hxxps://jjsploit[.]net/jjsploit-windows/

Analysis

user interaction
yes
max time kernel
229s
max time network
232s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://jjsploit.net/jjsploit-windows/
Sample260903-xtpweabc46

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
292	4856	msedge.exe
834	4856	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
1692	RobloxPlayerInstaller.exe
6452	RobloxPlayerInstaller.exe
6508	RobloxPlayerInstaller.exe
6672	RobloxPlayerInstaller.exe
5996	RobloxPlayerBeta.exe
2348	RobloxPlayerBeta.exe
5384	jjsploit.exe

Loads dropped DLL 2 IoCs

pid	Process
5996	RobloxPlayerBeta.exe
2348	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jjsploit.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
832	raw.githubusercontent.com
834	raw.githubusercontent.com
893	raw.githubusercontent.com
902	raw.githubusercontent.com
904	raw.githubusercontent.com
906	raw.githubusercontent.com
908	raw.githubusercontent.com
833	raw.githubusercontent.com
894	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
5996	RobloxPlayerBeta.exe
5996	RobloxPlayerBeta.exe
5996	RobloxPlayerBeta.exe
2348	RobloxPlayerBeta.exe
2348	RobloxPlayerBeta.exe
2348	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Input\CrouchButtonPressed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\LegacyRbxGui\brickSide.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\avatar\compositing\CompositExtraSlot2.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\configs\DateTimeLocaleConfigs\en-us.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\PlatformContent\pc\textures\sky\indoor512_bk.tex	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\StudioSharedUI\grid.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\StudioSharedUI\pending.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\account_over13.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\families\Michroma.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\AvatarImporter\img_dark_Rthro.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\PlatformContent\pc\textures\wangIndex.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\RobuxIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\models\Thumbnails\Mannequins\Rthro.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\StudioConvertToPackagePlugin\placeholder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\GuiImagePlaceholder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\common\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\families\LuckiestGuy.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\rotationArrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\StudioCameraUI\iconFPS.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\StudioSharedUI\spawn_withoutbg_32.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Input\SprintButtonRegular.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\crying-medium.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\crying-small.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\MenuBar\icon_safety_off.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\9-slice\search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\FredokaOne-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\thumbs-up-xsmall.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\TwemojiMozilla.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\explosion.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\icon_localization-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\LuckiestGuy-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Settings\Radial\TopRightSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\FaceControlsEditor\checkbox_checked.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\BuilderSans-Bold.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\PlatformContent\pc\textures\water\normal_24.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\models\CrossExpVoiceDataModelPatch\CrossExpVoiceDataModelPatch.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\ErrorPrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\skull-large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\SpeakerNew\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\icons\ic-unpin-20x20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\avatar\compositing\CompositLeftArmBase.mesh	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jjsploit.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329361574598794"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-e7d81637d42c4b23"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-e7d81637d42c4b23"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{41EFC969-BBC2-4489-8686-79D3868449B2}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-9fe94fb0e9d84c25"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	jjsploit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	jjsploit.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1692	RobloxPlayerInstaller.exe
1692	RobloxPlayerInstaller.exe
1692	RobloxPlayerInstaller.exe
1692	RobloxPlayerInstaller.exe
5996	RobloxPlayerBeta.exe
3612	msedge.exe
3612	msedge.exe
2348	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
4256	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
5384	jjsploit.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 1340	3280	msedge.exe	85
PID 3280 wrote to memory of 4744	3280	msedge.exe	87
PID 3280 wrote to memory of 4856	3280	msedge.exe	88
PID 3280 wrote to memory of 4744	3280	msedge.exe	87
PID 3280 wrote to memory of 4744	3280	msedge.exe	87
PID 3280 wrote to memory of 4608	3280	msedge.exe	89
PID 3280 wrote to memory of 4608	3280	msedge.exe	89
PID 3280 wrote to memory of 912	3280	msedge.exe	91
PID 3280 wrote to memory of 960	3280	msedge.exe	92
PID 3280 wrote to memory of 912	3280	msedge.exe	91
PID 3280 wrote to memory of 912	3280	msedge.exe	91
PID 3280 wrote to memory of 960	3280	msedge.exe	92
PID 3280 wrote to memory of 960	3280	msedge.exe	92
PID 3280 wrote to memory of 3044	3280	msedge.exe	93
PID 3280 wrote to memory of 2444	3280	msedge.exe	94
PID 3280 wrote to memory of 3044	3280	msedge.exe	93
PID 3280 wrote to memory of 3044	3280	msedge.exe	93
PID 3280 wrote to memory of 2444	3280	msedge.exe	94
PID 3280 wrote to memory of 2444	3280	msedge.exe	94
PID 3280 wrote to memory of 3024	3280	msedge.exe	98
PID 3280 wrote to memory of 4160	3280	msedge.exe	99
PID 3280 wrote to memory of 3024	3280	msedge.exe	98
PID 3280 wrote to memory of 4160	3280	msedge.exe	99
PID 3280 wrote to memory of 3820	3280	msedge.exe	101
PID 3280 wrote to memory of 4672	3280	msedge.exe	109
PID 3280 wrote to memory of 4672	3280	msedge.exe	109
PID 3280 wrote to memory of 4672	3280	msedge.exe	109
PID 3280 wrote to memory of 5332	3280	msedge.exe	112
PID 3280 wrote to memory of 5332	3280	msedge.exe	112
PID 3280 wrote to memory of 5332	3280	msedge.exe	112
PID 3280 wrote to memory of 5436	3280	msedge.exe	113
PID 3280 wrote to memory of 5436	3280	msedge.exe	113
PID 3280 wrote to memory of 5436	3280	msedge.exe	113
PID 3280 wrote to memory of 6060	3280	msedge.exe	115
PID 3280 wrote to memory of 6060	3280	msedge.exe	115
PID 3280 wrote to memory of 5724	3280	msedge.exe	117
PID 3280 wrote to memory of 5724	3280	msedge.exe	117
PID 3280 wrote to memory of 5724	3280	msedge.exe	117
PID 3280 wrote to memory of 6028	3280	msedge.exe	118
PID 3280 wrote to memory of 6028	3280	msedge.exe	118
PID 3280 wrote to memory of 6028	3280	msedge.exe	118
PID 3280 wrote to memory of 6032	3280	msedge.exe	119
PID 3280 wrote to memory of 6032	3280	msedge.exe	119
PID 3280 wrote to memory of 6032	3280	msedge.exe	119
PID 3280 wrote to memory of 5756	3280	msedge.exe	120
PID 3280 wrote to memory of 5756	3280	msedge.exe	120
PID 3280 wrote to memory of 5756	3280	msedge.exe	120
PID 3280 wrote to memory of 4972	3280	msedge.exe	121
PID 3280 wrote to memory of 4972	3280	msedge.exe	121
PID 3280 wrote to memory of 2460	3280	msedge.exe	122
PID 3280 wrote to memory of 2460	3280	msedge.exe	122
PID 3280 wrote to memory of 2460	3280	msedge.exe	122
PID 3280 wrote to memory of 5968	3280	msedge.exe	123
PID 3280 wrote to memory of 5644	3280	msedge.exe	124
PID 3280 wrote to memory of 5644	3280	msedge.exe	124
PID 3280 wrote to memory of 5644	3280	msedge.exe	124
PID 3280 wrote to memory of 3040	3280	msedge.exe	125
PID 3280 wrote to memory of 3040	3280	msedge.exe	125
PID 3280 wrote to memory of 3040	3280	msedge.exe	125
PID 3280 wrote to memory of 6012	3280	msedge.exe	130
PID 3280 wrote to memory of 5972	3280	msedge.exe	131
PID 3280 wrote to memory of 5820	3280	msedge.exe	132
PID 3280 wrote to memory of 1692	3280	msedge.exe	133
PID 3280 wrote to memory of 6452	3280	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://jjsploit.net/jjsploit-windows/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8c83bc188,0x7ff8c83bc194,0x7ff8c83bc1a0
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,11245031090578871854,582675683420221249,262144 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,2449472486837697617,3078713675818653289,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,1334936913695433135,8388719570660176165,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12292389827407465039,11077633330366518445,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12532190887081523233,12623525839392753727,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,9826081804187778091,8837233588990774411,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,9264065231586831097,5500148736551422641,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,6989682115689139771,8358989128243629334,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,8377327541570905883,18340888993848120638,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,3864289912902341903,7721600195517976482,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,3864289912902341903,7721600195517976482,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6296,i,15439868369443399709,7475367982496268119,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6500,i,12085139452190193870,1198329063091185432,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6284,i,8046360793764331824,14017775640577340190,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,13012796992714593621,4984499743059778952,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4212,i,15854491080184108371,7402780435803462283,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4228,i,1047781068351292698,17220269947630274441,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6352,i,3984357554410584782,5542146765197869768,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7084,i,4535597836768197093,18278715746759240757,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7300,i,6451237551803424129,14054882014241705260,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7320,i,14497445714758848817,18080166210564490087,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,4237562799285339931,1335682348084822226,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7472,i,11904967396410538206,10461119601555101766,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7844,i,11568400626371144047,7314797223018131215,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,15651892989825589121,1879169556495150286,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8492,i,4386315276667700139,11714872583919888895,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8348,i,7225280217956869604,1513392045649162650,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:8
  2⤵
  PID:5820
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- - C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1692
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:5996
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:6452
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:6508
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:6672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,16667350001149075809,786044800862907713,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:6220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7060,i,3422829246894484620,7834525378767956312,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:6948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6340,i,12992281466104902122,8647848669869872861,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:7124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8512,i,18060322362143178123,6126173527619256454,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7120,i,12323379105580463387,12521841661958932537,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9188,i,14518360911877678121,10729424185195626096,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=9200 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7100,i,3152845287114045170,10503651538677353077,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:1
  2⤵
  PID:6400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5836,i,12326472278164550268,9553268465079421217,262144 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5220,i,9014516219252438159,15157157657087687092,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:6292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5280,i,12259598551690989342,14446751590981195678,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9012,i,983654156936956969,89156461936366089,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8864 /prefetch:1
  2⤵
  PID:6408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=1644,i,629555891935287531,16437682495181703682,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,12582142070810198711,1948832644707329929,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8564,i,18023551983064179959,18204408463735833484,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,12582142070810198711,1948832644707329929,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:7124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9016,i,9331626467750590961,13355201521585911411,2097152 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,17844370837513648863,18075111120145242052,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8380,i,18024478988747340503,931751595311121992,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8908,i,4894444420495815062,3035349934278121353,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:8
  2⤵
  PID:6572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8412,i,9558362931829885885,8683254667996485279,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:8
  2⤵
  PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9260,i,4665393710386968286,7767047287948687432,524288 --field-trial-handle=2272,i,6184827839401326976,14848109234833398530,262144 --variations-seed-version --mojo-platform-channel-handle=9256 /prefetch:8
  2⤵
  PID:6288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5052

C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7136

C:\Users\Admin\Downloads\jjsploit.exe
"C:\Users\Admin\Downloads\jjsploit.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:5384
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.22.1 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5384.2480.4621040308448145438
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:4256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff8c616b078,0x7ff8c616b084,0x7ff8c616b090
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.22.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1760,i,4867223044995403885,12434206382646077886,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
    3⤵
    PID:6456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.22.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2080,i,4867223044995403885,12434206382646077886,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.22.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2432,i,4867223044995403885,12434206382646077886,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
    3⤵
    PID:7124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.22.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3672,i,4867223044995403885,12434206382646077886,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 7a3cc75779e5d17e093e9e6e249c1022af0339fb9bb59030efd3a7b7ed7c4088
MD5 44b95492bd8693f310fc4b2c4fbabe53
SHA1 cda7cb64accacb9170ebdc6d7d876a6b46d29bbc
SHA512 47c612d2ec39fba90c732ff5160ec290499e59f7c578c1d45d5d205abc9c28514681a0bb98d0320334ce649a047e0ca99137dc3ac9a7eeebacde82797701ac42
SSDEEP 196608:fU9iHrHJbgONLiZ3V1ZbmsxvqfkIu0akVZzZC4qJv:fNHqOUbbmsxSfNu0akTI4qJv
TLSH
T149A6BF22BA00C032E8D200B2D6BD9FFA993D59350B3954D3A7D45DB95A305D33B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.dll
Size 20.3MB
SHA256 ba16843aff0ae092f7b5ada3cfa5a46cdc08a8c4d95854108939c6e7b299f49e
MD5 c915e742f16468edc1bb1337904c4fe2
SHA1 08fc874ece1c1ff330de49f591c2d05467e81432
SHA512 2892972459dcd2b182b05fc20797f81390dac4fe34011ccec6bdb5d8f00c51a5c5db9d46152f3f9d3fd51a9ce432e0fe97ff5db5b668b865eedcfc4831c322c3
SSDEEP 196608:7bkm4lWYZk1uGwLEit6yL6yC69Wgxpz9svGiDKxZl:7bYEQ0uGjUjL6yC69WgxpCOiDKF
TLSH
T11827BF4EE9D70AE8C6715470D0AF17E3DB22308C4A6D6EF78AA50121367369D2219F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ba

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 41KB
SHA256 26b7f00ffe23f22e24713399178643f36cb5d006f3469dfd86b6ff95f8a63e79
MD5 ba148dfe6db2432a1a6efbbbdd9bbc5f
SHA1 75b0060dda4bbff073c035095ffcca7deaf610a2
SHA512 52cb525a9fe3dae8c24a2b30dfd7faf1baf21203dd84b4573bc107c2c043d4a3a0dc358517988ee55bcf53a2d22fbbac18162b1aa35f0da2c44fa6a0ebe54ddd
SSDEEP 768:fuCTrkbkI2/+/qaUxhXQp3YnIQSzPCX3lRT8GzWxHGRGwDqU9v5OC8cl:fLTQQnm/36e3YnGmcZxHahl91rl
TLSH
T1E113F2DFC79C1BE6392566ACBA2B816C8D101175D5DAD6C13203CA8D3BC4B4BA846B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000130

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000130
Size 1024KB
SHA256 acb3564aa682d2025cae708b693716aeb5306e7df68a0c07b7f55e06458e47c5
MD5 3f8a4202b7d08ac882520aec9911205d
SHA1 c18a0962b2f16e6dff705cb4279e1e311b7abccb
SHA512 eee190d7bf61b109c48539e071401282e761bbbed4419f440ecb52eb44e26770d51da5fcd8e3bd7d9d87ce86911cc3e7faf40372f26bd6515b9daa2508feb804
SSDEEP 24576:hszJrLvZNXBLs3GvP1ZrRuVY4TaqEi6A8:udrlNJ7NSVY0as58
TLSH
T1B2253341D1E343D4C024E36AB1A70C3ADFC5C35E97D7976029AE3C2648CBDACA66B9D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 2d8ad76981e0ff7ff5bed8846631dfe333b013133d39033d250db003ecb99270
MD5 d6ed25df61e1ebf67b3592b3cb4b9e02
SHA1 b80db780612de0ab9d415afb40a53370a1442e6f
SHA512 f682bfe80ae1ca6682a328e53abce112c85aca6977256b7aea335f55a29bbce3f9407bb34d245479882ab61d39b44301b31913d428a999ff9ad4c04363c4a296
SSDEEP 192:6E0ePHsm7FMdzzUKjLM3CRu1WzdwStwOtbwPHddu9iCcfrM:6wZ7F0zYKjEguQ3tziPHdyncTM
TLSH
T12642408DAAA60883FF68B6B0E5F53C8B757254AAD6275F33E145C03D1A2FBD93C10512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 69fa0c8baa20c8b9ae41f2cb2737437d754e510feb0c8fda69ddc25a9f51c732
MD5 5fab119c8d6d5e1e42ee93a0919183e6
SHA1 58653a1e4d124f11f0a001322224b8d954a3448c
SHA512 437f5b7e8849b20d0cef340394e8edcf593d42bd6581f36564bc144d316657a0392aabfddfb4b25374e74e0e516c63ce9f05e5782aded76e5e61bd32b457375b
SSDEEP 192:CcueP/sbQydzzfL8LMgUXuBWzEwiBSbwPW4u/52cfrC:Cq0QKzTL8r4ucKBpPWtEcTC
TLSH
T108322E8DAAA50883FF68B6B0E5F53C8B717255AAE6271F33E145C43D1A2FBD93C10512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 c96b0a63c1420d6144735649e1dec5ff1e9b40c98069e1ef8547143b3de46021
MD5 bf794d9a27c22982338630c4caa31d4c
SHA1 a82d9f13c17a5ad6b78a492a93f4c367d007fef7
SHA512 b4e307886b6df914a6eafeda59ab9750dfc481dd8d228d4a367bc3ebf67aa4cc50df15f3b4270d1f8d92820375f6c5497ec730b4cef7c5cca753d4289ab36763
SSDEEP 192:W9N/BsnbazzzZ4C2l8dYtoYeqAlbW3RNcUYduae:WBcbwz143l8+zAU3Rpaje
TLSH
T1DC122BCDE5860883FF64B6B1E4F62C8671B6995965076F33D208C03E261FBDE3C50816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 f4bfa77bc712327e9f033416cc3640034e47073f75d59f697c15f8fcd8a2f823
MD5 92715b1fa7062ec79818f11e1781fe4d
SHA1 e3e48e64d7dea47e3901362c770dfbd53fc2dffb
SHA512 9ab974b4d6dd3bdf885d8f5e1e0815ead970594342d90ce08cebed483d58f57f7bbb12a884a6d4911be221c934d31e75cf6cf0a1c08c3499d05353744ff61282
SSDEEP 384:DLk60ElaFerP6+kr1nezDP2JqNPRnLHfjURmEEuUjK2gcivIHT7lhsqRFFfnEFQl:UYXW1rA
TLSH
T18F42C0F3C3E8966ECC2196F26A147E1BCE1D091543683D6AC9E4EF4B93E1471E24178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 36KB
SHA256 9951ec7cf7ec1f014bbd76a01e03eb7d74114bb172f8e4b2f2ff786f203991bb
MD5 7927a94a7201bac514448af2ea8f1212
SHA1 0c644b55c5652c703d6441486b78b4caf4df4b78
SHA512 79543364bf001cc1a75f0f808945ed0f6d42ddb956ca13dee9e92a77c1f0334279c187ce989a514a54ba9389f24367060f12887f3a2a253058f3ad40d7ba7abb
SSDEEP 384:DLk60ElaFerP6+kr1nezDP2JqJleqBemsR0iU/BJmnekLRf5XnMgJ8ePx5Be+264:UY77YFjMkIrdcBDeMJXkXnSbQmOD
TLSH
T131F2DFF3C3E8967E9D6155F56A242D2BCE1D0D1902283D26CDE9EF4B93E1472E20264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 16d750561086b410e8f5def74be45c8dc620d25840893d7fcfe30446493ccc0e
MD5 85567162d622878306835dd370f9c565
SHA1 77074d752b93b030d4fe622d31a0c6cc6a76b020
SHA512 1be0f7f3a03eaaabf9b489ccfcfac746731502a61392f09b9c29f0a70e61e160d9613fe7b8cd414147de97992ef4feaa6cfccfba0d13ee3a2d67ac05fd4d9502
TLSH
T192D022A3620430B5B67CBE9BB06AFC8FC33E20218802DDEAA0D0E89D153146D0617284
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 210B
SHA256 fa0b7c3c95ec43db0bf5ec7671ea4cbb50735457178c7e3aa2ee07674730a828
MD5 e43ff73104260005b1170d9b1c3d63c7
SHA1 291800b6dc3e40640814a133dea1282d11cc1dcb
SHA512 2bd7d1e4c7968cf39d98a1f722aee85a88835a474003226ad06a21425e72548a0eb2919556b97af8712b080190e462a745fe4e2ea073f826b0faf1094ab29de9
TLSH
T1BBD023A3160030B4B67CBE9A605AEC8FC325101584039DD990D0945D153145D1617140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5929e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5929e5.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1af03df56fe0369607741756f9e5cfb0ea866c8f85db4a667fabef776ab4d179
MD5 8f2c15fd4d8998a603380d27812a26a9
SHA1 85de98bebb7fd2f855eee9948ca41a388c23831b
SHA512 c895eff50e0b83aaa8c6a183fb8e7cf8676fb6206232eeeae396bc5b565f07085bb5d3bedb43302128a2f0329db8f4b3f920bfbb963e5c71e55477044dd6e41d
SSDEEP 192:sxZcRKyM/jK1Ml8MkF/fbDsRfSSoIdpd3HW6+WNy81/Y4sjsuIgrJ:sxZcMMF/f/sRaSZ1HbT/69
TLSH
T1C052D815AA346977CCDBD209F955BB93D6F94463A2900E44A9FCCA1C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 debe2758b7b121d47bdf4d07cbf28e303bc8adf72a5dfed5051cf8a5ebf9db46
MD5 b45da3e5fa38251c2b0062952ea238a8
SHA1 25c9015bdf7ff301788fe6fd94a4878290a28d2f
SHA512 36d22a3d4a98272a58e10853acfcd89b388a7e80ee5a7348e7be83d07f68ce069e61334b78d022e766d6c5db0a2724b6eab8393661fe5b9823c5dd78e054d754
SSDEEP 192:sxZURKyM/jK1Ml8M0cBWF/fbDs0RSSpp4b+OddpvW2+XCipHW6+WNOUxr3Ws8S+Z:sxZUMsmWF/f/s04SbXQYHbVyuL/kUEnR
TLSH
T10392E652A5209977CCE7C519F925BFA7E6F94063D9804E48AAFCC91C04EA6FD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 611d5ac6169c9519cbdfe5f449b4631da3468d28c2b1e648467bd71d5e311c17
MD5 94e79645a43d1ae561516a49142dbc1c
SHA1 2227e76f3c25044bdc86b69bcd1101d34a2686a9
SHA512 b8bdd73a10e43b8fa1329be3a850b344f5b3ea9fa283c7826fdcfbd442bf591324b193cfc99c1c602860896cb0176a244d93047167cc18f5c596d77c40c041b6
SSDEEP 192:sxZcRKyM/jK1Ml8M0cBzF/fbDs0fSSlb+Sddpmn+Y3HW6+WNrH81q+KHog/Y4UjF:sxZcMsmzF/f/s0aS8s0HbkGL/WpnR
TLSH
T13282E756A5209977CCDBC609B9257F67D6F90463D9904E8CAAFCC90C04EA6FC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 99aba39d42afe4d4d7d140aca44f85d0a74581ce43765669a3e204d93cbef9f1
MD5 2e90863bb10670668523846f8d97ce76
SHA1 1447b4e2e475750afbadd6c4d9b1033249d6bad4
SHA512 6d73dd8ed0c9adf4bb135955668d9cd2bbae27a89252e15b0f253983dac17a8e4289363cfc3d986ef6205d2e0ad0fc4237f26e905bd7b1e2ef9dece8e8aa1335
SSDEEP 384:sxZUMqXmWF/f/s04SaXQzHbfyusHsUn3lJR:sc7XmWF/fV4SaiHbfQs4VJR
TLSH
T13A92D552A5209977CCE7D519F925BFA7E6F94063D9804E88AAFCCD1C00E66FD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 a6d0261e12ff28b448a6c307a8013f41582a6158f105f33739d4fee2777a0001
MD5 83cbdcdd6538be3e1a1c253410e112fe
SHA1 ff0fcdc052eecd50e19c866ef4491cf75d2c67ed
SHA512 c1ce1a0efb280b45a44744609398c33783117185d58ba663cb507fae13fcf241fb6f23f5d91d9b2da9565c72690c8e34e6c5394a9dd963dd3b670b7d72752635
SSDEEP 384:sxZUMq5mWF/f/s04SaXQzHbfyu/KH0zn3lJR:sc75mWF/fV4SaiHbfy0LVJR
TLSH
T10992D552A5209977CCE7D519F921BFA7E6F95063D9804E88AAFCCD1C00E66FD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 a41fba32bff034ea0dd79da70993aaa76bc889e3d4dd067930858e4fd0d3e5e6
MD5 b9ceda5d74ad81f564018c4b11da1909
SHA1 63d9267b9300d7c97273ac100edf44a2ead649c2
SHA512 5ce06ab33f46967c345eda0a826f4375bd52da2bfb9a33399f0dacd090065478b3a68b27add7fb9b5166ff4085849688b1ae62adfe91adf64804a4a27a980e0b
SSDEEP 192:sxZcRKyM/jK1Ml8M0cBWF/fbDs0RSSR4b+Oddpm2+pipHW6+WNrH81q+KHog/Y4q:sxZcMsmWF/f/s04SRXQZHbkGL/oznR
TLSH
T1B882D652A5209977CCDBD519F9217FA7E6F94463D9804E48AAFCC90C04EA6ED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 392522a4a062ce0cefb9d64aff8810f7f9db50bd2b22ccfba545eac089827466
MD5 38dc67c974e7e3b70ea18b604a363138
SHA1 f33d721f63fb00a158ab70751e60c59fdc68fdf0
SHA512 aa3ea1f31bab172e3a4a9eb91ec625f5393a9c1e22b4aec069d9463ce669ff57cf6c442a4803a5e5ee2c9403d7199efe48fea3dc4ca16ae71362e5ba891d9fb0
SSDEEP 768:fb8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdgrooktUnL:fb8iJPNWvx76ru1jahALocdrxUL
TLSH
T17DD2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 8e23293ad66b502df88cb9fe64de21e126e4026027a7faffebca43dc70fa1d0c
MD5 06a856e25e5b914d0dd2d47061231584
SHA1 3c78279353056dfaac08f326a4a9b88617ff6331
SHA512 d4d51671d6d32aa4ec07323f0943904b8db51acc62b8a04f903bd8c91a0b511c06b22dd6b6cc30e19b7dfbd4d11d3112deb05e2734db020967f660c3468948bf
TLSH
T164A0021B42C09009C102A7F439EA01622312F91602021357C5914189CD615858FB140C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 3KB
SHA256 2061a0cf7fc30a81ffbf034b9e36ac3b1d1936e57a1d9a012fa10caafa0473ea
MD5 9969ba9471eeb64544964aeb41a70e9a
SHA1 b087182daaaaf54cacc99bade3558f3b20bce700
SHA512 c0c83928214c99d559513017da677f1b9cfcc36ccfa6f5e0f8d4edb71bb5f807c9297251164816a5db3f5268827bc9fee78d07bbe5ebaacf3ece41905b77e4a7
TLSH
T1FA51C98E8C460F96DEEC517608B72886333518CC57842E1B5BED9234BCD332C6C1A654
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9aaf1a4484ddf1adfa84eb6d4cf3ee37bd86c22b49c68e0063bc36091e984e5d
MD5 0249a8af622be54006cc50cbf5f625cb
SHA1 318f07a55315014ebb283cb70d51f7025a64ca36
SHA512 018c9d4253116a1a9563ff421c3b6c39931e30c2b5a2039cb4ecd81f4cafcfb1f62ddfcdf25fd4fe8eba4486a180033079cd5a6754eb297380b45504f9888c51
TLSH
T134E0C0F72EF72840FEFF67E5047098A40245B459D544BC8F5417EB8334613523406C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 dd30bdb263a53c5f68015f0b177efa5501b668afa0ce1ced839b0adb49144a11
MD5 867e735b558f6fed6dec1a0bb580de76
SHA1 94d7c13c89aecb40053f6bfcf54c106d7fbaec35
SHA512 a8afce994eb8a193c8d7fe9cf690188e2b40e96e13c78ab4274c5cdf704194633aee43ccd26ac38fe5f39fc979c4ba37c62d147f7e0364f647233c944acfe0e1
TLSH
T187A002248A499001C54716F010F5668073525D9D41261319EC9AD0AC9EE52D455C5381
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b2ebb43005dfc9887869d810c126877b10d7b8093160ad875d1e0524a20d319d
MD5 368d0582d839f4560d21c483b9ababf8
SHA1 c42cab199089181239a438ed9e361c9a7bb22f4d
SHA512 b957f71c5bce3aa71ee756dcbf7980c5ae03b77ea77a62461c6e20519548b0102b8869c6aae15e5f673d4328fd8a70ed04f65c0b312e7890717fc06e22fee9cb
TLSH
T11CB00415CD1D51C5C50747F454FD744473701C550357375555DCF075445535075D550D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592fe0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592fe0.TMP
Size 48B
SHA256 ed68804723c1f690d49bb70709efbdfe98e14f151805fc53a216089b0eb48f21
MD5 951855da56e43cdf1c89ac4e1eff4435
SHA1 b6fa4364fcbd09ac734bfb863ab2b87140e5e56d
SHA512 128d3817a27c331e033cdb5d9508750ff9dd642dbf3c2733cfca6048fb297523ffbdfdd6efe8e9572dd5981d35b4e8ab7922ef1fb91e46c6b3ac644301b66e8c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5b542bb6369904570ae90ae243a51ad4e8321a7075d25d738c0b3aa8ee68b29c
MD5 29036785fd28132f902b01947d8cc670
SHA1 58a2133404ecf721f505719945f3ca12f9249e2a
SHA512 0f92f2fb7db6fec0017eec13f81b9f5652061f4b2ea8c74d7d54168dfc512fbc31d2313064acdd0192a1b560054526eafd2bb56f94170cd0701bbaeea590113b
SSDEEP 96:KkOkKHK6TEPIkumW28mJ9Wk2K+TWi2yMERS9JCKKsSeZ2KSMq:S3TEPIkumWlmJkk0TWi5MERSsFp7
TLSH
T1A1A14351327F42413C7E641AA2B68B5B574279A3306DE53B3BA810750F27E250EFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a2fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a2fd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e38cfcb2e85c340fd92561cf16b64074efb9ffae22fe82766ffb56ce320270b5
MD5 673f288ba8bb9e40f1549c934e15a44f
SHA1 e71c59c23be8fe4247981c4f9486fab40da1bf17
SHA512 e1a591ca7351329c09c1310a6dc82f922058922a714da59a52cf063ee75a3a43c79ab1ac711f241dec072075d35a827de67bfe0f0a3cf4467021005c1d05425a
SSDEEP 384:bZcIlsNg+zGl8UHfb7ukhOp3VeP1sa+VY4BZpom:Dle2DbhOpi1hgTnpt
TLSH
T1B4827C326C786D7B58F3D685F84773179EB8C067D6C86F94D5ECAB1C04CA398130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8de6512f62c8e926b879eeb47129dddf897197527abc364216a3f341eb5b7e0c
MD5 d2233759373a56909996c2c01886a109
SHA1 f4fad5e0cbd50b9271e1e10171c30a497c4e0023
SHA512 5d92cb59f25b27823b52086f63cd9acf0c88b86ff8737c768b78987fb98163dec0c5e80eae6228d3b93af726f49527bdeb00a70eed265843a356523468b9a108
SSDEEP 96:ZqONkIQsjpfmUTmDK5ih/cIPURHl8h4otop5U5D2BhPwivh50xy0SFYKEAxnO0Br:gONY6kDfQmiUyGmZ903yO4+TQiHVo1U6
TLSH
T19202D7356C782CBB9EA3AE49F44737276FA5112BEAC52F85D9E81A1C00C734C2747826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0b59f5dea010665958e3e09b60b0fb812f70702bd54aad197bc0fe9e99869062
MD5 7f8e96561f7a1ae4d5a614bc14a413bd
SHA1 94337712b315929cb47a4989cb2e0890642bdfc1
SHA512 0fb49eb0c5f48d4a84dcc9294a4bb1ebe81ab7a33c5ef1ea8443c5c56cd9b27139efbe843d89d14c5eaef8d3ad4bc7239a82e6a8684a799514f6e79ab0e7a414
SSDEEP 384:fZcI4sNgfzTul8Ucf/7ikhOp3VeP1sa+VY4BZpom:34/aW/tOpi1hgTnpt
TLSH
T1BA827C326C786D7B59F3D685F84673179EB4C067D6C86F94D5ECAB1C04CA398130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 67b72ee6654eff3cc7a40c7f79755330064a19ca4c5fbd656220f40725072923
MD5 cf395861c59ba17197af9fc5a072d5fa
SHA1 c82df894dab2b4479ed5036e5627e986b4a40eba
SHA512 19d942caa38e9b57f138a756b84f8683a16b24913f9d3eec833dd5fff836120d8b81b63254f0e01cfd10a84d2604f5a204ffcf6569e4b9bcaf2eb61abfaabb9c
SSDEEP 384:piFGZcIysNh8TUNTUlIlfzTul8Upfj7ykhOp3VeP1sa+VY4BZpom:AFUy2wgVaBjdOpG1hgTnpt
TLSH
T18FC219F258D7887AD9AE8747EB7D2E138DBCC053B5C4A950B798560CCC862BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1354b81fe59882132f663b655fe840d55de02cebe31158b6535334b616f6bc20
MD5 63d220cc447a002424635097075f5cf7
SHA1 a2e656a0c3a2013119f4b11dd48c73db16e87f4e
SHA512 bf410dbae13d3600f986ee35684fac3591aa4895e1bb17db469aedf7c2b168ca5a1ce6b2647cc42de537bf2ab4ac634aafc748dd04ed948de058c51b47f2158a
SSDEEP 384:vZcI0sNgfzTul8Ucf/7ikhOp3VeP1sa+VY4BZpom:n0/aW/tOpi1hgTnpt
TLSH
T166827C326C786D7B58F3D685F88673179EB4C067D6C86F94D5ECAB1C04CA398130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dda1a1434e82fc56673f149a6f3679c4cac6fd4493995199302bb2f55b469eb8
MD5 4694ea9668cd78fa2a91b579f855ecbd
SHA1 4954273ab8b91cd9fa98d622b430367e9a35d7d2
SHA512 8e46b889a9a8826831b09f32b05fb1556687cde2471820e25474ca5db17551048b22bfa4fb47724490dddf3c4c4afcdc49471160a29499361def56f37b345dee
SSDEEP 192:SONR6kSQmiUyxZmu903yO4+R5pbr9eNcRHBq8bU6:SONR67aEu9hOp3Vei1U6
TLSH
T18D123B3268786C3B5EE39949F48732179EA5812BEBC87FD5D5EC2B1C05CB35C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9a69343b3f0a00dd5f6728079a306c2651964b577f47e0c59f73703370cf7bb4
MD5 53faefae6ea9253692b864b440ff6918
SHA1 53650cb84d65d75f43e1cc1aba876ffd08a2c5fd
SHA512 5b8bc9c9b7eb4cf9077301db31f081f489cb34048ef9518256ae5a5a1620d1244e17860f53da0029dd235df9c3b55acb9131951a9db9663305335a5592a72960
SSDEEP 384:piFPZcIZsNg8TUNTUlIlfzTul8ULgfv7ikhOp3Ve51sa+VY4BZpom:AFHZZwgVaP+vtOpy1hgTnpt
TLSH
T146C219F258D7997AD9AE8747EB7D2E138D7CC053B5C46A50B3985A0CCC862BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c5bc0170952aabb2c4c2a5fef8b423b6ccc4c4b61d74ace45caeb1047fbd83c8
MD5 8d1c350e455b05dc19a8a5e231f8c01f
SHA1 d4eef52d8371ef24eb435685fb98fc839bf4d4f6
SHA512 0c544c069b02d1993c47471d1bd1a83d26dbc16a9d4bdda8244067018ba91e51803e37c0afd4b4bcc664fbfb0a4df34a4c5b232b316ecb57090e69d290892870
TLSH
T1CBE00902D34000ABC1AC073481CB2B483BF2902557EB02469A3151B83CB27443C30E84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d046d2a3580b449ef154129f5af2a361f1fd802f567ed9fcc5e4b3ce8461de72
MD5 5f15f5ee8661f2608bf4dca21fdb2eba
SHA1 ad92bd3627b527c05a7f57ce56b58c2d941c0b33
SHA512 2f61fc62f90d5cd1dee2f34ce62882b4e2e63c0237b26d868eff65e79e71e8de027aff9a2f7f2123e0a0d21c34df435fca75b3554666c38b35ec18e354679eab
TLSH
T1D4E00201D100007BC19C073080C71A583FF1502527F70144962141BC2CA33442930F44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bafca4423cb0f9f2a5017c5ac08e156b11e73a7f0ecab78bcf65b416ff0d2e10
MD5 9cdbae6430c50b0546d287b308c4f2f3
SHA1 6299dd6943995da296205e2bfa6dd31eaa583c06
SHA512 9d8f99607d39e2ddcea45c68deed9736ffec356861b80e95322cda9f435c4f00e0655057e1be240fc1242700730a3ba8dc5d4664fb0973ef2be8da894ed164c5
TLSH
T1A1E00402D34000AAC1AC073481CB2B583BE6906557FA02469A3155B83CB37543D21E84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 31ddf8ba28a138d12ec877e7ff113c218e94c5a38ac33c9296dbc3d652e6b6dd
MD5 9a463022e0d6fa636b17a1deaf95ec95
SHA1 a6c30d53e6e71921b4086891a1f70c088d316bb0
SHA512 60f8100faf39491af34b9714559bc8ca843eac92ab34f88ce9bf58bfb434a241a0581840a006217553abc007370236ca2271558bba5f62aa529c8178e0c13adb
TLSH
T193E04402C38002BBC0AC033080CB2B0A3BAAC03803FB0303AA2080B83CB33203C32E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b1a890dc350e4e31496cbb9a48cea2e8ea40f873722873364c27c2241f3caeee
MD5 c94b782d610b4ac6fc81fb193bc0df24
SHA1 21646e7b86029a615363ac1bef71572211a2f02f
SHA512 a44bef2311bced04f85d55ad5acaadf020ebdae82c8dd8b3668457d598ae4a9f1c0c591509ee26406e25ed0223d3cbe9c44d82bdaa128c2db67cf949f70e59f2
TLSH
T1F5E00101D24000BBC1AC073480C71B483BF1902517FB0245962151B82CA37443830F84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58f6a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f6a0.TMP
Size 392B
SHA256 118bf032a017220a599a9d50db2e95b4600359a53d374530a66fd99c07e51889
MD5 fd020e748d307c0254ee9b71885c0044
SHA1 4f10137e9a4806c927b291305081d2e2017c4eaa
SHA512 6418687eda299ba5d36d67c9c43f5cfb1cc75db8ebf436ea2dabd3a26f5591415d4ff3bc5738a334916d549e3e664b4ccc4dc95e60ee8317ed500cfad7f4b233
MD5 SHA1 SHA512

Submit Download

708dbced-d685-4e10-932a-85e125527442.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\708dbced-d685-4e10-932a-85e125527442.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 971c9f2eefd6b95d9dc956bbf2ba06f42d34427b761186859af9ccacd3895050
MD5 530c082de32eac70aa61954b4ce852ce
SHA1 6c0459ee4eb2f9a72a32cc4f4bd510a3d33dde47
SHA512 2bbb03fe56caeeadd68bd525b7c8c3e731cf386c11b8b229b78515b1d000e693ac4b396ae03f399c85abb5dff2a9de764a1ca5af354f8527ca3b67a11935d30d
TLSH
T1DE412A68A6FD1108F3B77E1AAFF6A86D487B78672F06D55E10110E4F0A23B40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 140B
SHA256 b71bc2473340dcaca9ad72cbbc94e7161a22d5c61f35926f2b1b44b57c68e162
MD5 795a5c82115116e1270e5184967158e7
SHA1 82e9933f9a17e691f43871a5a5573a0076ef8ca2
SHA512 0390331b1447a31286a068a6d750b29ec66b323fbb326ce23edcaa71deda374c865a28e374580b02fcc8fe9203ed5c82840657efeaffff9aef088e579fe8571d
TLSH
T1E0C04CCA13D1323B2F93599FD2514D36510A1045D0081160C8CA999F0A689D310CBCD1
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 190B
SHA256 7821a446305e0ce9e1a2a2fa2fce2ecd21cb2921af6ccbb301ada5ea17b94d06
MD5 1d07857d60fc46457df84516ca9a6549
SHA1 e76ac37d497bb662902fbb0ed434740c2a3347c4
SHA512 7611f98c3f303400f87c41290c6bf791d6d26ad53628e22262bfd75f84ee384c3ed047c61f9d6481132025232a99effe89513e7681cfdbc85bdf66fea6f1233b
TLSH
T165C0C9C613D1323B2F934C9FD1504D36510B104190081160C8D6999F19289D710CB8C2
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 235B
SHA256 74fd8a929f4d62eb56f9e8d97a5b571504f2cb1120d74166c249d1e213d378ea
MD5 cf37d4178c6c5b3b23bbbf55928aea9f
SHA1 a4ed1b58c9fee668c2e6b3776bcc4080fe8087d9
SHA512 edb2f8598b656db7ac65cc2eb63ce4f0ee8564f9769e1d76ef4f9ece754bbc0f738d2eee3e5efb7b98bf7757a7fd940fec33e667266d911ea404f0fbd2d77556
TLSH
T1F9D09EC713D1323B6F975C9FD1544D3B510B1042900811A0C8D6999F5D389D750CF8C2
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 285B
SHA256 ab439561447b1773fb06c610b91b2ff4a21f581e79517bbc5f434e84f058165b
MD5 accba0789e292e11020f861a0ffae035
SHA1 a198b8206763291dbd3acb1bafb422d7782e635f
SHA512 db0e58fbbbddfe7a47e4afe3ebe80306da108cfca12508734898b8b3c6db945b91a127372f6400910e37917b21253f60f7223bfc902f5bc638fc7055f65af673
TLSH
T13DD04CC713D5327B6F975C9FD1544D3B520B1042D0481260C8D6999F5D389D750CB9C2
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 409B
SHA256 727dfc1cab538e2e80a97a138ca4ed42fd326120ecc3487a0c3a66023f37ca5c
MD5 e6a97be4611f7d1edece20ee403c0db9
SHA1 fa5cfbca4e860754ed7ed3277de58e098bc6124c
SHA512 2dfd15ea763b6cc383df760d0d8763ab3335c3ef2808be55e80e56fd434ed264f2e9317e998316ae6a8124af77e4ce8e869344f93909561066f6b41d94d9052f
TLSH
T1F1E039DA97D4223B2FD34D9FE1854926624B2082D0080661C8EAE99E1D3C9E761CB8C2
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 533B
SHA256 dc4c46f8eeb374d26601df50b4657cdbaf16af749504f8dc82674a22ea0b2106
MD5 82a35025e992263733c704869f6f7b61
SHA1 b633c2fbf31f92bb3748f66b8cebac0cd65fcc01
SHA512 adfd492cb17b861521650babad287977ac31ad4c9d342fdd5c586235c2e1fd91d40fb7294b575d24b63910ce87d6914b5dae302e0a9cba8138e2c2f3cc7d146c
TLSH
T1FFF096D697D8223A3FC34E8FA18A5925255B6042D0080621C4EBD89E1D2D5BB62CB4D2
MD5 SHA1 SHA512 TLSH

Submit Download

InstallerInfo.log

Path C:\Users\Admin\AppData\Local\Roblox\RobloxPlayerInstaller\InstallerInfo.log
Size 580B
SHA256 4f105c3fa3de937b1d8cd156491248a209c7d40acb2646f5c80a1798eb2b1fcf
MD5 d0777d23094b3b529c79d332a6a6e15b
SHA1 c3b3434dbdd938cf05c076a0f2a73835dcfe7785
SHA512 e1a0df4e96322c72e543d4c4b94617c2469e3f9e75c8866c38e0f098b8ebe6b1de0e4ab66dd860eaed117d049e6d0346b29f69f2317c6c958b470cc69aaf8898
TLSH
T12EF0C8D787D8223B3FC34E8FE18A4925255B6042D0080521C8EBD99E1D2D5BB61CB4D3
MD5 SHA1 SHA512 TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 0790f682f966191c7edb3029fa7df525b7b5b81c536e69ba4a8e376e1facf114
MD5 ba4bd8fbc43cd1410173c1fe34a0efa7
SHA1 dd1b28b732bf69dd5bb2876d661f49153f4507cd
SHA512 230ca45c41e9909577e56cb77d5970b0010eeb3d9cf0c5bcb8bd06a4433c396012b1a2ac9e4d6af4e79aa4c696bfb1292edb8cd17eb796855b7d39258652a5ac
TLSH
T1B2A0020D80E66398859176B645A093247922D45B5200CAC8484F63528B4593ED404CA7
MD5 SHA1 SHA512 TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 f604f99fa65b188908cd63db44e74ba65be66719d226ab3385bbf24e1ca0df40
MD5 87ac92d3ddea18b7a0ff2b4c60e8ac82
SHA1 d850852c7b190b53b2cfb09dec5e80149e310fcc
SHA512 13c20e9fe1fc9ba6a92fcb176e44d85019b5302e159292ea41d3de930f642034981ff95686c4b5e07fc9a8ae7587c1ce0fd56676baa53cafdfe95fd6d0495867
TLSH
T194A0020D10C693E4D4917773D1C051747965989B62000968084F726547C55A8D514D6A
MD5 SHA1 SHA512 TLSH

Submit Download

20c2d0e1-7c94-4b59-b028-25be5ff73114.tmp

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\20c2d0e1-7c94-4b59-b028-25be5ff73114.tmp
Size 2KB
SHA256 ccb62062eacebd162f5538411860ee137de5c778b4f07ef76be22afeca30e6bd
MD5 bb2708c9ddb241fb2f8e777aad98f66e
SHA1 0025d33166d2a30d8f8dd4583ee2a773ebd58e1d
SHA512 f03919b1f97f38c180e2d8256f9ef6f0535ba4b32c4952506d8b13b0a929a46bbb66a066bce5c13c8121ecb3ee155012947ddeae46628d45031e8eb078348863
TLSH
T182519773BC54AB374DE25649F95A3F63ED3190A1E6912F9099EE0B1C01D729C1319C2F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3b8ee99816722e51b6a9f31ca1370c93c94fb12de35167f9953a8294630eceef
MD5 b70e7f8df99c7f2b7c0006cc93732f3c
SHA1 940f2640c9dbe6b3b91cc638f31b638fb846eccd
SHA512 15b4a3b5f9c5a7aae512e3fb1fe78f1cbafe61940b3d8bc06634a757914671affa25c1a7bc7436fbccbb2d41ae679b1e110d5cab3e0f8065b6e49ee8be3b9657
TLSH
T163D0123272011138D01466331006A1080502D20B400E8214542CC56D1E040611E078D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ae8404dfa357b15f63c427f20ea161557f660cb57fe02913707fac7b871ce4cb
MD5 d650f270e9d3c77caec1b326c1f8d78f
SHA1 eccaecf455761e8ab36b27d322a951224abe629f
SHA512 73cafab93f919eb6f1b025de4f1cdefe51d4c31e353e41536678225ddb916c51f88e5f9ba2987cb8be162b6b95cc8d6650859e0d073a1561341da7501bb5dc30
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 810e574fd026540d0adcb9c8c071c7cefbf3414e89184a8c837a61717c272b2d
MD5 cf3b2795079da160c4c2945e9d7dc9b5
SHA1 7bd3310982622336f7a6ce3200c8b8be04df079d
SHA512 50f14a9206c494c2df6114e831f2ff9e791dcf9759ed44e8144f2de118e016df5606fc71845e8cf6efffd80e930eed9287b73142e2ce74dfa70579218a4b5740
TLSH
T1B4B0129002CCD390CBA02F31CD81020A21208700830A02B3C1E0C1D5C8317C88B0F3C8
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\Preferences
Size 6KB
SHA256 6571a34fdd41b6169d4f0bd1c32a5b7dcf86402e1a54eac6a8e92a372409322d
MD5 8638f8c843e82ef919f78c62e48d85bb
SHA1 b891749924665381d06af8e7412d0626e681d3bd
SHA512 7864ccd643ece8f9650e7c31589881ec7a0380b22d62d6db89803b27421cd09f69c1873c14c16666c42aa010036dcef4045cb7555d43fc9fbd54714a0ed4bf46
SSDEEP 192:st000wofKZ8pa1t/S+WiT8KwYHnQuKMMC:stF0vVk/VRwBC
TLSH
T1A6E1A6426E286A774CC7E619BA35BB67E2F6502261D50E94EBFD861C04D66CC220BD0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5bf5c6.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\Preferences~RFe5bf5c6.TMP
Size 6KB
SHA256 908a9e7580444c54b03e5cd481f5efeb8833699705c869042277490e1e8be616
MD5 54ae1102375af48c280129a30a56a63e
SHA1 6e668f4f379cea958b5033f580526d9d964817e9
SHA512 d2b79c533b34767ceaf8e5160d8d505c7f1c7f18e3ce5678018d617b8c2c63d1044707a53feb60217c6ba8d881e620362228e38bb3e11f0d34a1c526458d400c
SSDEEP 192:st000w9fKZ8pa1t/S+WiT8KwYHnQuFMM8:stF0+Vk/VRwA8
TLSH
T120E195026E286A7B4CC7E619BA35FB67E2F6502265D50E94EBFD851C04D66CC220BD0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Local State
Size 1KB
SHA256 2644998dea4ecd4746403e09142ed38937e1ef375a4acad70ad1a8140a43b3c0
MD5 474c2ff7c608b5b6a235eac422b1e777
SHA1 ba6e90e169f21fb7de6902239710cebcb5dff64b
SHA512 01288f088e8a217901b61dd4084e9bec7d6a5e591807ceae871d1cb150711c0c676c013f2bedc0f314e35c4103da7e19ad6ebe835d1b10fb4d738b32b9d4d960
TLSH
T19E318573F4E02B326DC2568AF1662B9B6D108072D1810F84A1EE4B1C12E72CC563DC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Local State
Size 3KB
SHA256 7469432fbe965853f748b018199929934530d3bf0fa5dbb05dbf78f48be99336
MD5 ced7ae223b9601afedb47553cacc6f7f
SHA1 a82df31b55166980d5970611b519def659a13cb5
SHA512 0895340786ac60b608a340956d8968633c0129da94995b092f01bc995c9a4c08bc936780088bc533e0e88bcecdd456f28214b9ee4d1a8fafce23c13025a81274
TLSH
T194718322A8A4AA274EE29A45F8862B17BAA19033E5C13FA4C9FD0F0C01D73D81355C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Local State
Size 16KB
SHA256 3e6331af7eeed4b1d0737bb9a501304d70b123a7291cebedd9606377aa5cc552
MD5 c57fbabaa7b76c219d3cdf72dfc031b1
SHA1 17da997d304b508fe6b3f87ae2156182111553d2
SHA512 2db49288a33674ecad692185c78e18e0c7215e501d7da63db22fab0e385211aaa49928a38c4fb3d56087a520ad795a3cac96a17ff255213125e9e0944d55d044
SSDEEP 384:z9+aQikB+z/xvxjg/qhEwNb/beXVOhZ2U+9zY:s/UxvxjgC+tXohZ2U+FY
TLSH
T1B9729E3B64686E3369F3E905B95C1B5BDAB494B290C12EB88EFE5F0D06D73D80306C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5b55fc.TMP

Path C:\Users\Admin\AppData\Local\net.wearedevs.jjsploit\EBWebView\Local State~RFe5b55fc.TMP
Size 1KB
SHA256 eb88b290cd82acde734863638e57eb73376247b6a6f1373845c5a26cbbe7ba42
MD5 5746a27cdb5cce9200a1b5c8e207cee2
SHA1 5aeab17d2746f2d1573ce81056fb343e6adbb95b
SHA512 d2e2f5545cb751378a617dac3427312f0753ee9491192601ffc1c72d63d906679fd1621e04ebaf43f073f069a2a0f3530b583cf8faabc1ab96e38afaeaf0d696
TLSH
T170216273E8E06B32ADC15589F1667B8B2D1080B2E1800F48A0EE071D12EB2DC863EC37
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Studio.lnk

Path C:\Users\Admin\Desktop\Roblox Studio.lnk
Size 1KB
SHA256 ace8903753f65bda1e1a0a4cb67d69ba0e24bb2b58db7149294b6d8a0ea2d4ca
MD5 6595fe9e58fa6c2f794c72c33ab4f64c
SHA1 59ec58b6b6c9d75367995730dde6558fcc1c7979
SHA512 961a341e6ea24ccc442e8f5de8c578f0b7d4465a6a613e14b1e46470e15268bafa6ea1f0abaa7e91accc59ffa33e36a9325ac225fa6e09764f11f830a7080bc6
TLSH
T1D0217F154BB21726F1B2873679B66753DA337C41EA1B1F7BC5C50249097020059A8F2B
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 13.0MB
SHA256 6819f279a5f123fb453c9b9192fe98802a896973b0652115fe3a1c06f1c2345f
MD5 be4ee7c43bebc9dbe029421e585419eb
SHA1 39906c7fa61061f19038a387e4ea1ef0151b0f8b
SHA512 9c01a4814685865f3939841163c528945fcb912f7ea0800173c2920953a139c2f07fb8988080263468533b6091f0f8eb9cf8b7992568386915a5ff1d07bf4555
SSDEEP 196608:Es6Sk0cVzmY5pSVlYL8dg7CwqOrNN5QCJ1IsvE:ErpVzTSVlYgdgOwqcYCz7E
TLSH
T186D69D6AA2B800E9D4BBD17CC6565603EBB1B41603709BDF16A046FA1F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjsploit.exe.crdownload

Path C:\Users\Admin\Downloads\jjsploit.exe.crdownload
Size 13.5MB
SHA256 57001e0087ac817c0ecea5d5bdbbbd8d0f63919815351f290fafbde44895fa83
MD5 00558be97c3ba5f3e5f5859b8dfdc43b
SHA1 25431d9b16af6a713c02a03a75b4bcea313323cd
SHA512 d451474eb0a697b60e51d1a31f4e824def631ef21af7b73adbb6b5aa163a53a7761c3de6075abd517356c1e3a297d3b7219ce6af0c478ae05b22be7f928a822b
SSDEEP 196608:3iRaStJlBRlVdAWq4tB8Nr1JP/MYdRpW6:yRBtJlBRlVdAWq4/Y5/MY9x
TLSH
T189E60865BA5B99ACD09BC47083468A67497134CB0B35A8FF40C4963C2F7EBF46F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-2477-0x00007FF8E2390000-0x00007FF8E2391000-memory.dmp

Download

memory/6456-2361-0x00007FF8E2390000-0x00007FF8E2391000-memory.dmp

Download

memory/6456-2586-0x0000021482E00000-0x0000021482F15000-memory.dmp

Download

memory/6456-2585-0x0000021482700000-0x0000021482BB8000-memory.dmp

Download

memory/6456-2618-0x0000021482700000-0x0000021482BB8000-memory.dmp

Download

memory/7124-2411-0x00007FF8E2390000-0x00007FF8E2391000-memory.dmp

Download

memory/7124-2410-0x00007FF8E26E0000-0x00007FF8E26E1000-memory.dmp

Download