0635ad719fac6ececacd54f5a9905ebe6fb869446a39c3396865207aa035a88d

Analysis

max time kernel
151s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dns-jumper.exe
Size 27.4MB
Sample261107-mxvwqaxxfv
SHA256 0635ad719fac6ececacd54f5a9905ebe6fb869446a39c3396865207aa035a88d
MD5 e716cdf819b1019ff9901a2c99a60962
SHA1 1d27fa0e5971564bd41a6f53d32ce781a299034a
SHA512 81406acbf1453d2c2429e3812546c952c62f58aca19ccc4ea9b5d7b34d0cb8217221d327e3339740cd4607236f34159084af745f237ee008aa7d75dfb1188a3c
SSDEEP 393216:BtZlu5LxQc66yGhAbD8Uwp6XOblL0qpqT6g:BtZlu5LxQc66yGhAbzrX9qA2
TLSH
T13B5717617B5A9968D19AC47483478AB24E7130DB0B35BAFF449496383F7DBF42F38218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	178	45.90.28.0	1768	dns-jumper.exe
Destination IP	267	149.112.112.10	1768	dns-jumper.exe
Destination IP	314	94.140.14.140	1768	dns-jumper.exe
Destination IP	60	185.228.168.168	1768	dns-jumper.exe
Destination IP	72	185.222.222.222	1768	dns-jumper.exe
Destination IP	246	5.1.66.255	1768	dns-jumper.exe
Destination IP	378	86.54.11.1	1768	dns-jumper.exe
Destination IP	419	86.54.11.213	1768	dns-jumper.exe
Destination IP	465	91.239.100.100	1768	dns-jumper.exe
Destination IP	468	194.242.2.2	1768	dns-jumper.exe
Destination IP	471	101.101.101.101	1768	dns-jumper.exe
Destination IP	154	1.0.0.1	1768	dns-jumper.exe
Destination IP	216	176.9.93.198	1768	dns-jumper.exe
Destination IP	474	101.102.103.104	1768	dns-jumper.exe
Destination IP	82	185.228.168.10	1768	dns-jumper.exe
Destination IP	90	46.226.109.82	1768	dns-jumper.exe
Destination IP	133	45.11.45.11	1768	dns-jumper.exe
Destination IP	61	45.90.28.0	1768	dns-jumper.exe
Destination IP	320	86.54.11.201	1768	dns-jumper.exe
Destination IP	353	94.140.14.140	1768	dns-jumper.exe
Destination IP	440	86.54.11.213	1768	dns-jumper.exe
Destination IP	50	5.1.66.255	1768	dns-jumper.exe
Destination IP	51	116.202.176.26	1768	dns-jumper.exe
Destination IP	134	176.9.93.198	1768	dns-jumper.exe
Destination IP	383	94.140.15.15	1768	dns-jumper.exe
Destination IP	452	208.67.220.220	1768	dns-jumper.exe
Destination IP	101	1.0.0.2	1768	dns-jumper.exe
Destination IP	57	185.228.168.9	1768	dns-jumper.exe
Destination IP	68	46.226.109.82	1768	dns-jumper.exe
Destination IP	89	95.215.19.53	1768	dns-jumper.exe
Destination IP	111	45.90.30.0	1768	dns-jumper.exe
Destination IP	205	185.228.168.9	1768	dns-jumper.exe
Destination IP	303	86.54.11.200	1768	dns-jumper.exe
Destination IP	345	149.112.112.112	1768	dns-jumper.exe
Destination IP	195	49.12.67.122	1768	dns-jumper.exe
Destination IP	244	46.226.109.82	1768	dns-jumper.exe
Destination IP	310	194.242.2.3	1768	dns-jumper.exe
Destination IP	332	94.140.14.15	1768	dns-jumper.exe
Destination IP	375	94.140.14.140	1768	dns-jumper.exe
Destination IP	153	49.12.67.122	1768	dns-jumper.exe
Destination IP	285	149.112.112.11	1768	dns-jumper.exe
Destination IP	451	86.54.11.213	1768	dns-jumper.exe
Destination IP	470	194.242.2.4	1768	dns-jumper.exe
Destination IP	184	1.1.1.2	1768	dns-jumper.exe
Destination IP	271	9.9.9.11	1768	dns-jumper.exe
Destination IP	384	94.140.14.15	1768	dns-jumper.exe
Destination IP	458	86.54.11.212	1768	dns-jumper.exe
Destination IP	113	185.95.218.42	1768	dns-jumper.exe
Destination IP	146	1.0.0.2	1768	dns-jumper.exe
Destination IP	189	1.0.0.2	1768	dns-jumper.exe
Destination IP	241	49.12.67.122	1768	dns-jumper.exe
Destination IP	335	94.140.14.14	1768	dns-jumper.exe
Destination IP	52	116.203.32.217	1768	dns-jumper.exe
Destination IP	112	74.82.42.42	1768	dns-jumper.exe
Destination IP	162	176.9.93.198	1768	dns-jumper.exe
Destination IP	278	149.112.112.11	1768	dns-jumper.exe
Destination IP	349	86.54.11.100	1768	dns-jumper.exe
Destination IP	382	94.140.14.141	1768	dns-jumper.exe
Destination IP	392	86.54.11.200	1768	dns-jumper.exe
Destination IP	423	208.67.220.220	1768	dns-jumper.exe
Destination IP	88	185.95.218.42	1768	dns-jumper.exe
Destination IP	147	185.228.168.10	1768	dns-jumper.exe
Destination IP	370	94.140.14.15	1768	dns-jumper.exe
Destination IP	450	86.54.11.13	1768	dns-jumper.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dns-jumper.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1240	powershell.exe
2592	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1829916145\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1829916145\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1829916145\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1829916145\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1331216444\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1829916145\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1331216444\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Mu\Staging	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1240	powershell.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	dns-jumper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dns-jumper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dns-jumper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies system certificate store 2 TTPs 23 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9F5FD91A546DF50C71F0EE7ABD1749988473E239\Blob = 190000000100000010000000cc8539733a8c4f09d4efc4660adde0170300000001000000140000009f5fd91a546df50c71f0ee7abd1749988473e2391d00000001000000100000002bf3b3cbd9a9f3bd53c744ef9e49057c140000000100000014000000898f2fa3e82ba014547bf356b8265f67380b9cd0090000000100000016000000301406082b0601050507030206082b0601050507030153000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0620000000100000020000000c32ffd9f46f936d16c3673990959434b9ad60aafbb9e7cf33654f144cc1ba1430b000000010000003a000000530053004c002e0063006f006d00200054004c0053002000450043004300200052006f006f0074002000430041002000320030003200320000000f0000000100000030000000329a12d428629d160e107f49b36d0d96123963b7fa552b63b3807131c3abfa881f01aa662a3148fb71abd06f4929ef8620000000010000003e0200003082023a308201c0a00302010202101403f5abfb378b17405be243b2a5d1c4300a06082a8648ce3d040303304e310b300906035504061302555331183016060355040a0c0f53534c20436f72706f726174696f6e3125302306035504030c1c53534c2e636f6d20544c532045434320526f6f742043412032303232301e170d3232303832353136333334385a170d3436303831393136333334375a304e310b300906035504061302555331183016060355040a0c0f53534c20436f72706f726174696f6e3125302306035504030c1c53534c2e636f6d20544c532045434320526f6f7420434120323032323076301006072a8648ce3d020106052b810400220362000445293573fac2b823ce147da8b14da05b36ee2a2c53c3600935b224662669c0b395d65d9240190ec6a51370f4ef1251285de7ccbdf93c85c1cf9490c92bce9242585967fd942710648c4f04b14d49e47b4f9bf5e708f80388f7a7c3924b195481a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014898f2fa3e82ba014547bf356b8265f67380b9cd0301d0603551d0e04160414898f2fa3e82ba014547bf356b8265f67380b9cd0300e0603551d0f0101ff040403020186300a06082a8648ce3d0403030368003065023055e32256e9d79224584f1e94320f0c0236c2fdac74324ee1fb1c8088a3ccfbd7eb2bff377df0edd79e756a35765245e0023100c78d6f42208fbeb64d59ed774d29c420204564863a50c6c4ad2d93f5187d72eda9cfc4ac5736280865df3c79667ea0ea	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9F5FD91A546DF50C71F0EE7ABD1749988473E239\Blob = 5c000000010000000400000080010000190000000100000010000000cc8539733a8c4f09d4efc4660adde0170300000001000000140000009f5fd91a546df50c71f0ee7abd1749988473e2391d00000001000000100000002bf3b3cbd9a9f3bd53c744ef9e49057c140000000100000014000000898f2fa3e82ba014547bf356b8265f67380b9cd0090000000100000016000000301406082b0601050507030206082b0601050507030153000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0620000000100000020000000c32ffd9f46f936d16c3673990959434b9ad60aafbb9e7cf33654f144cc1ba1430b000000010000003a000000530053004c002e0063006f006d00200054004c0053002000450043004300200052006f006f0074002000430041002000320030003200320000000f0000000100000030000000329a12d428629d160e107f49b36d0d96123963b7fa552b63b3807131c3abfa881f01aa662a3148fb71abd06f4929ef866b0000000100000020000000c32ffd9f46f936d16c3673990959434b9ad60aafbb9e7cf33654f144cc1ba14320000000010000003e0200003082023a308201c0a00302010202101403f5abfb378b17405be243b2a5d1c4300a06082a8648ce3d040303304e310b300906035504061302555331183016060355040a0c0f53534c20436f72706f726174696f6e3125302306035504030c1c53534c2e636f6d20544c532045434320526f6f742043412032303232301e170d3232303832353136333334385a170d3436303831393136333334375a304e310b300906035504061302555331183016060355040a0c0f53534c20436f72706f726174696f6e3125302306035504030c1c53534c2e636f6d20544c532045434320526f6f7420434120323032323076301006072a8648ce3d020106052b810400220362000445293573fac2b823ce147da8b14da05b36ee2a2c53c3600935b224662669c0b395d65d9240190ec6a51370f4ef1251285de7ccbdf93c85c1cf9490c92bce9242585967fd942710648c4f04b14d49e47b4f9bf5e708f80388f7a7c3924b195481a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014898f2fa3e82ba014547bf356b8265f67380b9cd0301d0603551d0e04160414898f2fa3e82ba014547bf356b8265f67380b9cd0300e0603551d0f0101ff040403020186300a06082a8648ce3d0403030368003065023055e32256e9d79224584f1e94320f0c0236c2fdac74324ee1fb1c8088a3ccfbd7eb2bff377df0edd79e756a35765245e0023100c78d6f42208fbeb64d59ed774d29c420204564863a50c6c4ad2d93f5187d72eda9cfc4ac5736280865df3c79667ea0ea	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 19000000010000001000000011a2b3490cb6c379a89e76c3569452d7030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd82000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c0000000100000004000000800100006b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 6b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc650f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a19000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	dns-jumper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9F5FD91A546DF50C71F0EE7ABD1749988473E239	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25\Blob = 0f00000001000000200000007a9bc7ffecf427111c5a2e5bf589ffff1ee95fef12b3cc42764d7c907a3f6959530000000100000081000000307f3020060a6086480186f92f00060930123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c03021060b6086480186f92f00060e0130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b000000010000003e0000004900640065006e0054007200750073007400200043006f006d006d00650072006300690061006c00200052006f006f0074002000430041002000310000006200000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae140000000100000014000000ed4419c0d3f0068beea47bbe42e72654c88e36761d000000010000001000000066908ed134572466070299553e6e2b99030000000100000014000000df717eaa4ad94ec9558499602d48de5fbcf03a252000000001000000640500003082056030820348a00302010202100a0142800000014523c844b500000002300d06092a864886f70d01010b0500304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f742043412031301e170d3134303131363138313232335a170d3334303131363138313232335a304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100a75019de3f993dd43346f16f516182b2a94f8f67895d84d953dd0c28d9d7f0ffae95437299f9b55d7c8ac142e1315074d1810d7ccd9b21ab43e2acad5e866ef3098a1f5a32bda2eb94f9e85c0aecff98d2af71b3b4539f4e87ef92bcbdec4f3230884b175e57c453c2f602978dd9622bbf241f628ddfc3b8294b49783c93608822fc99da36c8c2a2d42c540067356e73bf0258f0a4dde5b0a2267acae036a51916f5fdb7efae3f40f56d5a04fdce34ca24dc74231b5d3313125dc40125f630dd025d9fe0d547bdb4eb1ba1bb4949d89f5b02f38ae42490e4624f4fc1af8b0e7417a8d172886a7a0149ccb44679c617b1da981e0759fa75218565dd9056cefbaba5609dc49df952b08bbd87f98f2b230a23763bf733e1c900f369f94ba2e04ebc7e93398407f744707efe075ae5b1acd118ccf235e5494908ca56c93dfb0f187d8b3bc113c24d8fc94f0e37e91fa10e6adf622ecb350651792cc82538f4fa4ba7895c9cd2e30d39864a747cd55987c23f4e0c5c52f43df75282f1eaa3acfd49341a28f341883a13eee8deff991d5fbacbe81ef2b95060c031d373e5efbea0ed330b74be2020c4676cf008037a55807f464e96a7f41e3ee1f6d809e133642b63d7325e9ff9c07b0f786f97bc939af99c1290787a808715d772749c557478b1bae16e7004ba4fa0ba68c37bff31f0733d3d942ab10b410ea0fe4d88656b7933b4d70203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ed4419c0d3f0068beea47bbe42e72654c88e3676300d06092a864886f70d01010b050003820201000dae9032f6a64b7c447619611e2728cd5e54ef25bce30890f929d7ae6808e1940058ef2e2e7e53528cb65c07ea88ba998b5094d78280df61090093ad0d14e6cec1f2379478b05f9cb3a273b88f059338cd8d3eb0b8fbc0cfb1f2ec2d2d1bccecaa9ab3aa60821b2d3bc3843d578a961e9c75b8d330cd60088390d38e54f14d66c05d740340a3ee857ec21f779c06e8c1a7185d5295edc9dd259e6dfaa9eda33a34d0597bdaed50f335bfedeb144d31c760f4daf1879ce248e2c6c537fb0610fa755966314729da769a1ce982aeef9ab951f788239a6995623ce5558036d75402fff1b95dced4236fd845844a5b65ef890cdd14a720cb18a525b40df901f0a2d2f400c8748ea12a488e65db13c4e225177debbe875b17205451934a53030bec5dca33ed62fd45c72f5bdc58a08039e6fad7fe1314a6ed3d944a4274d4c3775973cd8f46be5538effae89132ea97580422de38c3ccbc6dc9333a6a0a693fa0c8ea728f8c638623bd6d3c969e95e0494caaa2b92a1b9c368178edc3e846e2265944751ed9758951cd10849d6160cb5df997224d8e98e6e37ff65bbbaecdca4a816b5e0bf351e1742be97e27a7d999494ef8a580db250f1c63628ac933676b3c1083c6addea8cd168e8df00737719ff2abfc41f5c18bec00375d09e54e80effab15c3806a51b4ae1dc382d3cdcab1f901ad54a9ceed1706ccceef457f818ba846e87	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25\Blob = 6b00000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae0f00000001000000200000007a9bc7ffecf427111c5a2e5bf589ffff1ee95fef12b3cc42764d7c907a3f6959530000000100000081000000307f3020060a6086480186f92f00060930123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c03021060b6086480186f92f00060e0130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b000000010000003e0000004900640065006e0054007200750073007400200043006f006d006d00650072006300690061006c00200052006f006f0074002000430041002000310000006200000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae140000000100000014000000ed4419c0d3f0068beea47bbe42e72654c88e36761d000000010000001000000066908ed134572466070299553e6e2b99030000000100000014000000df717eaa4ad94ec9558499602d48de5fbcf03a251900000001000000100000002e43cb5682e3a1756f80fc53cfbff8252000000001000000640500003082056030820348a00302010202100a0142800000014523c844b500000002300d06092a864886f70d01010b0500304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f742043412031301e170d3134303131363138313232335a170d3334303131363138313232335a304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100a75019de3f993dd43346f16f516182b2a94f8f67895d84d953dd0c28d9d7f0ffae95437299f9b55d7c8ac142e1315074d1810d7ccd9b21ab43e2acad5e866ef3098a1f5a32bda2eb94f9e85c0aecff98d2af71b3b4539f4e87ef92bcbdec4f3230884b175e57c453c2f602978dd9622bbf241f628ddfc3b8294b49783c93608822fc99da36c8c2a2d42c540067356e73bf0258f0a4dde5b0a2267acae036a51916f5fdb7efae3f40f56d5a04fdce34ca24dc74231b5d3313125dc40125f630dd025d9fe0d547bdb4eb1ba1bb4949d89f5b02f38ae42490e4624f4fc1af8b0e7417a8d172886a7a0149ccb44679c617b1da981e0759fa75218565dd9056cefbaba5609dc49df952b08bbd87f98f2b230a23763bf733e1c900f369f94ba2e04ebc7e93398407f744707efe075ae5b1acd118ccf235e5494908ca56c93dfb0f187d8b3bc113c24d8fc94f0e37e91fa10e6adf622ecb350651792cc82538f4fa4ba7895c9cd2e30d39864a747cd55987c23f4e0c5c52f43df75282f1eaa3acfd49341a28f341883a13eee8deff991d5fbacbe81ef2b95060c031d373e5efbea0ed330b74be2020c4676cf008037a55807f464e96a7f41e3ee1f6d809e133642b63d7325e9ff9c07b0f786f97bc939af99c1290787a808715d772749c557478b1bae16e7004ba4fa0ba68c37bff31f0733d3d942ab10b410ea0fe4d88656b7933b4d70203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ed4419c0d3f0068beea47bbe42e72654c88e3676300d06092a864886f70d01010b050003820201000dae9032f6a64b7c447619611e2728cd5e54ef25bce30890f929d7ae6808e1940058ef2e2e7e53528cb65c07ea88ba998b5094d78280df61090093ad0d14e6cec1f2379478b05f9cb3a273b88f059338cd8d3eb0b8fbc0cfb1f2ec2d2d1bccecaa9ab3aa60821b2d3bc3843d578a961e9c75b8d330cd60088390d38e54f14d66c05d740340a3ee857ec21f779c06e8c1a7185d5295edc9dd259e6dfaa9eda33a34d0597bdaed50f335bfedeb144d31c760f4daf1879ce248e2c6c537fb0610fa755966314729da769a1ce982aeef9ab951f788239a6995623ce5558036d75402fff1b95dced4236fd845844a5b65ef890cdd14a720cb18a525b40df901f0a2d2f400c8748ea12a488e65db13c4e225177debbe875b17205451934a53030bec5dca33ed62fd45c72f5bdc58a08039e6fad7fe1314a6ed3d944a4274d4c3775973cd8f46be5538effae89132ea97580422de38c3ccbc6dc9333a6a0a693fa0c8ea728f8c638623bd6d3c969e95e0494caaa2b92a1b9c368178edc3e846e2265944751ed9758951cd10849d6160cb5df997224d8e98e6e37ff65bbbaecdca4a816b5e0bf351e1742be97e27a7d999494ef8a580db250f1c63628ac933676b3c1083c6addea8cd168e8df00737719ff2abfc41f5c18bec00375d09e54e80effab15c3806a51b4ae1dc382d3cdcab1f901ad54a9ceed1706ccceef457f818ba846e87	dns-jumper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	dns-jumper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df06b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25\Blob = 1900000001000000100000002e43cb5682e3a1756f80fc53cfbff825030000000100000014000000df717eaa4ad94ec9558499602d48de5fbcf03a251d000000010000001000000066908ed134572466070299553e6e2b99140000000100000014000000ed4419c0d3f0068beea47bbe42e72654c88e36766200000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae0b000000010000003e0000004900640065006e0054007200750073007400200043006f006d006d00650072006300690061006c00200052006f006f00740020004300410020003100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b06010505070308530000000100000081000000307f3020060a6086480186f92f00060930123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c03021060b6086480186f92f00060e0130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000200000007a9bc7ffecf427111c5a2e5bf589ffff1ee95fef12b3cc42764d7c907a3f69592000000001000000640500003082056030820348a00302010202100a0142800000014523c844b500000002300d06092a864886f70d01010b0500304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f742043412031301e170d3134303131363138313232335a170d3334303131363138313232335a304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100a75019de3f993dd43346f16f516182b2a94f8f67895d84d953dd0c28d9d7f0ffae95437299f9b55d7c8ac142e1315074d1810d7ccd9b21ab43e2acad5e866ef3098a1f5a32bda2eb94f9e85c0aecff98d2af71b3b4539f4e87ef92bcbdec4f3230884b175e57c453c2f602978dd9622bbf241f628ddfc3b8294b49783c93608822fc99da36c8c2a2d42c540067356e73bf0258f0a4dde5b0a2267acae036a51916f5fdb7efae3f40f56d5a04fdce34ca24dc74231b5d3313125dc40125f630dd025d9fe0d547bdb4eb1ba1bb4949d89f5b02f38ae42490e4624f4fc1af8b0e7417a8d172886a7a0149ccb44679c617b1da981e0759fa75218565dd9056cefbaba5609dc49df952b08bbd87f98f2b230a23763bf733e1c900f369f94ba2e04ebc7e93398407f744707efe075ae5b1acd118ccf235e5494908ca56c93dfb0f187d8b3bc113c24d8fc94f0e37e91fa10e6adf622ecb350651792cc82538f4fa4ba7895c9cd2e30d39864a747cd55987c23f4e0c5c52f43df75282f1eaa3acfd49341a28f341883a13eee8deff991d5fbacbe81ef2b95060c031d373e5efbea0ed330b74be2020c4676cf008037a55807f464e96a7f41e3ee1f6d809e133642b63d7325e9ff9c07b0f786f97bc939af99c1290787a808715d772749c557478b1bae16e7004ba4fa0ba68c37bff31f0733d3d942ab10b410ea0fe4d88656b7933b4d70203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ed4419c0d3f0068beea47bbe42e72654c88e3676300d06092a864886f70d01010b050003820201000dae9032f6a64b7c447619611e2728cd5e54ef25bce30890f929d7ae6808e1940058ef2e2e7e53528cb65c07ea88ba998b5094d78280df61090093ad0d14e6cec1f2379478b05f9cb3a273b88f059338cd8d3eb0b8fbc0cfb1f2ec2d2d1bccecaa9ab3aa60821b2d3bc3843d578a961e9c75b8d330cd60088390d38e54f14d66c05d740340a3ee857ec21f779c06e8c1a7185d5295edc9dd259e6dfaa9eda33a34d0597bdaed50f335bfedeb144d31c760f4daf1879ce248e2c6c537fb0610fa755966314729da769a1ce982aeef9ab951f788239a6995623ce5558036d75402fff1b95dced4236fd845844a5b65ef890cdd14a720cb18a525b40df901f0a2d2f400c8748ea12a488e65db13c4e225177debbe875b17205451934a53030bec5dca33ed62fd45c72f5bdc58a08039e6fad7fe1314a6ed3d944a4274d4c3775973cd8f46be5538effae89132ea97580422de38c3ccbc6dc9333a6a0a693fa0c8ea728f8c638623bd6d3c969e95e0494caaa2b92a1b9c368178edc3e846e2265944751ed9758951cd10849d6160cb5df997224d8e98e6e37ff65bbbaecdca4a816b5e0bf351e1742be97e27a7d999494ef8a580db250f1c63628ac933676b3c1083c6addea8cd168e8df00737719ff2abfc41f5c18bec00375d09e54e80effab15c3806a51b4ae1dc382d3cdcab1f901ad54a9ceed1706ccceef457f818ba846e87	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25\Blob = 5c0000000100000004000000001000001900000001000000100000002e43cb5682e3a1756f80fc53cfbff825030000000100000014000000df717eaa4ad94ec9558499602d48de5fbcf03a251d000000010000001000000066908ed134572466070299553e6e2b99140000000100000014000000ed4419c0d3f0068beea47bbe42e72654c88e36766200000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae0b000000010000003e0000004900640065006e0054007200750073007400200043006f006d006d00650072006300690061006c00200052006f006f00740020004300410020003100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b06010505070308530000000100000081000000307f3020060a6086480186f92f00060930123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c03021060b6086480186f92f00060e0130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000200000007a9bc7ffecf427111c5a2e5bf589ffff1ee95fef12b3cc42764d7c907a3f69596b00000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae2000000001000000640500003082056030820348a00302010202100a0142800000014523c844b500000002300d06092a864886f70d01010b0500304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f742043412031301e170d3134303131363138313232335a170d3334303131363138313232335a304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100a75019de3f993dd43346f16f516182b2a94f8f67895d84d953dd0c28d9d7f0ffae95437299f9b55d7c8ac142e1315074d1810d7ccd9b21ab43e2acad5e866ef3098a1f5a32bda2eb94f9e85c0aecff98d2af71b3b4539f4e87ef92bcbdec4f3230884b175e57c453c2f602978dd9622bbf241f628ddfc3b8294b49783c93608822fc99da36c8c2a2d42c540067356e73bf0258f0a4dde5b0a2267acae036a51916f5fdb7efae3f40f56d5a04fdce34ca24dc74231b5d3313125dc40125f630dd025d9fe0d547bdb4eb1ba1bb4949d89f5b02f38ae42490e4624f4fc1af8b0e7417a8d172886a7a0149ccb44679c617b1da981e0759fa75218565dd9056cefbaba5609dc49df952b08bbd87f98f2b230a23763bf733e1c900f369f94ba2e04ebc7e93398407f744707efe075ae5b1acd118ccf235e5494908ca56c93dfb0f187d8b3bc113c24d8fc94f0e37e91fa10e6adf622ecb350651792cc82538f4fa4ba7895c9cd2e30d39864a747cd55987c23f4e0c5c52f43df75282f1eaa3acfd49341a28f341883a13eee8deff991d5fbacbe81ef2b95060c031d373e5efbea0ed330b74be2020c4676cf008037a55807f464e96a7f41e3ee1f6d809e133642b63d7325e9ff9c07b0f786f97bc939af99c1290787a808715d772749c557478b1bae16e7004ba4fa0ba68c37bff31f0733d3d942ab10b410ea0fe4d88656b7933b4d70203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ed4419c0d3f0068beea47bbe42e72654c88e3676300d06092a864886f70d01010b050003820201000dae9032f6a64b7c447619611e2728cd5e54ef25bce30890f929d7ae6808e1940058ef2e2e7e53528cb65c07ea88ba998b5094d78280df61090093ad0d14e6cec1f2379478b05f9cb3a273b88f059338cd8d3eb0b8fbc0cfb1f2ec2d2d1bccecaa9ab3aa60821b2d3bc3843d578a961e9c75b8d330cd60088390d38e54f14d66c05d740340a3ee857ec21f779c06e8c1a7185d5295edc9dd259e6dfaa9eda33a34d0597bdaed50f335bfedeb144d31c760f4daf1879ce248e2c6c537fb0610fa755966314729da769a1ce982aeef9ab951f788239a6995623ce5558036d75402fff1b95dced4236fd845844a5b65ef890cdd14a720cb18a525b40df901f0a2d2f400c8748ea12a488e65db13c4e225177debbe875b17205451934a53030bec5dca33ed62fd45c72f5bdc58a08039e6fad7fe1314a6ed3d944a4274d4c3775973cd8f46be5538effae89132ea97580422de38c3ccbc6dc9333a6a0a693fa0c8ea728f8c638623bd6d3c969e95e0494caaa2b92a1b9c368178edc3e846e2265944751ed9758951cd10849d6160cb5df997224d8e98e6e37ff65bbbaecdca4a816b5e0bf351e1742be97e27a7d999494ef8a580db250f1c63628ac933676b3c1083c6addea8cd168e8df00737719ff2abfc41f5c18bec00375d09e54e80effab15c3806a51b4ae1dc382d3cdcab1f901ad54a9ceed1706ccceef457f818ba846e87	dns-jumper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9F5FD91A546DF50C71F0EE7ABD1749988473E239\Blob = 6b0000000100000020000000c32ffd9f46f936d16c3673990959434b9ad60aafbb9e7cf33654f144cc1ba1430f0000000100000030000000329a12d428629d160e107f49b36d0d96123963b7fa552b63b3807131c3abfa881f01aa662a3148fb71abd06f4929ef860b000000010000003a000000530053004c002e0063006f006d00200054004c0053002000450043004300200052006f006f007400200043004100200032003000320032000000620000000100000020000000c32ffd9f46f936d16c3673990959434b9ad60aafbb9e7cf33654f144cc1ba14353000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0090000000100000016000000301406082b0601050507030206082b06010505070301140000000100000014000000898f2fa3e82ba014547bf356b8265f67380b9cd01d00000001000000100000002bf3b3cbd9a9f3bd53c744ef9e49057c0300000001000000140000009f5fd91a546df50c71f0ee7abd1749988473e239190000000100000010000000cc8539733a8c4f09d4efc4660adde01720000000010000003e0200003082023a308201c0a00302010202101403f5abfb378b17405be243b2a5d1c4300a06082a8648ce3d040303304e310b300906035504061302555331183016060355040a0c0f53534c20436f72706f726174696f6e3125302306035504030c1c53534c2e636f6d20544c532045434320526f6f742043412032303232301e170d3232303832353136333334385a170d3436303831393136333334375a304e310b300906035504061302555331183016060355040a0c0f53534c20436f72706f726174696f6e3125302306035504030c1c53534c2e636f6d20544c532045434320526f6f7420434120323032323076301006072a8648ce3d020106052b810400220362000445293573fac2b823ce147da8b14da05b36ee2a2c53c3600935b224662669c0b395d65d9240190ec6a51370f4ef1251285de7ccbdf93c85c1cf9490c92bce9242585967fd942710648c4f04b14d49e47b4f9bf5e708f80388f7a7c3924b195481a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014898f2fa3e82ba014547bf356b8265f67380b9cd0301d0603551d0e04160414898f2fa3e82ba014547bf356b8265f67380b9cd0300e0603551d0f0101ff040403020186300a06082a8648ce3d0403030368003065023055e32256e9d79224584f1e94320f0c0236c2fdac74324ee1fb1c8088a3ccfbd7eb2bff377df0edd79e756a35765245e0023100c78d6f42208fbeb64d59ed774d29c420204564863a50c6c4ad2d93f5187d72eda9cfc4ac5736280865df3c79667ea0ea	dns-jumper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	dns-jumper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c00000001000000040000008001000019000000010000001000000011a2b3490cb6c379a89e76c3569452d7030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd86b00000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc652000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 6b000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d00f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff0300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e1d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb13140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc662000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d00b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470033000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c05c000000010000000400000080010000190000000100000010000000b009e99a5cfc928a173190106dbb32a92000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717	dns-jumper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\9F5FD91A546DF50C71F0EE7ABD1749988473E239\Blob = 0f0000000100000030000000329a12d428629d160e107f49b36d0d96123963b7fa552b63b3807131c3abfa881f01aa662a3148fb71abd06f4929ef860b000000010000003a000000530053004c002e0063006f006d00200054004c0053002000450043004300200052006f006f007400200043004100200032003000320032000000620000000100000020000000c32ffd9f46f936d16c3673990959434b9ad60aafbb9e7cf33654f144cc1ba14353000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0090000000100000016000000301406082b0601050507030206082b06010505070301140000000100000014000000898f2fa3e82ba014547bf356b8265f67380b9cd01d00000001000000100000002bf3b3cbd9a9f3bd53c744ef9e49057c0300000001000000140000009f5fd91a546df50c71f0ee7abd1749988473e23920000000010000003e0200003082023a308201c0a00302010202101403f5abfb378b17405be243b2a5d1c4300a06082a8648ce3d040303304e310b300906035504061302555331183016060355040a0c0f53534c20436f72706f726174696f6e3125302306035504030c1c53534c2e636f6d20544c532045434320526f6f742043412032303232301e170d3232303832353136333334385a170d3436303831393136333334375a304e310b300906035504061302555331183016060355040a0c0f53534c20436f72706f726174696f6e3125302306035504030c1c53534c2e636f6d20544c532045434320526f6f7420434120323032323076301006072a8648ce3d020106052b810400220362000445293573fac2b823ce147da8b14da05b36ee2a2c53c3600935b224662669c0b395d65d9240190ec6a51370f4ef1251285de7ccbdf93c85c1cf9490c92bce9242585967fd942710648c4f04b14d49e47b4f9bf5e708f80388f7a7c3924b195481a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014898f2fa3e82ba014547bf356b8265f67380b9cd0301d0603551d0e04160414898f2fa3e82ba014547bf356b8265f67380b9cd0300e0603551d0f0101ff040403020186300a06082a8648ce3d0403030368003065023055e32256e9d79224584f1e94320f0c0236c2fdac74324ee1fb1c8088a3ccfbd7eb2bff377df0edd79e756a35765245e0023100c78d6f42208fbeb64d59ed774d29c420204564863a50c6c4ad2d93f5187d72eda9cfc4ac5736280865df3c79667ea0ea	dns-jumper.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1240	powershell.exe
1240	powershell.exe
1240	powershell.exe
2592	powershell.exe
2592	powershell.exe
2592	powershell.exe
5504	msedgewebview2.exe
5504	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3868	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeIncreaseQuotaPrivilege	1240	powershell.exe
Token: SeSecurityPrivilege	1240	powershell.exe
Token: SeTakeOwnershipPrivilege	1240	powershell.exe
Token: SeLoadDriverPrivilege	1240	powershell.exe
Token: SeSystemProfilePrivilege	1240	powershell.exe
Token: SeSystemtimePrivilege	1240	powershell.exe
Token: SeProfSingleProcessPrivilege	1240	powershell.exe
Token: SeIncBasePriorityPrivilege	1240	powershell.exe
Token: SeCreatePagefilePrivilege	1240	powershell.exe
Token: SeBackupPrivilege	1240	powershell.exe
Token: SeRestorePrivilege	1240	powershell.exe
Token: SeShutdownPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeSystemEnvironmentPrivilege	1240	powershell.exe
Token: SeRemoteShutdownPrivilege	1240	powershell.exe
Token: SeUndockPrivilege	1240	powershell.exe
Token: SeManageVolumePrivilege	1240	powershell.exe
Token: 33	1240	powershell.exe
Token: 34	1240	powershell.exe
Token: 35	1240	powershell.exe
Token: 36	1240	powershell.exe
Token: SeIncreaseQuotaPrivilege	1240	powershell.exe
Token: SeSecurityPrivilege	1240	powershell.exe
Token: SeTakeOwnershipPrivilege	1240	powershell.exe
Token: SeLoadDriverPrivilege	1240	powershell.exe
Token: SeSystemProfilePrivilege	1240	powershell.exe
Token: SeSystemtimePrivilege	1240	powershell.exe
Token: SeProfSingleProcessPrivilege	1240	powershell.exe
Token: SeIncBasePriorityPrivilege	1240	powershell.exe
Token: SeCreatePagefilePrivilege	1240	powershell.exe
Token: SeBackupPrivilege	1240	powershell.exe
Token: SeRestorePrivilege	1240	powershell.exe
Token: SeShutdownPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeSystemEnvironmentPrivilege	1240	powershell.exe
Token: SeRemoteShutdownPrivilege	1240	powershell.exe
Token: SeUndockPrivilege	1240	powershell.exe
Token: SeManageVolumePrivilege	1240	powershell.exe
Token: 33	1240	powershell.exe
Token: 34	1240	powershell.exe
Token: 35	1240	powershell.exe
Token: 36	1240	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeIncreaseQuotaPrivilege	2592	powershell.exe
Token: SeSecurityPrivilege	2592	powershell.exe
Token: SeTakeOwnershipPrivilege	2592	powershell.exe
Token: SeLoadDriverPrivilege	2592	powershell.exe
Token: SeSystemProfilePrivilege	2592	powershell.exe
Token: SeSystemtimePrivilege	2592	powershell.exe
Token: SeProfSingleProcessPrivilege	2592	powershell.exe
Token: SeIncBasePriorityPrivilege	2592	powershell.exe
Token: SeCreatePagefilePrivilege	2592	powershell.exe
Token: SeBackupPrivilege	2592	powershell.exe
Token: SeRestorePrivilege	2592	powershell.exe
Token: SeShutdownPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeSystemEnvironmentPrivilege	2592	powershell.exe
Token: SeRemoteShutdownPrivilege	2592	powershell.exe
Token: SeUndockPrivilege	2592	powershell.exe
Token: SeManageVolumePrivilege	2592	powershell.exe
Token: 33	2592	powershell.exe
Token: 34	2592	powershell.exe
Token: 35	2592	powershell.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1768	dns-jumper.exe
1768	dns-jumper.exe
1768	dns-jumper.exe
1768	dns-jumper.exe
1768	dns-jumper.exe
1768	dns-jumper.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1768	dns-jumper.exe
1768	dns-jumper.exe
1768	dns-jumper.exe
1768	dns-jumper.exe
1768	dns-jumper.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 3868	1768	dns-jumper.exe	89
PID 3868 wrote to memory of 4988	3868	msedgewebview2.exe	90
PID 3868 wrote to memory of 4880	3868	msedgewebview2.exe	91
PID 3868 wrote to memory of 4880	3868	msedgewebview2.exe	91
PID 3868 wrote to memory of 4880	3868	msedgewebview2.exe	91
PID 3868 wrote to memory of 4880	3868	msedgewebview2.exe	91
PID 3868 wrote to memory of 5640	3868	msedgewebview2.exe	92
PID 3868 wrote to memory of 5676	3868	msedgewebview2.exe	93
PID 3868 wrote to memory of 5676	3868	msedgewebview2.exe	93
PID 3868 wrote to memory of 5676	3868	msedgewebview2.exe	93
PID 3868 wrote to memory of 4800	3868	msedgewebview2.exe	94
PID 3868 wrote to memory of 4800	3868	msedgewebview2.exe	94
PID 3868 wrote to memory of 4800	3868	msedgewebview2.exe	94
PID 3868 wrote to memory of 4800	3868	msedgewebview2.exe	94
PID 3868 wrote to memory of 4800	3868	msedgewebview2.exe	94
PID 1768 wrote to memory of 1240	1768	dns-jumper.exe	95
PID 1768 wrote to memory of 2592	1768	dns-jumper.exe	100
PID 3868 wrote to memory of 4780	3868	msedgewebview2.exe	105
PID 3868 wrote to memory of 4780	3868	msedgewebview2.exe	105
PID 3868 wrote to memory of 4780	3868	msedgewebview2.exe	105
PID 3868 wrote to memory of 4340	3868	msedgewebview2.exe	106
PID 3868 wrote to memory of 4340	3868	msedgewebview2.exe	106
PID 3868 wrote to memory of 4340	3868	msedgewebview2.exe	106
PID 3868 wrote to memory of 5504	3868	msedgewebview2.exe	107
PID 3868 wrote to memory of 4820	3868	msedgewebview2.exe	108
PID 3868 wrote to memory of 4820	3868	msedgewebview2.exe	108
PID 3868 wrote to memory of 4820	3868	msedgewebview2.exe	108

C:\Users\Admin\AppData\Local\Temp\dns-jumper.exe
"C:\Users\Admin\AppData\Local\Temp\dns-jumper.exe"
1⤵
- Unexpected DNS network traffic destination
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=dns-jumper.exe --webview-exe-version=1.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1768.5188.12847851748976399803 /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView /prefetch:4 /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc90005fd8,0x7ffc90005fe4,0x7ffc90005ff0
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView" --webview-exe-name=dns-jumper.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1584 --field-trial-handle=1760,i,5091601314707596503,10586474512820228478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView" --webview-exe-name=dns-jumper.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2088 --field-trial-handle=1760,i,5091601314707596503,10586474512820228478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView" --webview-exe-name=dns-jumper.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1760,i,5091601314707596503,10586474512820228478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView" --webview-exe-name=dns-jumper.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1760,i,5091601314707596503,10586474512820228478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView" --webview-exe-name=dns-jumper.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=1760,i,5091601314707596503,10586474512820228478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView" --webview-exe-name=dns-jumper.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=1760,i,5091601314707596503,10586474512820228478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView" --webview-exe-name=dns-jumper.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4496 --field-trial-handle=1760,i,5091601314707596503,10586474512820228478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView" --webview-exe-name=dns-jumper.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=1760,i,5091601314707596503,10586474512820228478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:758782bcab6910f7ca3143a36c99a5800af3a1da
    3⤵
    PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $OutputEncoding=[System.Text.Encoding]::UTF8; $m = @{}; Get-NetAdapter -ErrorAction SilentlyContinue | ForEach-Object { $m[[int]$_.ifIndex] = $_.InterfaceGuid }; Get-DnsClientServerAddress | Where-Object { $_.InterfaceAlias -notmatch 'Loopback' } | ForEach-Object { $g = $m[[int]$_.InterfaceIndex]; $root = if ($_.AddressFamily -eq 23) { 'Tcpip6' } else { 'Tcpip' }; $st = $null; if ($g) { $st = (Get-ItemProperty -Path ('HKLM:\SYSTEM\CurrentControlSet\Services\' + $root + '\Parameters\Interfaces\' + $g) -Name NameServer -ErrorAction SilentlyContinue).NameServer }; [pscustomobject]@{ InterfaceAlias = $_.InterfaceAlias; AddressFamily = [int]$_.AddressFamily; ServerAddresses = $_.ServerAddresses; Static = $st } } | ConvertTo-Json -Depth 4"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $OutputEncoding=[System.Text.Encoding]::UTF8; $s = @(); $s += (Get-DnsClientGlobalSetting).SuffixSearchList; $s += (Get-DnsClient | Select-Object -ExpandProperty ConnectionSpecificSuffix); $s | Where-Object { $_ } | Sort-Object -Unique"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Size 78KB
SHA256 c0aa761fb7d8d1e4449a899027f1157cf1169624110050ab6b3d316ba61f908c
MD5 28a49a6d660f1ca74195f9ad92ceaf97
SHA1 1660781555326eae5e290b875f6eebe856e5b4fb
SHA512 edc803988a47d075f14804b258888e88a9aeca44dc1133c1df5cf7b8aa89b8904e8f69f48b2d1315ca5d03580f28878429b8a7e0c931c9a693ef8aecd1157e4e
SSDEEP 1536:9dRy5TkCcFPWjBs0w7euY3bqmxvrGYlD7bohIJMRLsINnThd:92uCIujK17euY3+mxvrGgD7MqMRLsqVd
TLSH
T19373123575AAB613ECE0D5CBBA70EBF25069DCC8F48B013E458A5350E57C683A83934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F0B2CB9C11CFD091DCC143A9C3B857B3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3
Size 657B
SHA256 3417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65
MD5 2edae4397f9c8f37d1709f2617513a8e
SHA1 c3197c3924e654af1bc4ab20957ae2c30e13026a
SHA512 1c0fcf47794efb56b0d583eeb9ce41091443b9caa40e03a6b86de30693b1c9d429973cef30882dde36f03974345310777c6dbf2056fb05492ff99aabe5974321
TLSH
T1DA019985C738A0579FF68381A2C380ABBD7B05DC894F261813ACEDA2618BB909F4245C
MD5 SHA1 SHA512 TLSH

Submit Download

572C18022EDD69EA4E0F401CF070D989

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572C18022EDD69EA4E0F401CF070D989
Size 480B
SHA256 14bb230844fe1cacea5d205d3b5bf7bb748d429226cb54a4c47681eac0c84b53
MD5 4a431fced9857a4951fb395bf4dbcde9
SHA1 26e65f6f5550492d8fe8267327658837328db4dd
SHA512 82e9c3cf98e11ac004ccc41379a1211f50f5d59198cf2493e7a1ce55b7f3f636a0ba8625919caa373193ead122d16c64268eface8a3baa1cf380ad051a75398d
TLSH
T167F05C0C29B601AAF4B6C9790DC2A563892DF2151408A6E6169A034E0F01F042D2552D
MD5 SHA1 SHA512 TLSH

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 ec37358d691cf50aa9ba11740a3c835df53f46f7b8ec533748bbea3070ba8915
MD5 9c1e50b6c4ec6fc85b6ac5e39864db2b
SHA1 ac05c722cbabf5cf026fcf4deb7c14414f4ef5a3
SHA512 53c06d06cd1a6c9fca3a7a4cfc9469e07864a0e22ca7f34ed53b27fa3d933c7135767dd103add98b362c1fc971497f4a7dbd5aaf1e77571c3e1353dd9c5fb440
TLSH
T1CBE0A7066BA84211F9730B3C547256118577F3277801C24C073A514C1C2AF14DD3371E
MD5 SHA1 SHA512 TLSH

Submit Download

F0B2CB9C11CFD091DCC143A9C3B857B3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3
Size 304B
SHA256 0e7e3895bc63b5d591874e98ee4d5597de7fd39fa17b025791ebd6b350296ab7
MD5 98289de441d7453a3f481ba14f554995
SHA1 fe0c3732aea9f17152bf868ca34b6879ba96e944
SHA512 b51dd360638c5d42b1dd3f7fdf21369bb9bb81a971a766a646dcb18cf4ca4d34cf653efa81349a811f3b76ebb529039cf6952e9cc23bedc700b0c35f303916d7
TLSH
T1DDE0A7388BB91A26F03A84BDC5E11312DA35B2156551CDCE0578454E0816B125CF0E0B
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9fab451cb8825ec06e9ab3d1efabe895bef9f7af2ea55948783d6a57e4d4d8b9
MD5 e4b3bb672412b0c20f6037b78f832b88
SHA1 5f9b98da181e390deb05df43c3396845adf0f36e
SHA512 37dd8290ac3b6515cc5e603dfd360d4f22e7d6216123c42d10a4444e7b101377b1dca5dbcfd586943040c80ba0d7e75c25a8fbb81179aa7d2c071e099ee13544
TLSH
T15A311F33B38C861DC85A143A10CCBE1032B6E3DF84AEDF9B7B91D249752F289DE24650
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cok24ati.nm1.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cok24ati.nm1.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

396f6e1f-f052-4f44-a485-9254c91c4ea3.tmp

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\396f6e1f-f052-4f44-a485-9254c91c4ea3.tmp
Size 15KB
SHA256 4ea38158337bf8e7aa9a8218c9f068d333e35e436f66d5428b5331c69ce8a959
MD5 3e54792a4ca434722c8a8c64b5048c14
SHA1 ae6ca0a9433b37a811284ca7c10c1e21bed620d9
SHA512 fdbf0f2eea16de276034393bc634cdc5e2bca6c88b31f626b913de88d6c103282052845cc0a8185105044e36f373439725b3cfaff917ce69309ef16def4340a1
SSDEEP 384:t+OBqImmJvGBLx3NaFMJFNNBSavvjvxxiW/J/g6rKU:gcvGtlNB7/n
TLSH
T1FC72AF7B28A56E336CF78909BACA374BCB616293C4D57BD8DDEC9F0E412F0941351815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 236ce6188de0d6415a9f7fd1ec3d616e636a290bc7f640af7c37807332a57bd3
MD5 cf0b69740618835fce3382b6a3677042
SHA1 7c75a6840bfff8b21be7a1595c69bec2ab0867a4
SHA512 bd0c551c12ef91c5cf98fadb4507cece7dc4d72c11d8e27173986d1e6a5a9baed1a93396bdaebf899eda68f3a2b77f0a9bcbdcd744b76aa43264a922ca9949dc
TLSH
T186D0122737024574C41021732043614C4945C11B90058141542C851E2B840640F07441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 50b0c35560df4c8e65d198d54d570d6a7bf3251c5f4ef654069b53b982d05833
MD5 e0d4ed7a5e96566fce4fb61e0363c09f
SHA1 3e3d4949269e9cd92d8467bceb7dd0702de515a1
SHA512 4fdde45a9a2a2dc40f89294b1f2a6926d5fb758b109b0e554e064f66eb5ad4261a0672154f5dfbf58b6052955a657f8ff3a96b3feb2cd338d48cbd5c3bfdcc60
TLSH
T183D0043557054440C44111753055414CC74D4411700143410154000515C10140707000
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

7d328a52-7d62-49be-ac3d-9760bd41db04.tmp

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Default\7d328a52-7d62-49be-ac3d-9760bd41db04.tmp
Size 6KB
SHA256 9f5f210769fe740d8574ecab08cf1276afea101e64730c20cb4559a65f3bfb22
MD5 17f42eaf7b602fa378770920937896ee
SHA1 9fd186c81ba045eef9454e5997c41930897b5d6c
SHA512 e5726fd6370d672d549beca894e6ce9875db56c49eb6de076821599378e4447c825dc5cc27f5e6d70644d89880ee46937f8097e87e5e7309664c19421bbd43bb
SSDEEP 96:sth/d/0jGnb99kXo5h16Z0xs7/x+6MhmuecJfl1ejeXK+gH1t28XM1C7K:stVFvUonxsV+FdflQjJd1tG6K
TLSH
T134D1A7065E247D7B8CC6F119BA29BB1BE3FA907261D51E58E7F9452C04DA6DC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 820c80d483c62a099e3226c3d170103d6ee1d2fd2a9957899fc4f156aba97ef6
MD5 7336cf5a190ea631957b54dffb2067a0
SHA1 52425841663ed8c1cccbde4802261137b5428973
SHA512 788537424664844fba26b9dca52e43b8af23ef9f4f0f372059cebf4cb72c352d6a4074a618770e9de043cdbdb4f15688308a64b1e222c4c179884ee6c1af7167
TLSH
T110A00223518444B2C600837710D1F1803270AC6903130F0595F495B6DD633959212251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6785756fc678a5e9928dee6bea77b71ccf5ab5719c9e59b43114528fd8a46597
MD5 726c0621988973c93b053e085fffa659
SHA1 bd5f43656b30db2d53c13e068fdedb117ed9c6d2
SHA512 8b54bf93de2013d9f177bd32a936e72e4727bbf2d59e3f65accaec80d27107f1349cf7ebaeba551c9213f767226c0fcae65bea4c2a5e0204311207a34c1fcda2
MD5 SHA1 SHA512

Submit Download

7b0c377c-9710-4904-ae14-01e93ecd7452.tmp

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Default\Network\7b0c377c-9710-4904-ae14-01e93ecd7452.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bc34d4ce-afb8-4585-a853-d499ce4ebf1d.tmp

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Default\bc34d4ce-afb8-4585-a853-d499ce4ebf1d.tmp
Size 6KB
SHA256 35a26a19c54bd9a250e58ec60b2ba884574cf56f433a4cfd3dee55a93a071d11
MD5 be443207920e994e7e92f529e7e3499e
SHA1 cfa3ca46aad9753671ec9192905ea7c9fb68658f
SHA512 a68d56d10e33a8b8cba7f4a0df1eb9525bc1c683b6f9ffc9e7b7d2ea489704d17a8893e8046a0488705c1d470242f8d4d3e6510d87767222108e8fa2a2fdbefb
SSDEEP 96:sth/d/0snb99kXo5h16Z0xs7/x+6MhmuecJfl1ejeXK+gHDt28XM1C7K:stVFhUonxsV+FdflQjJdDtG6K
TLSH
T1ADD1A6055E287D7B8CC6F119BA29BB0BE2FA907270D51D58E7F9462C04DA6DC2347D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\Local State
Size 1KB
SHA256 dbfb7427c1efb91b636b8543d7ff441066be774cb8991c5eaf49bbaa89a18fe5
MD5 5176e36bb36207521cc049318bada2e5
SHA1 85462d073e2d510ea8f597ac376c3f6157213be2
SHA512 6b04858cd018e9ce84ccbe74b251f551b8b5ec78d754ffb5c7e8b4d96b10b332cd8c3955a9aaf8df483262f9074b7ba722346ee00483c4014b3d40793061021f
TLSH
T1E02162F3E5F51B33ECC25A4AA0937E4B9E30A16FD5021F4091DE0F1C01AB0AC966AC36
MD5 SHA1 SHA512 TLSH

Submit Download

b6bad2b6-7821-4375-a715-3d3b3d5df57d.tmp

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\b6bad2b6-7821-4375-a715-3d3b3d5df57d.tmp
Size 3KB
SHA256 2bbf650ce9d4029e68ed8c32ef6c57cc68e17b81a16d2a7adb59e77654ca6fda
MD5 5b6152e17994f1d73ed2e25892884592
SHA1 c19e92f76c3b7ef83537ee480edae94d62f98521
SHA512 fa639ef50786bcfdf03356afa516fefc1b031f0f7ae80858f79e4609cb102236949a52a49358b0740f030b82a96f4c1a4225b7da550e47717af60d3e762d4a1c
TLSH
T13461987769B4A9378EF29A04B8863F0BEBA59127E9863F95C5ED0F0C01D72A81341C17
MD5 SHA1 SHA512 TLSH

Submit Download

c1e720e2-c0c3-4ba6-9915-b165800d6230.tmp

Path C:\Users\Admin\AppData\Local\io.medjumper.dnsjumper\EBWebView\c1e720e2-c0c3-4ba6-9915-b165800d6230.tmp
Size 2KB
SHA256 2044083c5ac86aa4a376387a703757becd2c3a5a98151f8ff26330ac320827d6
MD5 9309126060b290293e046075573f2814
SHA1 2db67defbf84a70d09a8f1030c75fb6ed2601c62
SHA512 752f14e287c6f9e00fb0b169b72191fab33340aa50d9749c6ad7424d0359444eca64424047c964cbc75e6a964ed3f7985ea302d14ff0dd5aeb481048617615df
TLSH
T10C51757368656A37D9E24A14A98A3F17CE359166D9572F9196DD0F0C00DB17C1341C37
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1331216444\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1414060306\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3868_1829916145\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1240-194-0x00000251D50E0000-0x00000251D50EA000-memory.dmp

Download

memory/1240-189-0x00000251D5020000-0x00000251D5042000-memory.dmp

Download

memory/1240-195-0x00000251D5700000-0x00000251D571E000-memory.dmp

Download

memory/1240-210-0x00000251D6450000-0x00000251D6978000-memory.dmp

Download

memory/1240-193-0x00000251D53F0000-0x00000251D54A2000-memory.dmp

Download

memory/1240-209-0x00000251D5D50000-0x00000251D5F12000-memory.dmp

Download

memory/1240-207-0x00000251D5100000-0x00000251D5110000-memory.dmp

Download

memory/1240-208-0x00000251D5700000-0x00000251D571A000-memory.dmp

Download

memory/1240-192-0x00000251D53D0000-0x00000251D53EE000-memory.dmp

Download

memory/4780-403-0x00007FFCB0A90000-0x00007FFCB0A91000-memory.dmp

Download

memory/4780-402-0x00007FFCB21B0000-0x00007FFCB21B1000-memory.dmp

Download

memory/4800-99-0x00007FFCB0DB0000-0x00007FFCB0DB1000-memory.dmp

Download

memory/4800-288-0x0000028834C80000-0x0000028834D32000-memory.dmp

Download

memory/4880-287-0x00000137A6000000-0x00000137A60B2000-memory.dmp

Download

memory/4880-27-0x00007FFCB0DB0000-0x00007FFCB0DB1000-memory.dmp

Download

memory/4880-564-0x00000137A6000000-0x00000137A60B2000-memory.dmp

Download

memory/5504-524-0x000002301A010000-0x000002301A011000-memory.dmp

Download

memory/5504-522-0x000002301A010000-0x000002301A011000-memory.dmp

Download

memory/5504-533-0x000002301A010000-0x000002301A011000-memory.dmp

Download

memory/5504-532-0x000002301A010000-0x000002301A011000-memory.dmp

Download

memory/5504-531-0x000002301A010000-0x000002301A011000-memory.dmp

Download

memory/5504-530-0x000002301A010000-0x000002301A011000-memory.dmp

Download

memory/5504-529-0x000002301A010000-0x000002301A011000-memory.dmp

Download

memory/5504-528-0x000002301A010000-0x000002301A011000-memory.dmp

Download