Analysis
- user interaction
yes - max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 02:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjsploit_8.18.9_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
jjsploit_8.18.9_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target jjsploit_8.18.9_x64_en-US.msi
- Size 6.1MB
- Sample260820-dfnxeabb27
- SHA256 85bd7c04a0d0fe935e405b4a912f99c90a4af8057d249a57e3c5f585de7d1897
- MD5 7693db1cb7d7689b617f8e44542ff874
- SHA1 920c5fde620e7b37c1aa709b899cc56fc8efe41b
- SHA512 143221225fa6648466f16047e1aa43f7511b09113025265e5418eb6a7d69874447b3a01a5e2cbb9b49beb9fa978f0e80a4fce93b0390f98c1135cf91cdd892d4
- SSDEEP 196608:U4LsjzUq3/VPb7bi655ZYPUg7Vs7jAEx9vqUQAI:UEsMq3/VH/55ZYcg7G3AETvUAI
- TLSH T1B55633537D40AD32C4968D7A543ECB6ADB78BCA01A91AD173268731ECCF22D06D786D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4712 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\god.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\fly.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua msiexec.exe File created C:\Program Files\jjsploit\Uninstall jjsploit.lnk msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua msiexec.exe File created C:\Program Files\jjsploit\jjsploit.exe msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59cdb6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF7C6799ADD10E03E4.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFBA7AF64821EEDF97.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID334.tmp msiexec.exe File created C:\Windows\Installer\e59cdb8.msi msiexec.exe File created C:\Windows\SystemTemp\~DF2FCBCDBF576350C8.TMP msiexec.exe File created C:\Windows\Installer\e59cdb6.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{B0A7DDA5-1A44-46F9-A747-29B5B200830E} msiexec.exe File created C:\Windows\Installer\{B0A7DDA5-1A44-46F9-A747-29B5B200830E}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{B0A7DDA5-1A44-46F9-A747-29B5B200830E}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DFE6B67B4638E05E7E.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3036 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000059e6eec40365f0360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380159e6eec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410159e6eec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e359e6eec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e659e6eec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\PackageCode = "A1407C0F842ECFE46AEAB893CE415555" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\ProductIcon = "C:\\Windows\\Installer\\{B0A7DDA5-1A44-46F9-A747-29B5B200830E}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\03D213AD8BB2E544BA57872C4637158D\5ADD7A0B44A19F647A74925B2B0038E0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\PackageName = "jjsploit_8.18.9_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\ProductName = "jjsploit" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\Version = "135397385" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\03D213AD8BB2E544BA57872C4637158D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0\External msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5ADD7A0B44A19F647A74925B2B0038E0\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5ADD7A0B44A19F647A74925B2B0038E0\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4500 msiexec.exe 4500 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3036 msiexec.exe Token: SeIncreaseQuotaPrivilege 3036 msiexec.exe Token: SeSecurityPrivilege 4500 msiexec.exe Token: SeCreateTokenPrivilege 3036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3036 msiexec.exe Token: SeLockMemoryPrivilege 3036 msiexec.exe Token: SeIncreaseQuotaPrivilege 3036 msiexec.exe Token: SeMachineAccountPrivilege 3036 msiexec.exe Token: SeTcbPrivilege 3036 msiexec.exe Token: SeSecurityPrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeLoadDriverPrivilege 3036 msiexec.exe Token: SeSystemProfilePrivilege 3036 msiexec.exe Token: SeSystemtimePrivilege 3036 msiexec.exe Token: SeProfSingleProcessPrivilege 3036 msiexec.exe Token: SeIncBasePriorityPrivilege 3036 msiexec.exe Token: SeCreatePagefilePrivilege 3036 msiexec.exe Token: SeCreatePermanentPrivilege 3036 msiexec.exe Token: SeBackupPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeShutdownPrivilege 3036 msiexec.exe Token: SeDebugPrivilege 3036 msiexec.exe Token: SeAuditPrivilege 3036 msiexec.exe Token: SeSystemEnvironmentPrivilege 3036 msiexec.exe Token: SeChangeNotifyPrivilege 3036 msiexec.exe Token: SeRemoteShutdownPrivilege 3036 msiexec.exe Token: SeUndockPrivilege 3036 msiexec.exe Token: SeSyncAgentPrivilege 3036 msiexec.exe Token: SeEnableDelegationPrivilege 3036 msiexec.exe Token: SeManageVolumePrivilege 3036 msiexec.exe Token: SeImpersonatePrivilege 3036 msiexec.exe Token: SeCreateGlobalPrivilege 3036 msiexec.exe Token: SeCreateTokenPrivilege 3036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3036 msiexec.exe Token: SeLockMemoryPrivilege 3036 msiexec.exe Token: SeIncreaseQuotaPrivilege 3036 msiexec.exe Token: SeMachineAccountPrivilege 3036 msiexec.exe Token: SeTcbPrivilege 3036 msiexec.exe Token: SeSecurityPrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeLoadDriverPrivilege 3036 msiexec.exe Token: SeSystemProfilePrivilege 3036 msiexec.exe Token: SeSystemtimePrivilege 3036 msiexec.exe Token: SeProfSingleProcessPrivilege 3036 msiexec.exe Token: SeIncBasePriorityPrivilege 3036 msiexec.exe Token: SeCreatePagefilePrivilege 3036 msiexec.exe Token: SeCreatePermanentPrivilege 3036 msiexec.exe Token: SeBackupPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeShutdownPrivilege 3036 msiexec.exe Token: SeDebugPrivilege 3036 msiexec.exe Token: SeAuditPrivilege 3036 msiexec.exe Token: SeSystemEnvironmentPrivilege 3036 msiexec.exe Token: SeChangeNotifyPrivilege 3036 msiexec.exe Token: SeRemoteShutdownPrivilege 3036 msiexec.exe Token: SeUndockPrivilege 3036 msiexec.exe Token: SeSyncAgentPrivilege 3036 msiexec.exe Token: SeEnableDelegationPrivilege 3036 msiexec.exe Token: SeManageVolumePrivilege 3036 msiexec.exe Token: SeImpersonatePrivilege 3036 msiexec.exe Token: SeCreateGlobalPrivilege 3036 msiexec.exe Token: SeCreateTokenPrivilege 3036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3036 msiexec.exe Token: SeLockMemoryPrivilege 3036 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3036 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3036 msiexec.exe 4500 msiexec.exe 4712 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4500 wrote to memory of 4712 4500 msiexec.exe 90 PID 4500 wrote to memory of 1468 4500 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.18.9_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3036
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AEBCA819BB607A4164BC42D664D11D22 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4712
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1468
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4972
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59cdb7.rbs
- Size 20KB
- SHA256 9e766e01d89ac43d3bbab41332ff26a85c53202c0c009cc5062f807cc55ed8df
- MD5 9f13f4da6c70bab1898d5c234f4c36c2
- SHA1 0872da3e81c223987a1fcdd3cfabb5dc27547cdf
- SHA512 f169aa341a3db0263198740f8bc2ffcc614358c5b766ac2205a339ae2c5f9b6d054e582324d2d2cec51c2270a4ae48e95812a6e0d10e3502b7ff70d0bb0b4c92
- SSDEEP 384:vT+avRzKSJaHWqCQJca87rg/1WpCst8t8t8t0tstststststststitztztbBsBtB:7+avRzKSJaHWqCQJca87rW1WpCst8t8i
- TLSH T15AA255415E10C6A2E2A71674EFA757143732C5CE6398624B868C5329CD833D43FB9FAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\jjsploit\jjsploit.exe
- Size 17.7MB
- SHA256 0c070f2230646cf5f9f1b691710aabd5dbbd42294d637c41f96474fab58bca35
- MD5 762a2f8d76cc09e1386c3130cbd29bce
- SHA1 ef444f154a2586649955c014b729062e09820688
- SHA512 4975fa427d1e95bfa9024adbd9f1c559d13920752c0e4db84eebd4248472dd1069406862da86453963654d6cf5b1c8aa3e35f47ba60e27229420cdb8f1812214
- SSDEEP 98304:E/IIxyGdVApJB4MzUrJmyHivajp522OG2ElqHF8JUu6X7LGZt+tqpMbqWj+74X/p:EXdVApJBmHivkoElqKUHpW4X/5FjO6
- TLSH T19017E725BE9B596CD05FC474834B8A724A7430CB0B35A9FF488596382F6EBF41F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
- Size 1KB
- SHA256 0e863708dd6c131a6f437b7426bd5e4362f5c6cfea6e66c8d4c65a5e3a85a48a
- MD5 0b88a115af148533e4c77ccb238dc730
- SHA1 671a5beb2c62b3aaf90054b855b5b3437fa54ac9
- SHA512 4aa924db401bf0153644ed1b701936de6adf3828a491d71f5bc50b1861728a934f62ca5c33d52db263abde7cfc5888489c5c3d4f72e734670d7c46bdc6f66b76
- TLSH T14A41E11063F51726E3B14A3A2EB50323867BFC65B9649E9A8085018D59A4100D5BCF7F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe59d76b.TMP
- Size 1KB
- SHA256 565d5c353ec1c758a0fca7a3b210fff5b268bac050c5db7d2cd62af70ee23267
- MD5 f7dd089d08407e265ad108830f114bdb
- SHA1 14cf192bcb4d06c69f292ea2df0a1fde5a7cd3da
- SHA512 e1efae479aa5474b662ecbd39821a173de7c2994b6f6d7ba2b53407a379122d241d7b6db814a171ccf68e7ff3d46fc4ea05e7477bf971e29c616b5754eaafc89
- TLSH T10941C21027F51716E3F145392EE503238B7BFC6579649F9680C5018D55A4100D5B8F3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI73DE.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59cdb6.msi
- Size 6.1MB
- SHA256 85bd7c04a0d0fe935e405b4a912f99c90a4af8057d249a57e3c5f585de7d1897
- MD5 7693db1cb7d7689b617f8e44542ff874
- SHA1 920c5fde620e7b37c1aa709b899cc56fc8efe41b
- SHA512 143221225fa6648466f16047e1aa43f7511b09113025265e5418eb6a7d69874447b3a01a5e2cbb9b49beb9fa978f0e80a4fce93b0390f98c1135cf91cdd892d4
- SSDEEP 196608:U4LsjzUq3/VPb7bi655ZYPUg7Vs7jAEx9vqUQAI:UEsMq3/VH/55ZYcg7G3AETvUAI
- TLSH T1B55633537D40AD32C4968D7A543ECB6ADB78BCA01A91AD173268731ECCF22D06D786D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 5250c14d5f07b3f5dcc181bf9feaff6becf58195819d519ec36515bf1a604702
- MD5 fb44cdc8bc44f65a55b9013771d82f62
- SHA1 162c259818f9f08470164e192a3dfbfadbce8fc2
- SHA512 d7275626ca1449ca44e7ceb6bd1a21a5558fa668c8fdec24f9de831f75e62c132e98604aa5d2930b22a4d2342b7ccd54d3d4b8235da3646c1ee98a1d445e1c40
- SSDEEP 24576:xFo3DMPydoO/vvTL/ygCCC1wfLeIpblREfUg9fMKU3MaZlTy84x2yrYj2+U:OHg
- TLSH T10E57B22436F92210E7B79F3CA8F06A234D397D5B9D15DE8D05451B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4eee659-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{75a30bdc-88a5-41bf-a7eb-04090b163412}_OnDiskSnapshotProp
- Size 6KB
- SHA256 4a5f4f5f1374e71585cf601de19f8894eff7184c9d368523a958b9096152bcca
- MD5 766329b584c1d742c940b3d51b3f9afa
- SHA1 c4b3c524ac0881c80bfd0149ef030a05403e0a66
- SHA512 6857d8d68de51afe84d2852ff52ef173826acb39a87bdbd4ac968f0d1dd2424ae8dbd6cd35e0cb10307836a63510e9e7a2f873ab2c07be7636efbc5b428cfc35
- SSDEEP 96:Fdheamavc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:LhtVb++uVmN
- TLSH T1A6D188081AF54711E2B3AB7228F18557A877B911EF33CB8E0198238E6671910F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH