480647d5ae
TLSH
T1F43187B3D8A07F371CE32586B1422E533F719125C5654F0455ED0B1A42DB29C922AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 3KB
SHA256 a961d4370f45a2501bbc677d7cf759a98be9f129eae2007f272df5b1eaa19aba
MD5 a9bf888a7083a844f698ab3c39106e53
SHA1 e69fc7cff93bd80a178cbcef39ff68e9227e96ce
SHA512 21199ee516440dc32421c28aef53c3ba2bac99c6e6f1751b321d27f42a385e67dd74caf286bc152f41f2603d0c161c83959cd4e2eb3b0a6cfd0a15bca37f0abb
TLSH
T1FC71A7366964B9374DF3AA45B9862F12B7A59223D5D53FA4C9EC0F0E01CB3981352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 2KB
SHA256 c24ce0cbfe71f2a53b8a232ff8b0dd41b5129f4b9d359decce916f3912c0af61
MD5 267c2935b84718409a4adea30c265d76
SHA1 5e0d3d970d7e4bfea9ec6acd683d9081484c3b3a
SHA512 e1a67461a5d1170148d67f00ead7d7003592b4bfd357c13688687ee9cd878029f5c976d4843e373aabeb799555f6acada55e6aa0810861f72b88c57ae2f990aa
TLSH
T16651C7737C54BB3749E35A44B9463F13AB36A2619A661F605AED0B0D01CF25C2316C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
Size 16KB
SHA256 a016f27366e583bb7249cfcbd3e81e448dba882d5581a30eb50e0096d260b7c2
MD5 0f330f254cac62456fe1d4bec14bb9ff
SHA1 be86e6fbb0e97c11a5180336375b53fa2abd3244
SHA512 5bed77499aeab2a3d3960b0c7cabd5c487614b00468a4337ea57f4dcc7a4f917b69412b61b83d63c7b143a2b8bbee9808d16fbdaaac74c500797ec29318034ba
SSDEEP 384:zah+aQikB+z/xvxjg/qhEwNbqXuE+h0nwuL2U09zR:T/UxvxjgC+inW2U0FR
TLSH
T16F728E3B64797E2358F3F9057A5D0B4BDBB595A284816EB84EED1F0E02CB3D80346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59db91.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe59db91.TMP
Size 1KB
SHA256 2597a5ccca2669e657fa6c194efb9de1fa511b0db4a7cd7809aae13554a0aa6b
MD5 5d47d31457879c73e96a143050bc435c
SHA1 5824866f20c636699664ead821c49472cad439f0
SHA512 d230a9dd66962c49dc7df21be687f40d1d8dab2223f039ea76165852a270f59a722f990e8b6a1c0ba6e1f090b5c7c30691ffb7410d08f9005db2a8f13a6ebcd5
TLSH
T15E219573C8A07B7719E32881F2023E433F61912585644F0854ED0B0A02CF69C832BC33
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 4645036f6d9d5c9d8b7eaeb4681258fe26d1699b28fe1cb44d6524eb5d551075
MD5 97f08bcb1d4e16d95d0591336563e71a
SHA1 d18b30e5c717738310af51aa27f67800fba361ed
SHA512 cdfef9173db4cba6ed57f398b77c6d0a3ca455384ee1b3377eb15b7b40cb4642e85e05901760aa2093afc3bf70b05370d5f58aaf21f6cd4e5b146f0d325052c7
TLSH
T10F312500A7E52255F0A34936FC7FA701DB61FC01AF5AD64F018C914C5DA4604A97BBBF
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 df63c6877ffc47ba9712d775544ea7a354e4f1fc0e9a720a8329f023537eaddd
MD5 5b086ec2c6c3bed1bdb03470e1d5201b
SHA1 9996ba39b56cbc5050205263a4ff3f617ec1f9ee
SHA512 fdc09b665d9eb0880b20bf78e3a4a19cdeb6d90f1804399bdf51b7b988f41c36b3868e598b09124a70679479437ca4959f000f032edcd762fa3dff3c494824b9
TLSH
T13C712200A7F62256F0A25936FCBFA701DB61BC02AF16D68F018C614D5CA1204A97F77F
MD5 SHA1 SHA512 TLSH

Submit Download

WRD.dll

Path C:\Users\Admin\Documents\jjsploit\WRD.dll
Size 2.3MB
SHA256 ff8ba075e8ec76ba408233210477d8f753cde89eb040366b547ed7dbcc57e709
MD5 22d6ae9859d3d8393183fd2ad9593bff
SHA1 ac6c6df5aa0c537ceb4579e33d5401235f3a76ff
SHA512 f9f6e99482bfa39e9c3858938ae7684cc7be11be58def47db3a41cce0f1daf7596b6a791afcf5ea135f716adaa48c92626c8f65ef327eb40409986a58750f74f
SSDEEP 49152:Y8o8RjSaYpSRV2S8f74TO52sMrTyjTjeCW:Vl0M+iyjTjq
TLSH
T198B59F17F65900E8C067D1F8CA5B9A13EBB27C594324A7F712E096652F23BE18E7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\Documents\jjsploit\libcrypto-3-x64.dll
Size 4.5MB
SHA256 03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
MD5 a9c1f7ca15c65c139bc9d4bf57df2e1e
SHA1 1b1377139a6b289d43a6b1161cd1089ffc817cf9
SHA512 97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
SSDEEP 98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC
TLSH
T112269DA9A5BC0056E86A91BCC3876227D371B51657F057CF2E688AF90F23FD1227B740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\Documents\jjsploit\libssl-3-x64.dll
Size 802KB
SHA256 0bda7daeb4040c722b8c287dfd2307c9b8228576db1dbbbaac901c35cc8dc62b
MD5 51b0d5f42a82f6fa8739b403e9b8b81c
SHA1 75968c157628bb7aca9b5f2331f7a0c9a1d28865
SHA512 94fba90ad7bcf190079089dcc3af97c598c016eb359fe4d2ea439b5fbcd4a5489ab4422652223926aae64002beef1368d5b95874f68a2e5bc4971b4f9604d814
SSDEEP 12288:Mzjte0Fevo3VS1npHEDHLqjRmqWSTzt7opiTdEVB3S:M9e5o3VVZVSPtopwdEVB3S
TLSH
T189053B69BBB8059CD876C13986934213E6F6B4563370EBDB0B648A790F23BD4273E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 778059.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 778059.crdownload
Size 6.0MB
SHA256 d515c7b0c66bb3bf2e6fb9019df3c13eb771cda096e2d8fe2a6b8269c076c94d
MD5 875d9315b3184acf5929d9d541cf7433
SHA1 6a4a8a413e99417e8021c0d1d6c6163f23e4351e
SHA512 1797e38730fc54a6d25d99b8453b5ba4964f7b0763fa24d8413da564b29f02e97d955aa80863bcd6855e1d167cd5490335bf86a4886d2288d48da9e75198563b
SSDEEP 196608:VhWnqAygY6CuG/B3A7eT9Wk/ezCl1PAz:bIy99Tp3CeT9Wwezc1i
TLSH
T15F563397FF9488B1C8120EB4147E97F14A39BC249A669A833594723DCEF26E04F75CD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 95c503a93ca51aba75f06f3418288f6e81c93559e4e8bda91acb4d39442a7a04
MD5 40f47cbdcbb259b94abb2c9ac77cc668
SHA1 d772030e6aecc753f6b7313f40029dbc57b1f55e
SHA512 beaa6c07e1bfa0ca346db154374b78940e220034ec53c290dd4487a5d288044de81cfe97aa17130602ef15ce9339348bd6922272a79da725cd844a163e690248
SSDEEP 24576:4u8m+1zmdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:d
TLSH
T18847F52437F92510E7F39E3DACF06A2349397D9B9C199E8D05811F4E0921BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{02664227-d336-40d7-96b9-059339fae153}_OnDiskSnapshotProp

Path \??\Volume{6e0928ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{02664227-d336-40d7-96b9-059339fae153}_OnDiskSnapshotProp
Size 6KB
SHA256 782bd95b36fbba6ee80d9a672727d1f6c870410d9b8f9681fae1e3761813c689
MD5 f809118c9a9de0aa60c52dbaef0856b5
SHA1 27241d70f1f6cbc003044d1cde22e6faba9ed11c
SHA512 dc92503846fcd62659effa9041d4e0e2bb3892a8f46e315197cf4e9a3dfc39eb056a1f3b93ac1d96a97a5327f2cebc8224b21f1bb4042d18841cbbc29d28ca86
SSDEEP 96:FC7SeQefFUvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:gRQkgb++ZVmN
TLSH
T100D19A085AF54711E2B3AB3228F14557A477B911FF33CB8E0198238E6671A14F936F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3864-72-0x0000000006960000-0x0000000006970000-memory.dmp

Download

memory/3864-63-0x0000000006960000-0x0000000006970000-memory.dmp

Download

memory/3864-64-0x0000000006960000-0x0000000006970000-memory.dmp

Download

memory/3864-65-0x0000000006960000-0x0000000006970000-memory.dmp

Download

memory/3864-71-0x0000000007310000-0x0000000007320000-memory.dmp

Download

memory/3864-62-0x0000000006960000-0x0000000006970000-memory.dmp

Download

memory/3864-73-0x0000000006960000-0x0000000006970000-memory.dmp

Download

memory/3864-68-0x0000000006960000-0x0000000006970000-memory.dmp

Download

memory/3864-70-0x0000000007310000-0x0000000007320000-memory.dmp

Download

memory/3864-74-0x0000000007310000-0x0000000007320000-memory.dmp

Download

memory/3864-69-0x0000000006960000-0x0000000006970000-memory.dmp

Download

memory/4108-678-0x00007FFA4B3F0000-0x00007FFA4B3F1000-memory.dmp

Download

memory/4108-896-0x000001C024C20000-0x000001C024C50000-memory.dmp

Download

memory/4108-679-0x00007FFA4C2A0000-0x00007FFA4C2A1000-memory.dmp

Download

memory/5756-670-0x00007FFA4C040000-0x00007FFA4C041000-memory.dmp

Download

memory/5852-686-0x00007FFA4C040000-0x00007FFA4C041000-memory.dmp

Download