Analysis
- user interaction
yes - max time kernel
53s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 16:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjsploit_8.19.2_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target jjsploit_8.19.2_x64_en-US.msi
- Size 6.1MB
- Sample260822-vdpvcs1xes
- SHA256 f373926cf70322421d1673a5222d354b7c322a33de890d8d4c2e0606a5c81073
- MD5 23467abb81313608f4acc6ff6a58615d
- SHA1 e659b35100a18da608b1e3afe4e9dfea33a5beb5
- SHA512 9961cef5182aaabff551a207b689e6e0f55d95166680e6afa4acbdedb06d3c64ccdc59ebb878b00f53a3e75c6fce58fcf271e984a5817762bf7ec67b89bac412
- SSDEEP 98304:1qDDClcUm1sfVVifYQ86KNAXNhNqn4gmPIdOEg17w7IeF+EDUdEkXimIKhHVC4D8:IGeUSsfwOVAXNhCmTEmA4EIRHVC4
- TLSH T107563317BFC0A627D42ADE7518379B21562DBC540AA17943A3CA724CECF22C18F7A5D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1004 jjsploit.exe - Loads dropped DLL 6 IoCs
pid Process 2384 MsiExec.exe 1004 jjsploit.exe 1004 jjsploit.exe 1004 jjsploit.exe 1004 jjsploit.exe 1004 jjsploit.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jjsploit.exe - Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 110 raw.githubusercontent.com 111 raw.githubusercontent.com 117 raw.githubusercontent.com 119 raw.githubusercontent.com 123 raw.githubusercontent.com 129 raw.githubusercontent.com - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\jjsploit\resources\luascripts\general\god.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua msiexec.exe File created C:\Program Files\jjsploit\Uninstall jjsploit.lnk msiexec.exe File created C:\Program Files\jjsploit\jjsploit.exe msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\fly.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{036D452E-DCE3-4D13-BE70-42109F70B6E1} msiexec.exe File opened for modification C:\Windows\Installer\{036D452E-DCE3-4D13-BE70-42109F70B6E1}\ProductIcon msiexec.exe File created C:\Windows\Installer\e58a5b3.msi msiexec.exe File opened for modification C:\Windows\Installer\e58a5b1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA6DA.tmp msiexec.exe File created C:\Windows\Installer\{036D452E-DCE3-4D13-BE70-42109F70B6E1}\ProductIcon msiexec.exe File created C:\Windows\Installer\e58a5b1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral1/files/0x00070000000246a5-324.dat embeds_openssl - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4428 msiexec.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 jjsploit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 jjsploit.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318911981494389" msedgewebview2.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E254D6303ECD31D4EB072401F9076B1E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E254D6303ECD31D4EB072401F9076B1E\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\ProductName = "jjsploit" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\Version = "135462914" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\03D213AD8BB2E544BA57872C4637158D\E254D6303ECD31D4EB072401F9076B1E msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E254D6303ECD31D4EB072401F9076B1E\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\PackageCode = "EF5EBEB2458B6714AB200D58DCBD2BF1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\ProductIcon = "C:\\Windows\\Installer\\{036D452E-DCE3-4D13-BE70-42109F70B6E1}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\03D213AD8BB2E544BA57872C4637158D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E254D6303ECD31D4EB072401F9076B1E\External msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E254D6303ECD31D4EB072401F9076B1E\ShortcutsFeature = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E254D6303ECD31D4EB072401F9076B1E\SourceList\PackageName = "jjsploit_8.19.2_x64_en-US.msi" msiexec.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 jjsploit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 jjsploit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 jjsploit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 jjsploit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 jjsploit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 jjsploit.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1244 msiexec.exe 1244 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 648 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4428 msiexec.exe Token: SeIncreaseQuotaPrivilege 4428 msiexec.exe Token: SeSecurityPrivilege 1244 msiexec.exe Token: SeCreateTokenPrivilege 4428 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4428 msiexec.exe Token: SeLockMemoryPrivilege 4428 msiexec.exe Token: SeIncreaseQuotaPrivilege 4428 msiexec.exe Token: SeMachineAccountPrivilege 4428 msiexec.exe Token: SeTcbPrivilege 4428 msiexec.exe Token: SeSecurityPrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeLoadDriverPrivilege 4428 msiexec.exe Token: SeSystemProfilePrivilege 4428 msiexec.exe Token: SeSystemtimePrivilege 4428 msiexec.exe Token: SeProfSingleProcessPrivilege 4428 msiexec.exe Token: SeIncBasePriorityPrivilege 4428 msiexec.exe Token: SeCreatePagefilePrivilege 4428 msiexec.exe Token: SeCreatePermanentPrivilege 4428 msiexec.exe Token: SeBackupPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeShutdownPrivilege 4428 msiexec.exe Token: SeDebugPrivilege 4428 msiexec.exe Token: SeAuditPrivilege 4428 msiexec.exe Token: SeSystemEnvironmentPrivilege 4428 msiexec.exe Token: SeChangeNotifyPrivilege 4428 msiexec.exe Token: SeRemoteShutdownPrivilege 4428 msiexec.exe Token: SeUndockPrivilege 4428 msiexec.exe Token: SeSyncAgentPrivilege 4428 msiexec.exe Token: SeEnableDelegationPrivilege 4428 msiexec.exe Token: SeManageVolumePrivilege 4428 msiexec.exe Token: SeImpersonatePrivilege 4428 msiexec.exe Token: SeCreateGlobalPrivilege 4428 msiexec.exe Token: SeCreateTokenPrivilege 4428 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4428 msiexec.exe Token: SeLockMemoryPrivilege 4428 msiexec.exe Token: SeIncreaseQuotaPrivilege 4428 msiexec.exe Token: SeMachineAccountPrivilege 4428 msiexec.exe Token: SeTcbPrivilege 4428 msiexec.exe Token: SeSecurityPrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeLoadDriverPrivilege 4428 msiexec.exe Token: SeSystemProfilePrivilege 4428 msiexec.exe Token: SeSystemtimePrivilege 4428 msiexec.exe Token: SeProfSingleProcessPrivilege 4428 msiexec.exe Token: SeIncBasePriorityPrivilege 4428 msiexec.exe Token: SeCreatePagefilePrivilege 4428 msiexec.exe Token: SeCreatePermanentPrivilege 4428 msiexec.exe Token: SeBackupPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeShutdownPrivilege 4428 msiexec.exe Token: SeDebugPrivilege 4428 msiexec.exe Token: SeAuditPrivilege 4428 msiexec.exe Token: SeSystemEnvironmentPrivilege 4428 msiexec.exe Token: SeChangeNotifyPrivilege 4428 msiexec.exe Token: SeRemoteShutdownPrivilege 4428 msiexec.exe Token: SeUndockPrivilege 4428 msiexec.exe Token: SeSyncAgentPrivilege 4428 msiexec.exe Token: SeEnableDelegationPrivilege 4428 msiexec.exe Token: SeManageVolumePrivilege 4428 msiexec.exe Token: SeImpersonatePrivilege 4428 msiexec.exe Token: SeCreateGlobalPrivilege 4428 msiexec.exe Token: SeCreateTokenPrivilege 4428 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4428 msiexec.exe Token: SeLockMemoryPrivilege 4428 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4428 msiexec.exe 1004 jjsploit.exe 4428 msiexec.exe 1004 jjsploit.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2384 1244 msiexec.exe 92 PID 1244 wrote to memory of 3124 1244 msiexec.exe 101 PID 4428 wrote to memory of 1004 4428 msiexec.exe 108 PID 1004 wrote to memory of 648 1004 jjsploit.exe 109 PID 648 wrote to memory of 3432 648 msedgewebview2.exe 110 PID 648 wrote to memory of 4548 648 msedgewebview2.exe 111 PID 648 wrote to memory of 4548 648 msedgewebview2.exe 111 PID 648 wrote to memory of 4548 648 msedgewebview2.exe 111 PID 648 wrote to memory of 2288 648 msedgewebview2.exe 112 PID 648 wrote to memory of 3112 648 msedgewebview2.exe 113 PID 648 wrote to memory of 3112 648 msedgewebview2.exe 113 PID 648 wrote to memory of 5440 648 msedgewebview2.exe 115 PID 648 wrote to memory of 5440 648 msedgewebview2.exe 115 PID 648 wrote to memory of 5440 648 msedgewebview2.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.19.2_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Program Files\jjsploit\jjsploit.exe"C:\Program Files\jjsploit\jjsploit.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.2 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1004.652.89529211306059168113⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa5d4eb078,0x7ffa5d4eb084,0x7ffa5d4eb0904⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,12696786720482961827,11623511718182490395,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:24⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,12696786720482961827,11623511718182490395,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:34⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1736,i,12696786720482961827,11623511718182490395,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:84⤵PID:3112
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3664,i,12696786720482961827,11623511718182490395,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14⤵PID:5440
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7A2448817ADCDB1D1BB3AF32215C7BA3 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3124
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4656
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58a5b2.rbs
- Size 21KB
- SHA256 7132541163e765e5745e894d6cd4ec42bfabc63e864e7a534d4035fd2971aa67
- MD5 49fca94d256f10e5660ed83167b5510c
- SHA1 149b70a1fd031d0830ef260314bf6d92ca812276
- SHA512 997ce83431eecefbb68e291a2450cfaa417a63e09c45ad67cdaed6f696944cde572981be3bc823cb5ac4b8b07241008846650f26ad093163e9a8615ae9ed9c41
- SSDEEP 384:G7rCuAoTrx6rCvegKZMf1kk7yWkTkt8t8t8t0tstststststststitztztwIcIEg:G7rCuAoTrx6rCvegKZMf1kk7yWkTkt8U
- TLSH T1DFA203429F10C2A3F66B0674EFA757143B72C4ADA348421B43CC9239898E7D53FB9A5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\jjsploit\jjsploit.exe
- Size 17.7MB
- SHA256 b4ef809177c10d2a09ed3b6fd27f4ce9a887af8bd139d6c8bc3accb1823e3dfb
- MD5 bc03398126baeb580b1ef9a3f3c84fee
- SHA1 df165f05aa057f5f7863168b695f88047051b12c
- SHA512 2f5244b42c719d36b1f04e0ff120ef43f2669d0bd73a2e770002bcabcdfd0207e32a90f3205ecb2ffe392bcd26810081cd6f4e56a10fff38b5bb8ff9bf7c9594
- SSDEEP 196608:qsSirkpsP805nJCzwTZ2f7WMNCNTh7ru:gir5PjCzwTZ2DpCNd7
- TLSH T1AF17F821BA9B995CD05FC474834B8A724A7530CB0B35B9FF488596382F6EBF41F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
- Size 1KB
- SHA256 3f71f5aba0b32c6f8965446923d3ad58bff735cfa9fd9eee824fb495b034b828
- MD5 646282b115f84b2a6edfa35495cec9fd
- SHA1 ba56cf69d2174051f9f7a119452a1b7e99f3795e
- SHA512 60a0c5fcf159d53f389a6e1b077a1a2dd2515d02c15f587169f0a8d2d85acf9963f3074d2007812f7945f38bec8c63f749c7f5c7673fdc0e13a7485c55fbb601
- TLSH T1C641125017E40726E3B14A392DE2971285BAF823DDA49F6A4194828D0958A00E57CF7F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe58a94b.TMP
- Size 1KB
- SHA256 73c7306fc56d40d015da4ad033662d69c98eb868113e284f21cc6735eb14f39f
- MD5 91b62e1b51bb8f4db9ec831052244b59
- SHA1 3ccc950255099446ed57d03580db6adcab558852
- SHA512 e93c6a1fa5003ef944234cbd496e926a3cf628143d00a56c0e3c747b3961a40f3c4e5c4bd4c61aa10b1362eba169ecd4aab0a3ba0ab1783e6c5f9222aeddf966
- TLSH T1C541FE6016E40726E3B14A783ED29B5295BBF822DEF49F674194428D0958A00E978F3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6B96.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 c45f325b15db5ab0558a924924b325e14f6ddab7e73ef3896583cd0cfc46075a
- MD5 51d51f91e7a53913d7dc6aafcd4c273e
- SHA1 14f2404a91e655842f852eec1c274975d184cdf7
- SHA512 15cc99ba0f72cae8fc8e37f3aca88bdb71f1d87014508d9ccf28ea9d8122d15865973843394b7b5f36e3335e0d7e72320816c9a06f12d568693996f27848f8b3
- TLSH T185D0121236110574C81231330542E5490C00C13B40054004543CC51E1B484A40D27482
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 ec73d87bbdbc3f712800053849b484962df083ab180a36dcc4e104b02b6e3cd2
- MD5 57fcfe422a612f12bad012f45b987463
- SHA1 468278a23f471c2cd617fdd3c0c1fe3046ea0476
- SHA512 a070c1ab2955799d8ab99a8867ed129d28327df83dbbac0d34e9341d1f1b22524824eb35550b1df778d69ee519487fcc1981cdb7cadcfa8a1eac431aa063ca80
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnGraphiteCache\index
- Size 256KB
- SHA256 669b9686ec4d0e6fd9548d84a74691387d2077543c20224d442eb6cb1bbe91b4
- MD5 56e8ab6db52774d4e8a33c2fdf80dbf7
- SHA1 c4820509284e8ad9ad1a9a9d28f00589aceeb6f9
- SHA512 08f3317f697a0ebe95f981c297a68d0ca85375740059c8e9b5a54b249977f3ce3ae4dac7da043d553489f9c07e9f1e589acf7bcead254bb7530d787380f368b6
- SSDEEP 3:LstlNllkll/lcY6J/:LsX3lEtcY6x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 1KB
- SHA256 2a6f21d3a6d68f334710f1bc1b0d591b8bfc81dc1a6d42aab3320e48ae164337
- MD5 86cff7c15721c90057d6366855fba5c0
- SHA1 f38537f7b2f7a0941bb8ac333dcc3a4a2055e3a1
- SHA512 44f72c099edc46de03205f484c90a12a8a337e101705361d403b9d3d691e045f9d658433d5317daee600b8ae876d687e07fe2bae3384023f0185470beb57a155
- TLSH T1DC31B5B2A4D82F3359816541B2563A936F32206ED1114F0869CE4B1C13EB2ECA03BC33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 2KB
- SHA256 30ac54da5723eb88fc6157bf554ff9380be3941548e83c616e6a482a55619bd4
- MD5 dac66029446e4257a2b963f664d65a01
- SHA1 0ecd030de748f8554de5ec493cf1c35fbe1c8e20
- SHA512 23497a8daffa810a9a91b4c3e151bb7d8f3417f3cda8c6a7181c1d75f16634210566d2e5a9f8f8d2cedaffed00414905aff7e0af4e5d9171cebe2412c26ea366
- TLSH T19251D7B37848AA374AE76904B94A3F139F365069E1621F549DCE0B0C02DB6DC3302C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 16KB
- SHA256 7263f01de76cf1dcb7e5178cc74d6fbaae79178526cb7881eb517d42591db1d5
- MD5 9505531009adc91fa4e6c41a8070735c
- SHA1 93a28ecef9835d6d4959f588468de83d65ba126a
- SHA512 af50b265cf9d78c575c69a8dac93a2d636dbc8fa79543e1f10a5e05a506de4b23f174593cfbcfcc86a45a2b3a85663e822b3690a7418ea922d7b24122137d53d
- SSDEEP 384:zda+aQikB+z/xvxjg/qhEdNb/leQ8vlKz3i9zL:f/UxvxjgC+Z2lKyFL
- TLSH T10B729D2765783E2755F7F9057A1D078BDBB994B290C26FA84DEE5F0E02C73E81302916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 3KB
- SHA256 3e78f48675bfa230bb25476022dd53ed7c8cbaa2153071a4e678e88962b5b54e
- MD5 4ab296a71c69eca0dedf81269df946e8
- SHA1 99e50d3f9fd6b0da1141e31d533792be99c55624
- SHA512 97fcbb24839feaf02e7715943ddcdf6b85e1fb71bd19d1b67153381963f0d8d4ff76bd0f02d7f20e345e3c367aa22fde15e03766fa3dc4f5614e2eb87547ffe0
- TLSH T17571A87264A8A9374EE7AD04B9863B12B7655137E1952F58DDDD0F0C02DB3D82342C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe58c781.TMP
- Size 1KB
- SHA256 b567e017f52d4a8bd5170fdac69e5a288a9611bbfa6fa30e6bce0e1a938098d8
- MD5 dfd50c35f37baa1b460a04b9c14596b7
- SHA1 ca4216e6687cc946346a4a8b37772e85a964b11f
- SHA512 89ceecc2d5d8dab69a37d7c401a4d567ba79a647ea4805f1a9c6c5b7bf85aafe76afddb7b8f329c402cc8aac75cb423acbd4ddbd509043be98a6993a20a45833
- TLSH T10A216573D4D87A3759515845F25676C72F61606ED1144F0C98CE561C13DB6EC913BC33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\jjsploit\D3DX9_43.dll
- Size 2.3MB
- SHA256 84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
- MD5 7160fc226391c0b50c85571fa1a546e5
- SHA1 2bf450850a522a09e8d1ce0f1e443d86d934f4ad
- SHA512 dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
- SSDEEP 49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW
- TLSH T17CB5486172F4C1E4E32A9039B597B20BFAB1304907188BC793E04D9A5FE6BD46CFA355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\jjsploit\WRD.dll
- Size 2.3MB
- SHA256 fa4b8680341c7ee129951a8b2015a6610f97b4d4019017b93fa00704a59f0452
- MD5 e7a38414b0923336c8ad736032af43e0
- SHA1 1ff204ce68e30ef15472eedf5797b8f532932fac
- SHA512 9477c2001fe26711d708fb83d0d8db9ce03fb96470605ac11afc979fbc9cd2be67f5f86123a521cf2521b284fd208cb54e52eb26feab30893f734f5a8e32d6e9
- SSDEEP 49152:i+OPjjLOHYYbRr/Am5MxtmJ42obweojTjmuX:AzfMrW2jTjmu
- TLSH T1F7B59F57B65900E8C0A7D1F8CA5B9603FBB278194324A7FB12E096652F23BE54F7E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\jjsploit\libcrypto-3-x64.dll
- Size 4.5MB
- SHA256 03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
- MD5 a9c1f7ca15c65c139bc9d4bf57df2e1e
- SHA1 1b1377139a6b289d43a6b1161cd1089ffc817cf9
- SHA512 97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
- SSDEEP 98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC
- TLSH T112269DA9A5BC0056E86A91BCC3876227D371B51657F057CF2E688AF90F23FD1227B740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\jjsploit\libssl-3-x64.dll
- Size 802KB
- SHA256 0bda7daeb4040c722b8c287dfd2307c9b8228576db1dbbbaac901c35cc8dc62b
- MD5 51b0d5f42a82f6fa8739b403e9b8b81c
- SHA1 75968c157628bb7aca9b5f2331f7a0c9a1d28865
- SHA512 94fba90ad7bcf190079089dcc3af97c598c016eb359fe4d2ea439b5fbcd4a5489ab4422652223926aae64002beef1368d5b95874f68a2e5bc4971b4f9604d814
- SSDEEP 12288:Mzjte0Fevo3VS1npHEDHLqjRmqWSTzt7opiTdEVB3S:M9e5o3VVZVSPtopwdEVB3S
- TLSH T189053B69BBB8059CD876C13986934213E6F6B4563370EBDB0B648A790F23BD4273E344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58a5b1.msi
- Size 6.1MB
- SHA256 f373926cf70322421d1673a5222d354b7c322a33de890d8d4c2e0606a5c81073
- MD5 23467abb81313608f4acc6ff6a58615d
- SHA1 e659b35100a18da608b1e3afe4e9dfea33a5beb5
- SHA512 9961cef5182aaabff551a207b689e6e0f55d95166680e6afa4acbdedb06d3c64ccdc59ebb878b00f53a3e75c6fce58fcf271e984a5817762bf7ec67b89bac412
- SSDEEP 98304:1qDDClcUm1sfVVifYQ86KNAXNhNqn4gmPIdOEg17w7IeF+EDUdEkXimIKhHVC4D8:IGeUSsfwOVAXNhCmTEmA4EIRHVC4
- TLSH T107563317BFC0A627D42ADE7518379B21562DBC540AA17943A3CA724CECF22C18F7A5D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 8627a51dbae8cd780e5ba79ae35e870bcd7cd09d6f655dc4cfef75adbe626418
- MD5 afac981116f9a975813045ea8bf5b305
- SHA1 04eaf412f9952bf09d27d0d46dd5eb8424a39394
- SHA512 b17288d0642958ee4465908ab539cc7db1f78c430d0d3c721b1525d25e7a6f08045a1e3007800c52ef021707671751c61445ea63ff976ef3299ec783ebd021b1
- SSDEEP 24576:su8m+1zSdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:F
- TLSH T11447D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{42acf4fb-905b-4919-8455-897efd6f9235}_OnDiskSnapshotProp
- Size 6KB
- SHA256 2c9d3f265ee9579049e13aef161bfc62d5530c4adcf6bacbac208721c100ca09
- MD5 dec919175a6b49683c9ff6e5991bda98
- SHA1 80dc08f6d7ae9a6fb393ebc6078c61a3ec371292
- SHA512 9a49ad00e984360e31a36e6f3e84317054ac534f13d638b8d22810b7d408adf1095adbdf28ac153022e904c9050ce085bcb12ec13f7875f8fc6ccf8ce8bc42f4
- SSDEEP 96:FJnQeVavc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:rnQvb++ZVmN
- TLSH T1E3D188185AE54711E2F3AB7228F14557A477B911EF33CB8E0198238E6670A10F876F6F
- MD5 SHA1 SHA512 SSDEEP TLSH