aaf407d1a222bf586f493573e865f66d40e4bd283b79fc3340e72c9641155bca

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JammVPN-x64.exe
Size 20.7MB
Sample261102-dbqkfass3j
SHA256 aaf407d1a222bf586f493573e865f66d40e4bd283b79fc3340e72c9641155bca
MD5 94e37b75e42b2b671b3decfda63bff78
SHA1 f59247c7b8ecdeabd6f65e33712c2afb75524f7a
SHA512 43ec6615e32230e01a29cd152abca9126053872f83f3689bbf890c090dd0a734067ef11e6d4afe691b4f941df6e0b2a2fa8a6344bb45b5b7f329483e339984aa
SSDEEP 196608:saDCTbm0CqeVWEMkl5fz8xGqtcGeQWC3EXAGQw7wKkg:NybRe0nklNz8szGbWmNw7U
TLSH
T1EC2728213A5B996DD09AC4B4C3464A775E6130DB1B36B9FB448486393F7ABF42F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JammVPN-x64.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1319500393\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1886517800\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_107244318\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_107244318\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_784910860\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_784910860\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_107244318\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_784910860\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_784910860\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1319500393\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1319500393\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1886517800\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1886517800\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_107244318\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1319500393\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1319500393\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_107244318\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_784910860\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1319500393\manifest.json	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	JammVPN-x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	JammVPN-x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4548	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	msedgewebview2.exe
4164	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5672	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5968	JammVPN-x64.exe
5968	JammVPN-x64.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5968	JammVPN-x64.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 4548	5968	JammVPN-x64.exe	88
PID 5968 wrote to memory of 5672	5968	JammVPN-x64.exe	90
PID 5672 wrote to memory of 4480	5672	msedgewebview2.exe	91
PID 5672 wrote to memory of 4124	5672	msedgewebview2.exe	92
PID 5672 wrote to memory of 4124	5672	msedgewebview2.exe	92
PID 5672 wrote to memory of 4124	5672	msedgewebview2.exe	92
PID 5672 wrote to memory of 4124	5672	msedgewebview2.exe	92
PID 5672 wrote to memory of 5076	5672	msedgewebview2.exe	93
PID 5672 wrote to memory of 3324	5672	msedgewebview2.exe	94
PID 5672 wrote to memory of 3324	5672	msedgewebview2.exe	94
PID 5672 wrote to memory of 3324	5672	msedgewebview2.exe	94
PID 5672 wrote to memory of 720	5672	msedgewebview2.exe	95
PID 5672 wrote to memory of 720	5672	msedgewebview2.exe	95
PID 5672 wrote to memory of 720	5672	msedgewebview2.exe	95
PID 5672 wrote to memory of 720	5672	msedgewebview2.exe	95
PID 5672 wrote to memory of 720	5672	msedgewebview2.exe	95
PID 5672 wrote to memory of 1492	5672	msedgewebview2.exe	99
PID 5672 wrote to memory of 1492	5672	msedgewebview2.exe	99
PID 5672 wrote to memory of 1492	5672	msedgewebview2.exe	99
PID 5672 wrote to memory of 1056	5672	msedgewebview2.exe	100
PID 5672 wrote to memory of 1056	5672	msedgewebview2.exe	100
PID 5672 wrote to memory of 1056	5672	msedgewebview2.exe	100
PID 5672 wrote to memory of 5956	5672	msedgewebview2.exe	101
PID 5672 wrote to memory of 5956	5672	msedgewebview2.exe	101
PID 5672 wrote to memory of 5956	5672	msedgewebview2.exe	101
PID 5672 wrote to memory of 4164	5672	msedgewebview2.exe	102
PID 5672 wrote to memory of 2544	5672	msedgewebview2.exe	103
PID 5672 wrote to memory of 2544	5672	msedgewebview2.exe	103
PID 5672 wrote to memory of 2544	5672	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\JammVPN-x64.exe
"C:\Users\Admin\AppData\Local\Temp\JammVPN-x64.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
  2⤵
  - Modifies registry key
  PID:4548
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5968.108.744060911836727641 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView /prefetch:4 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x170,0x194,0x7fff320a5fd8,0x7fff320a5fe4,0x7fff320a5ff0
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1792,i,11557671058805744964,12253768184638509466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2040 --field-trial-handle=1792,i,11557671058805744964,12253768184638509466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1792,i,11557671058805744964,12253768184638509466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1792,i,11557671058805744964,12253768184638509466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4 /prefetch:1
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=1792,i,11557671058805744964,12253768184638509466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1792,i,11557671058805744964,12253768184638509466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=1792,i,11557671058805744964,12253768184638509466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4392 --field-trial-handle=1792,i,11557671058805744964,12253768184638509466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView" --webview-exe-name=JammVPN-x64.exe --webview-exe-version=0.1.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4296 --field-trial-handle=1792,i,11557671058805744964,12253768184638509466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4fd5a381d67551cb3c92ddb0297420575274bb4
    3⤵
    PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

90983ec9-3296-4b44-9937-f27c5e7ce233.tmp

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\90983ec9-3296-4b44-9937-f27c5e7ce233.tmp
Size 15KB
SHA256 bdaea10c5dc91a5da878c70c0d2ca4d9dd3e325a845486973395204bbff22f9d
MD5 cedbf9bc97fcfe20cf38867c5b7116d4
SHA1 d330e805a56d05f268dadee38734f8b57e667dd8
SHA512 63b0a49f8023a86d27b1141f5b9cb221d69a5c33c8afb8b47a5cef093767cdd938d24c101e1b761700ed536af7f9705221d8f6933d44573bb3377cb98850f361
SSDEEP 384:2+OBqImmJvGBLx3NaFMJFNNBSHgRw031g6rs:jcvGtlNo+/A
TLSH
T1D672AE7B287A5B6338F7C909BA8E374BCB696293C0D577E8DCEC9F1E116B0441351815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92e52801-7d05-47bb-a54b-0320d2e1acca.tmp

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\92e52801-7d05-47bb-a54b-0320d2e1acca.tmp
Size 3KB
SHA256 2017e0347de3cd93a2032a844475b5f01265f6da3df0a725f4777f3936a8bb22
MD5 a154aac6551834201b160c838e17a119
SHA1 796baa15bde279ca9d935b712b30f5d85f5b498a
SHA512 0690166bad921d709c6090657488c32d802c2968e79f2d1e212d2d20e27bbe6962362a6072be5f6e26c704e64bbb5ed3e78829ebeaf989fb4645cb9152d10752
TLSH
T1DC61A7776975A67B5AE2DA05B8863F06EB699023D5813F95C5EC0F1C00D72982382C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e0ebbf9aaca0037b78ece60dc4bb20d898df388b32399a0e0d589a867792b64d
MD5 1a5ed1b840c1e6ecf781a7597d1e7577
SHA1 ab8ebba19d5c890bb2c7681d12f33e5d335e3214
SHA512 105337c4dfaab7956a5c4c1578503d32b0040259f819eb280591281159f8d94838aa667cc479dc11428d510b71dd2aa5fb2fda5ad076c0739239482526c93b17
TLSH
T184D0245333014374CC3034730403710D1443C11FC1054045D47CD7FD1F040740D03441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8c99895ef497e61a9ddcb6c466aa5b3fafa3ab20bd1eb5efe08b105fef7dcd10
MD5 c285ace9f2e18db2074713e6ada5a598
SHA1 99f56d116cf93508b5f192633b700eb158f197ac
SHA512 23b6176f6351b8f51aba00225e05634c14fbc2eefbf58ba408bb960aba43334531d0dc76961de4005a67aa6598f25fa765aa9b33a5e676ae100d7ea6707fb801
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

21e12259-f2b3-43d0-85a9-3284d5972604.tmp

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Default\21e12259-f2b3-43d0-85a9-3284d5972604.tmp
Size 6KB
SHA256 7662d59886e18b694288b08288ad2df02afc6636389faba332750e1523fbd8f6
MD5 b6b39bbe493f09343b268141be14bbcf
SHA1 7429e26e2cf606a38372c590e7455f7b6a6bdf01
SHA512 b445578ce9d1e746595482dfaa33d7b870b873460049bf83e40c56c4aa181d34bb65ed8404f49279ea97ac7b63a0d27caa8361c1614a06003d46b5dce1777b0e
SSDEEP 96:st3/dM+k0iNQb9tkNo5h16Z0us7/x+6MhmuecJ9y1eje6K+g2MU28XM1C7K:stPOp2EonusV+Fd9yQjGMNG6K
TLSH
T115D196025E24B9BB5CC6E509FA39BA0BE3F9A07161D52D58E7FD462C08DB5CC2207D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 10d0ac487f2f26d0596c098fdda5b87367d446f123a46ef10eecbcb03b21f7e1
MD5 5cd5d2e22878886943b7b276b61345c9
SHA1 2273dbd2c86f67d64b5697f180c907fba9ccfff6
SHA512 86ecf830f693d3e4dce44ab033a6726182c22c164796babb506e2e3e65b122ff1ffd630d1d7e8b290857f5cab39a6721dfa412885d0097fa4299513950dcd61a
TLSH
T173B002B4882A010AC2105B7591C371D0F374ED2442132A86CBD349F5F7B57A3C2A915C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8fda712480f0d06e689964d03c7c0d1207da4b1c89eaa32c0ee4e027c4511e60
MD5 e0cd5bb2b56500cf0dcedf63d0ed23d4
SHA1 537c538fd883f4af6575deabea60fe33b7a81e2d
SHA512 984ee2156d771fbeec21191409d4a1b50530c6520214ee7eb68ac329538af949141e1e9527569a43d4af368f99716ff11511dbb58a0dd2250e0e8a32efd8c34b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d558bab6-dd10-4b6f-b2c0-525ffcb0423e.tmp

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Default\Network\d558bab6-dd10-4b6f-b2c0-525ffcb0423e.tmp
Size 821B
SHA256 94f08e3ca1b50af34117351e4f7c717eb32c84a0319ca8a77ca38af840536869
MD5 5199e221fec2fed1d2c14446dca557d0
SHA1 2002f041c2b26c288dad4093aa7eb2d2263ee0b4
SHA512 ecc54e0e00824be8db073356c4f389277cd5a18afde80ea779dea562b0b50281081e7eb92ca82b7b4f3ac950acce4fbbe5887ad6089982243dec844146fa7d74
TLSH
T11F016BA2C3D4C67D8A4116E426347827CD2E051992282D27CDEAEFDA67E1075D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e555124f-2e89-4e71-a3fb-255cd0c3ef23.tmp

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Default\e555124f-2e89-4e71-a3fb-255cd0c3ef23.tmp
Size 6KB
SHA256 b831cf04e9e1be70aafcaaae1c64cc009e51b8fc8df1eba73aed3a86ed9ef6b6
MD5 aed526c7b1d8bd08c771e5bca02286eb
SHA1 b2bbccf0d21d4dcc48e0c9a515dbdb5835027dfe
SHA512 272c0233cf13c738ac5a46cf32d4f719a6bcd8594cee9ae6f65ed3a3262f2907a9c53b20e0de25ac4d253635dcea151c9056e1f8a81d5bfe0a5259ae8de3d92b
SSDEEP 96:st3/dM+k0ZGNQb9tkNo5h16Z0us7/x+6MhmuecJ9y1eje6K+g27+528XM1C7K:stPOpsEonusV+Fd9yQjGMCG6K
TLSH
T153D1A7025E24B9BB4CC7E519FA397A1BE3F9A071A1952D48E7FD462C04DB5CC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\Local State
Size 1KB
SHA256 5b98ec102b04dbde4b4ed18d943c7c25cd5e68d242698dcd9b2a92e6d2a46556
MD5 3aa9b51b4f0172005bfbf0e41f3e82d8
SHA1 5f4879f7512689b5a736a71cbd4f62c316c36420
SHA512 5c26f7eaf472db2be0a3af44001c120e4526bb2524b168d6432bfa1ee0fd9955519a9a8a6e1c30a99d67db4d4df777adfa97ab12666ce993ff9e95f83d3d67e1
TLSH
T1C12172B3E8BA6731A981660A75077F479F34A067C1518900D4CE4B2801E601EBAAAC37
MD5 SHA1 SHA512 TLSH

Submit Download

ebb3212b-4aac-46fc-a36a-2ccbee2225cd.tmp

Path C:\Users\Admin\AppData\Local\com.jammvpn.app\EBWebView\ebb3212b-4aac-46fc-a36a-2ccbee2225cd.tmp
Size 2KB
SHA256 130b41671265eca61093732c6636871ac487e06732aa59e325117055ff63e3d0
MD5 80ad02c08dbc6b33fe6a249c3cfcf506
SHA1 72c46decb1f2dbf17bca0d10cc2a0c1b919f0337
SHA512 f90c141c13bd3515f1d0e8335f5cdc8ab7888f9e006fe5bba925b0bbcfdc88577acbfecdeb58a8b00df3df7ffdfd39b446f2d8cdd192bc837d97cee5d88fbbfa
TLSH
T11B5175736C26A77696E29619B94B3F13DF39A0A2DA522F50D9DD0B2800D711D2386C37
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_107244318\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_1886517800\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5672_784910860\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

memory/720-101-0x00007FFF52D20000-0x00007FFF52D21000-memory.dmp

Download

memory/1492-249-0x00007FFF54A10000-0x00007FFF54A11000-memory.dmp

Download

memory/1492-248-0x00007FFF52D20000-0x00007FFF52D21000-memory.dmp

Download

memory/4124-25-0x00007FFF52D20000-0x00007FFF52D21000-memory.dmp

Download

memory/4164-348-0x0000022B23FF0000-0x0000022B23FF1000-memory.dmp

Download

memory/4164-346-0x0000022B23FF0000-0x0000022B23FF1000-memory.dmp

Download

memory/4164-354-0x0000022B23FF0000-0x0000022B23FF1000-memory.dmp

Download

memory/4164-356-0x0000022B23FF0000-0x0000022B23FF1000-memory.dmp

Download

memory/4164-357-0x0000022B23FF0000-0x0000022B23FF1000-memory.dmp

Download

memory/4164-355-0x0000022B23FF0000-0x0000022B23FF1000-memory.dmp

Download

memory/4164-353-0x0000022B23FF0000-0x0000022B23FF1000-memory.dmp

Download

memory/4164-352-0x0000022B23FF0000-0x0000022B23FF1000-memory.dmp

Download