Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 05:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jjsploit_8.19.3_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
jjsploit_8.19.3_x64_en-US.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target jjsploit_8.19.3_x64_en-US.msi
- Size 6.1MB
- Sample260823-gn3bjstbkf
- SHA256 f42dcd90b4a3228fffa331b0143cbee0b85a6b3137aca4cddc1231fd00d18765
- MD5 c92d5000b150d8af02b2fc92753aa3dc
- SHA1 cc211ee1e2b0f52974dc774920226ea22c9f5d3f
- SHA512 396084fc342d049590579f5fa824bd0e7079ea10f2f70ab1358bb6852b2bcc58a8440d6b4f21c2f7bce33683ce2090837df6df945c8674818824573fb07749aa
- SSDEEP 196608:vNmzbvEVcL93YfK5agemy7GClDCDhVAzqq3ngHMqrqwIe:ozg8YfKsjLFlDC12zq2ngfrq
- TLSH T1605633577C41DB3AC1265E7A89729BA08F397C141E99A98B6369361EDEF03C04F36CC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2556 jjsploit.exe - Loads dropped DLL 1 IoCs
pid Process 4384 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jjsploit.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\jjsploit\resources\luascripts\general\god.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\walkthrough.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\removewalls.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\noclip.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\tptool.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\beesim\autodig.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\jumpland.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\fly.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\dab.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\criminalesp.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\energizegui.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\animations\levitate.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\walkspeed.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\multidimensionalcharacter.lua msiexec.exe File created C:\Program Files\jjsploit\Uninstall jjsploit.lnk msiexec.exe File created C:\Program Files\jjsploit\jjsploit.exe msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\teleportto.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\chattroll.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\infinitejump.lua msiexec.exe File created C:\Program Files\jjsploit\resources\luascripts\general\aimbot.lua msiexec.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{D84DC9DA-36B4-4382-A053-5943D06D33F2}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DFC6B2CCE602F004A1.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1778549771\metadata.pb msedgewebview2.exe File opened for modification C:\Windows\Installer\e5a0040.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF525F163FD79CA290.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4A5.tmp msiexec.exe File created C:\Windows\Installer\e5a0040.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e5a0042.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1778549771\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1778549771\manifest.fingerprint msedgewebview2.exe File created C:\Windows\Installer\SourceHash{D84DC9DA-36B4-4382-A053-5943D06D33F2} msiexec.exe File created C:\Windows\SystemTemp\~DF91A1E153C6154DBB.TMP msiexec.exe File created C:\Windows\Installer\{D84DC9DA-36B4-4382-A053-5943D06D33F2}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DF7AF38C6A979E7DFA.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5852_1778549771\manifest.json msedgewebview2.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5392 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AD9CD48D4B6328340A3595340DD6332F\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\ProductName = "jjsploit" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\03D213AD8BB2E544BA57872C4637158D\AD9CD48D4B6328340A3595340DD6332F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\SourceList\PackageName = "jjsploit_8.19.3_x64_en-US.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AD9CD48D4B6328340A3595340DD6332F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AD9CD48D4B6328340A3595340DD6332F\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AD9CD48D4B6328340A3595340DD6332F\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AD9CD48D4B6328340A3595340DD6332F\External msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\PackageCode = "606E1AB49521A7449821A34F16F89497" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\Version = "135462915" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\03D213AD8BB2E544BA57872C4637158D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\ProductIcon = "C:\\Windows\\Installer\\{D84DC9DA-36B4-4382-A053-5943D06D33F2}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AD9CD48D4B6328340A3595340DD6332F\InstanceType = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 828 msiexec.exe 828 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 5852 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5392 msiexec.exe Token: SeIncreaseQuotaPrivilege 5392 msiexec.exe Token: SeSecurityPrivilege 828 msiexec.exe Token: SeCreateTokenPrivilege 5392 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5392 msiexec.exe Token: SeLockMemoryPrivilege 5392 msiexec.exe Token: SeIncreaseQuotaPrivilege 5392 msiexec.exe Token: SeMachineAccountPrivilege 5392 msiexec.exe Token: SeTcbPrivilege 5392 msiexec.exe Token: SeSecurityPrivilege 5392 msiexec.exe Token: SeTakeOwnershipPrivilege 5392 msiexec.exe Token: SeLoadDriverPrivilege 5392 msiexec.exe Token: SeSystemProfilePrivilege 5392 msiexec.exe Token: SeSystemtimePrivilege 5392 msiexec.exe Token: SeProfSingleProcessPrivilege 5392 msiexec.exe Token: SeIncBasePriorityPrivilege 5392 msiexec.exe Token: SeCreatePagefilePrivilege 5392 msiexec.exe Token: SeCreatePermanentPrivilege 5392 msiexec.exe Token: SeBackupPrivilege 5392 msiexec.exe Token: SeRestorePrivilege 5392 msiexec.exe Token: SeShutdownPrivilege 5392 msiexec.exe Token: SeDebugPrivilege 5392 msiexec.exe Token: SeAuditPrivilege 5392 msiexec.exe Token: SeSystemEnvironmentPrivilege 5392 msiexec.exe Token: SeChangeNotifyPrivilege 5392 msiexec.exe Token: SeRemoteShutdownPrivilege 5392 msiexec.exe Token: SeUndockPrivilege 5392 msiexec.exe Token: SeSyncAgentPrivilege 5392 msiexec.exe Token: SeEnableDelegationPrivilege 5392 msiexec.exe Token: SeManageVolumePrivilege 5392 msiexec.exe Token: SeImpersonatePrivilege 5392 msiexec.exe Token: SeCreateGlobalPrivilege 5392 msiexec.exe Token: SeCreateTokenPrivilege 5392 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5392 msiexec.exe Token: SeLockMemoryPrivilege 5392 msiexec.exe Token: SeIncreaseQuotaPrivilege 5392 msiexec.exe Token: SeMachineAccountPrivilege 5392 msiexec.exe Token: SeTcbPrivilege 5392 msiexec.exe Token: SeSecurityPrivilege 5392 msiexec.exe Token: SeTakeOwnershipPrivilege 5392 msiexec.exe Token: SeLoadDriverPrivilege 5392 msiexec.exe Token: SeSystemProfilePrivilege 5392 msiexec.exe Token: SeSystemtimePrivilege 5392 msiexec.exe Token: SeProfSingleProcessPrivilege 5392 msiexec.exe Token: SeIncBasePriorityPrivilege 5392 msiexec.exe Token: SeCreatePagefilePrivilege 5392 msiexec.exe Token: SeCreatePermanentPrivilege 5392 msiexec.exe Token: SeBackupPrivilege 5392 msiexec.exe Token: SeRestorePrivilege 5392 msiexec.exe Token: SeShutdownPrivilege 5392 msiexec.exe Token: SeDebugPrivilege 5392 msiexec.exe Token: SeAuditPrivilege 5392 msiexec.exe Token: SeSystemEnvironmentPrivilege 5392 msiexec.exe Token: SeChangeNotifyPrivilege 5392 msiexec.exe Token: SeRemoteShutdownPrivilege 5392 msiexec.exe Token: SeUndockPrivilege 5392 msiexec.exe Token: SeSyncAgentPrivilege 5392 msiexec.exe Token: SeEnableDelegationPrivilege 5392 msiexec.exe Token: SeManageVolumePrivilege 5392 msiexec.exe Token: SeImpersonatePrivilege 5392 msiexec.exe Token: SeCreateGlobalPrivilege 5392 msiexec.exe Token: SeCreateTokenPrivilege 5392 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5392 msiexec.exe Token: SeLockMemoryPrivilege 5392 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 5392 msiexec.exe 5392 msiexec.exe 2556 jjsploit.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5392 msiexec.exe 828 msiexec.exe 4384 MsiExec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 828 wrote to memory of 4384 828 msiexec.exe 90 PID 828 wrote to memory of 1744 828 msiexec.exe 96 PID 5392 wrote to memory of 2556 5392 msiexec.exe 99 PID 2556 wrote to memory of 5852 2556 jjsploit.exe 100 PID 5852 wrote to memory of 1708 5852 msedgewebview2.exe 101 PID 5852 wrote to memory of 4828 5852 msedgewebview2.exe 102 PID 5852 wrote to memory of 4828 5852 msedgewebview2.exe 102 PID 5852 wrote to memory of 4828 5852 msedgewebview2.exe 102 PID 5852 wrote to memory of 4828 5852 msedgewebview2.exe 102 PID 5852 wrote to memory of 4580 5852 msedgewebview2.exe 103 PID 5852 wrote to memory of 4576 5852 msedgewebview2.exe 104 PID 5852 wrote to memory of 4576 5852 msedgewebview2.exe 104 PID 5852 wrote to memory of 4576 5852 msedgewebview2.exe 104 PID 5852 wrote to memory of 4488 5852 msedgewebview2.exe 105 PID 5852 wrote to memory of 4488 5852 msedgewebview2.exe 105 PID 5852 wrote to memory of 4488 5852 msedgewebview2.exe 105 PID 5852 wrote to memory of 4488 5852 msedgewebview2.exe 105 PID 5852 wrote to memory of 4488 5852 msedgewebview2.exe 105 PID 5852 wrote to memory of 3284 5852 msedgewebview2.exe 108 PID 5852 wrote to memory of 3284 5852 msedgewebview2.exe 108 PID 5852 wrote to memory of 3284 5852 msedgewebview2.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jjsploit_8.19.3_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Program Files\jjsploit\jjsploit.exe"C:\Program Files\jjsploit\jjsploit.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.3 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2556.4472.17065598628707707194 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8477f5fd8,0x7ff8477f5fe4,0x7ff8477f5ff04⤵PID:1708
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1736,i,7405534825271091161,179030008146590612,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1736,i,7405534825271091161,179030008146590612,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1736,i,7405534825271091161,179030008146590612,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3012 --field-trial-handle=1736,i,7405534825271091161,179030008146590612,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f /prefetch:14⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.19.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4556 --field-trial-handle=1736,i,7405534825271091161,179030008146590612,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:29c3566ed9441bce44d52060c3c564a95f18725f4⤵PID:3284
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 374D17725A4649BF19083AE0176743D2 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4384
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1744
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a0041.rbs
- Size 21KB
- SHA256 b6341db0ebed2d8fc2000f62c7e55f6d000fd7fef67097cb567ef3fdf13aeb13
- MD5 4143dabc37eb7a790a83494fc8c25fa0
- SHA1 0992ac47df44f033d1bd8cac976b44847b764e36
- SHA512 9243fcf5362cea3f2c9d445fee0853f6128081a62b410c561ee58da73699847804ce9eade4e39af36432e1f27f528f99eea82eb24c9517d2154ca80bc06cdaab
- SSDEEP 384:fqQpNpgpPpg7p+pRbpxfpGpAp4p+QpEpcap4plpGkpUpap3pMpSpW6plpst8t8tc:fqQpNpgpPpEp+pRbphpGpAp4p+QpEpFU
- TLSH T193A212455E00C2E2E6A707B4DFA797043B31C58DD799920B4A8C53399C973C82FBAE9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\jjsploit\jjsploit.exe
- Size 17.7MB
- SHA256 dbfcf21e609a33ac7ed200a62a664c6d67e1fdbf06a41e3c677e3201ee5d9628
- MD5 11a736b4f7b1a3d2b85eed1a22f71d7e
- SHA1 d759e2adfa3a32baf5d5ba0abbce8ea6c12e0c77
- SHA512 81adb3f2b46f5dd3a9e89452ab98857f1b77efc1af4935debb08bee7bcd7c9dc191ded77cb33ee04f3181dde8e459ecc43fccd5be7bedb88a8406c8088dc0e9a
- SSDEEP 196608:YJ4IFq5OblOTH2XNZPNWkLn3yBI5aRWgEg:9IFyTWXNZl/LnCBEaF
- TLSH T1F117F821BA9B996CD05FC474834B8A764A7430CB0B35B9FF448596382F6EBF41F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk
- Size 1KB
- SHA256 3affcb5340260e637040a25e642af0c94dfe3bfb4e4ddee3a310ffeab299603e
- MD5 6c46274f19f64962694d03c97419c063
- SHA1 ecc4a2f6e89524ea5a470ccf09416bb1a4fd92fe
- SHA512 bceb3a5b5bfc804aaaff4c1e74c2562f32c59e5ff3b95790368235e160e952510f40a85151da47982225089adce59b800a6d67a3bc573f6c6188a3d8f6d0894a
- TLSH T16041E00026F4033AE3B24B396B611315873AFC27BA649F5E808602CD58A8501DA7DF7F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe5a082f.TMP
- Size 1KB
- SHA256 d5a4e8fbef1e9f23b45eaa3b8a1e788fb6798272ea3e73b4376bcd664c085aaf
- MD5 ac0567e577e30a7bf3ac63e2603060e7
- SHA1 6c40f23d5e241035ce16f22574be5bc2d0c875b0
- SHA512 4610cda3dcafebae3d028fdc75003d73a236ba092e7c66fbf3e2fb565eab452d9dcaf1d590e3fe3ba2f6280101925fd97a0abddd78550e490102f5817de276db
- TLSH T1BD41C10016F4432AE3B24B396BA207158B7AFC27BAA49F5E84C602CD54A4511DA3DF7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7AB4.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 e258906d4af290f4fc6b381135a39aedfbffb5da25310710fe839475490d5429
- MD5 9bb139bad7a001744594fc6e93addc3a
- SHA1 797b9ff26dc8b7b1c5525298919d992de7e9b05f
- SHA512 71a398901cc611a1ae3802a9e533a742215a1dabb6c1d0189277549ccac994f7dc0ad23ad74e43dcb17610f4ba347cae060c4e8cb51b220b4f9eebb3d961f752
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 f60c216aa4622251412141998b0187d40cee390d753830b3ded2ed9c2624c1af
- MD5 0bf0cdcf267d853e7dd7f230bba9fc85
- SHA1 76e388cd3521e243921567d1b2d48b9358b818c8
- SHA512 35700d3d129cb857f9c5fb3698f8cbeb96b313299cd4504e8cdd84c30625957e379a0edf5c08efaa75d9428fc48fb59f87f23e4ca1f7a8b7feb0d58511ff2b79
- TLSH T177D01232320241B4C02021370353F20C8602D61B460541005428C92D5A540A40903481
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 b11894b9901251e60a460756b6461946e6c0be0824b1acf2af9810df339a0e12
- MD5 15ef530cf0fcc9f2882aadd806f53e12
- SHA1 89e55787130234c25a2c2edcdd3362e6ad7851b5
- SHA512 124ba746b2c732439645804cf74d17b70eda4f0c618514712bfbac41717ab92ee6082d9a8fa10b7fee326c8bd8e00f941a349997f62062edcb8cb7544f8b18c4
- TLSH T114C09212900C1AB5C7916FB2E8C2C0843530A421020F9EA5D1A53464A0283B6838A121
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a7977.TMP
- Size 48B
- SHA256 9de01ee5fa2f97b094997c664a1dd76677ed0ecdbfeb69724b3823f2d63d604e
- MD5 d5581937d2e27b024406866c511bd3d4
- SHA1 5f9d653248d4a0961c04a91cac38b7bde7c76442
- SHA512 573dd278d2a3d7213ad197f86fb8031a2e6080ff852c25c24013c0300d800c19f381306b72cf3d16e96f86bf24ed838ab6e2fd987d1277d9957b91f42d85b7c7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\DawnCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State
- Size 2KB
- SHA256 b1d136d8549ea83e10e810a3f5209d6c375f7eed171832c8c8462c134136d8b1
- MD5 1ce7688ae5bac3c33c7e53e327b5b8e9
- SHA1 df57c94004f8bdee8bf7acc3a4d3212fe6ec60c2
- SHA512 c8f7dd781b3e13228053cde16dc149b9814744bb39d00d988855ead7077dc5fedf20557267c8d097095a506ea6ab3fae0934d379d68b107f65f066c0bb5926d3
- TLSH T1125178BBC7E486ADC86192F916643D1ACF5D091D46BC3D6A88E5EFCB57E1071E20014E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5b37f5.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\cac7566e-b32b-428e-88fd-be84b293731d.tmp
- Size 6KB
- SHA256 1b38d1d7c9503060a718319434aeb0d314b02ed72c52ceea7d1585721f81870f
- MD5 da902563971c045636d5ef2934e5c820
- SHA1 f27a9c5d4ca08be90f2746329f24ee9753b36dd8
- SHA512 8a77a6a7e5dd18b3a355f8f4503a24c146672987b91e2683393c77979dabd27e60605d518074ec931e1ac91c0e91d0044b491177e340211bbe59af4440ae9e46
- SSDEEP 96:ste/dcZAHBqb9yk/o5h16ZPQs7/x+6Mhmuecpdt1enG/HG/cetK+g5f28XM1C7K:stmm6X8o+QsV+FNdtQoIc7XfG6K
- TLSH T192D197425E24797B4CCAF109BA34BA57E3F9A03265E51E98EBF8452C14EB5DC2307C07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 2KB
- SHA256 e36dbee95973db6942006bbd1a80476a517b1858632210038dc08cb5042ee11d
- MD5 c5be1a90231b9586989076a36bc212f2
- SHA1 f30b8fd2b6961bae3efaade9f3d47520b9c53131
- SHA512 82b7dde0d7447941c54f05d0023187313c1af45ace57baab730ba367749d76be69ad1d54af7d0d912cdc438d08821da88c0e2f91ba2a2bff5ea44acd7d6b0ef6
- TLSH T15D5197736C14AA3789F69A0D794B3B629F75D056AA611F619DDC1B0C00D729C3346C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 3KB
- SHA256 5cd9a24ff58c9b83cd55255333db207bb72a1172b1463d479ca11c9416fd22c7
- MD5 9b86a39b6569540cc10a73aa27c4d22d
- SHA1 5d26b87006736ef2875d62d4ebb187e5a2dd1181
- SHA512 2f7143e2631128d63288f7324068cc282b1f36f4edbc7bd3c9dc354cc92c56d49608358f4fb78d4374bb976d54921460269e358c4c232f7b2a5076391fa4759d
- TLSH T1A86196776964A9278DF6DA09B8863712BBA59027E5917FA5D9EC1F0C00D73CC2382C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State
- Size 15KB
- SHA256 5c484e2e044ee1a916f31938ad41b19e264d74b3cec01bc51f312d35d8119ac8
- MD5 4ded070730aa86b3abed86cc66b826fa
- SHA1 050b88228504ebec89764733c7a50834e3d9a046
- SHA512 16c7714cad72b0583afd40f4081d6b2f8230e9af9929f72b844b6145a49b8cd6d889785584d97f5592eccc4b47f8fb1782838ab3ca87e020e321c52f32c438dd
- SSDEEP 384:9+aQikB+z/xvxjg/qhEJNBSwYExCEAVdpNZ9zA:I/UxvxjgC+g/EUbFA
- TLSH T1B4729E2B58797D23A5F7FA097D4D078BDBB8D4B290C16DB84DBDAF0916872D81302C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe5a23e5.TMP
- Size 1KB
- SHA256 54e7f02d8ee0464e460a5f780b8363b47a76f0f6d39ed497f30693d4cc3b7511
- MD5 bc063ed8ac18e998729f25382bf55ac4
- SHA1 5be98dfb5be9f0552ed174eca24e76d9a189c9b6
- SHA512 6d0bfd5cbe5ae43a36f062f6edcf10c35dd0009632b677b43b7ac1c55dda643fde82544423bf40983ce7e733bdbab96d60f43e80578934099a9e5edd49e1e0b4
- TLSH T1412195F3D4945E33AC962A0B214776932F30A02B82108E5068DD8B0804D32CC779FC32
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a0040.msi
- Size 6.1MB
- SHA256 f42dcd90b4a3228fffa331b0143cbee0b85a6b3137aca4cddc1231fd00d18765
- MD5 c92d5000b150d8af02b2fc92753aa3dc
- SHA1 cc211ee1e2b0f52974dc774920226ea22c9f5d3f
- SHA512 396084fc342d049590579f5fa824bd0e7079ea10f2f70ab1358bb6852b2bcc58a8440d6b4f21c2f7bce33683ce2090837df6df945c8674818824573fb07749aa
- SSDEEP 196608:vNmzbvEVcL93YfK5agemy7GClDCDhVAzqq3ngHMqrqwIe:ozg8YfKsjLFlDC12zq2ngfrq
- TLSH T1605633577C41DB3AC1265E7A89729BA08F397C141E99A98B6369361EDEF03C04F36CC1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 3f75dab41bf47dc772318bda93869606186879ca721022d4674660fa170429c3
- MD5 64c829e4703a906bd9725a431bf56810
- SHA1 cceafc34bcf6194da4a7ba605bb88f3e37491412
- SHA512 184b6e2a0b5d5a6efbdc85922583696584b51ecfb7760d15816a6e1e0f25fe7d75dee80b8cfe85294a7eeaddf699a9373a97eac15410dd60afa3afc25d21764f
- SSDEEP 24576:9Fo3DMPIdoO/vvTL/yQAQiFAvLeqrLXzU9WCtNuYm1ua5nxg8IhWwpKx0ua:AHY
- TLSH T14F57A52476F92200E7B79E3CA8F06A238D397D579C15DE8D45421B4E0922F71E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1150c197-629f-4c73-836b-962acb6f19b8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 b530a38110245430e9c6fa7c04b632786249fe7c86a000bd4d9917533214b489
- MD5 13ffb1498a716cd005f92605678d1e79
- SHA1 bd7abb2327a2f603d92eba7f9a76cc2a5d86cb06
- SHA512 d89e27e1e1265fe5548d13b99a86a8d26331baf6abecefc86ea2a836a4efcac806c80894edcb4ccf0ac7dd7ee78b1dfef66b0e7e47eea4d60732098a0f7f6cbc
- SSDEEP 96:Fshe0Xvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Ghzb++uVmN
- TLSH T195D188085AF54711E2B3AB3128F18557A877B811EF33CB8E0198238E6671A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH