File name:

jjsploit_8.17.8_x64_en-US.msi

Full analysis: https://app.any.run/tasks/c970bfdf-eb8b-48e2-a715-67795581a6d5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 10, 2026, 00:13:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
loader
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: jjsploit, Author: wearedevs, Keywords: Installer, Comments: This installer database contains the logic and data required to install jjsploit., Template: x64;0, Revision Number: {5D9DB88B-4BA9-4A1B-A614-B2AB3A0D3B9D}, Create Time/Date: Wed Mar 4 22:22:18 2026, Last Saved Time/Date: Wed Mar 4 22:22:18 2026, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5:

AD1D89C3147F24D3BD43C24761CBF24B

SHA1:

7F712D7C75926AA378D764CC965242A04D5FCFAB

SHA256:

8E269F69CC241AF31098D086C02D3D5D37B172D6EF85F8A43F0E13A8E166FA1B

SSDEEP:

98304:n6UqGMT3tBnt59vREhz+rDU+a2yNRwhPJZev4qQzkcKzjphqNsE1VRZ4xO5OWkhy:zKQzJYwGkdA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6900)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 6468)

  • SUSPICIOUS

    • Manipulates environment variables

      • powershell.exe (PID: 6900)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 6900)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 8716)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7000)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 8716)

    • Starts process via Powershell

      • powershell.exe (PID: 6900)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6900)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 6900)
      • MicrosoftEdgeUpdate.exe (PID: 6468)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8504)
      • MicrosoftEdge_X64_145.0.3800.97.exe (PID: 6352)
      • setup.exe (PID: 8816)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 6468)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8504)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 6468)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7904)
      • MicrosoftEdgeUpdate.exe (PID: 4104)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4664)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2764)

    • Application launched itself

      • setup.exe (PID: 8816)
      • MicrosoftEdgeUpdate.exe (PID: 4644)

    • Searches for installed software

      • setup.exe (PID: 8816)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 6544)

    • Reads the computer name

      • msiexec.exe (PID: 8716)
      • msiexec.exe (PID: 4368)
      • MicrosoftEdgeUpdate.exe (PID: 6468)
      • MicrosoftEdgeUpdate.exe (PID: 4104)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7904)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4664)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2764)
      • MicrosoftEdgeUpdate.exe (PID: 2868)
      • MicrosoftEdgeUpdate.exe (PID: 7576)
      • MicrosoftEdgeUpdate.exe (PID: 4644)
      • MicrosoftEdge_X64_145.0.3800.97.exe (PID: 6352)
      • setup.exe (PID: 8816)
      • MicrosoftEdgeUpdate.exe (PID: 5608)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6544)
      • msiexec.exe (PID: 8716)

    • Checks supported languages

      • msiexec.exe (PID: 4368)
      • msiexec.exe (PID: 8716)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8504)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7904)
      • MicrosoftEdgeUpdate.exe (PID: 6468)
      • MicrosoftEdgeUpdate.exe (PID: 4104)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4664)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2764)
      • MicrosoftEdgeUpdate.exe (PID: 2868)
      • MicrosoftEdgeUpdate.exe (PID: 7576)
      • MicrosoftEdgeUpdate.exe (PID: 4644)
      • MicrosoftEdge_X64_145.0.3800.97.exe (PID: 6352)
      • setup.exe (PID: 8816)
      • setup.exe (PID: 5484)
      • MicrosoftEdgeUpdate.exe (PID: 5608)

    • Manages system restore points

      • SrTasks.exe (PID: 6444)

    • Disables trace logs

      • powershell.exe (PID: 6900)

    • Checks proxy server information

      • powershell.exe (PID: 6900)
      • MicrosoftEdgeUpdate.exe (PID: 2868)
      • MicrosoftEdgeUpdate.exe (PID: 4644)
      • MicrosoftEdgeUpdate.exe (PID: 5608)
      • slui.exe (PID: 2460)

    • The sample compiled with english language support

      • powershell.exe (PID: 6900)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8504)
      • MicrosoftEdgeUpdate.exe (PID: 6468)
      • MicrosoftEdge_X64_145.0.3800.97.exe (PID: 6352)
      • setup.exe (PID: 8816)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 8504)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 8504)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 6468)
      • MicrosoftEdgeUpdate.exe (PID: 4644)
      • MicrosoftEdge_X64_145.0.3800.97.exe (PID: 6352)
      • setup.exe (PID: 5484)
      • setup.exe (PID: 8816)

    • Launching a file from a Registry key

      • MicrosoftEdgeUpdate.exe (PID: 6468)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 2868)
      • MicrosoftEdgeUpdate.exe (PID: 5608)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 6468)
      • MicrosoftEdgeUpdate.exe (PID: 4644)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 6468)
      • setup.exe (PID: 8816)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 4644)

    • Creates a software uninstall entry

      • setup.exe (PID: 8816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: jjsploit
Author: wearedevs
Keywords: Installer
Comments: This installer database contains the logic and data required to install jjsploit.
Template: x64;0
RevisionNumber: {5D9DB88B-4BA9-4A1B-A614-B2AB3A0D3B9D}
CreateDate: 2026:03:04 22:22:18
ModifyDate: 2026:03:04 22:22:18
Pages: 450
Words: 2
Software: Windows Installer XML Toolset (3.14.1.8722)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
22
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
1388\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2460C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2764"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.225.7\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.225.7\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.225.7
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.225.7\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2868"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMjUuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIyNS43IiBpc21hY2hpbmU9IjAiIHNlc3Npb25pZD0ie0U1Q0QxREVBLTg2MDEtNDgyQi05NzVBLTU2ODUzQkE5OTYyM30iIHVzZXJpZD0iezU0QTI5NjhDLUVCNDktNDcwMS1BNzMxLUI3OTUwM0U0NzNEQn0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7MDNCRjhBMkQtMEMzMy00ODA3LTk0MUQtNjM3MTc4Q0YxREM5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS40MDQ2IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4yMjUuNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjAyOTc0MTEyMTgiIGluc3RhbGxfdGltZV9tcz0iNTc4Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.225.7
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
4104"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.225.7
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
4368C:\Windows\syswow64\MsiExec.exe -Embedding 73C67BCFD3D1565B20B517FE133FDEF4 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4644"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.225.7
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
4664"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.225.7\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.225.7\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.225.7
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.225.7\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5484C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{1614579C-1396-4F70-9ADF-71DC94F4A1D9}\EDGEMITMP_76AF6.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.160 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{1614579C-1396-4F70-9ADF-71DC94F4A1D9}\EDGEMITMP_76AF6.tmp\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.97 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6de9bcc68,0x7ff6de9bcc74,0x7ff6de9bcc80C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{1614579C-1396-4F70-9ADF-71DC94F4A1D9}\EDGEMITMP_76AF6.tmp\setup.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
145.0.3800.97
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{1614579c-1396-4f70-9adf-71dc94f4a1d9}\edgemitmp_76af6.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5608"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMjUuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIyNS43IiBpc21hY2hpbmU9IjAiIHNlc3Npb25pZD0ie0U1Q0QxREVBLTg2MDEtNDgyQi05NzVBLTU2ODUzQkE5OTYyM30iIHVzZXJpZD0iezU0QTI5NjhDLUVCNDktNDcwMS1BNzMxLUI3OTUwM0U0NzNEQn0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7RjI0NEY5M0ItNUIwNS00NzhELTkwNTEtNjQ5RTNERERBMzc1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS40MDQ2IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iJnF1b3Q7K1pGQWozU09JSTVCSnpvR3V6OE9wcjBoWjhIL3JEenFiL1FWcjNQWWg0ST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTQ1LjAuMzgwMC45NyIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyMDMwNTc3MjgwMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjIwMzA1OTI5MDQ0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjA0MjkwMDQ1NDMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzNhMjcxM2I0LWU2ZjEtNDBhNC05NTc0LWE4NGMxY2M5NjA2ZT9QMT0xNzczNzA2NDM3JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWRFU2slMmZiU09vaUc1dzhHUU96VUdBSkZuZkkxSGpWZCUyZmVXUTNqWFpuNkViemdLN3pWWUdhQ08lMmJJYnZySzR2QllWM24ydnE0cyUyYmR5ZEtISDJKUCUyZkd5ZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE4NjYzMzI3MiIgdG90YWw9IjE4NjYzMzI3MiIgZG93bmxvYWRfdGltZV9tcz0iOTM1NCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjIwNDI5MTYwODEyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjA0NDg1ODI4MzEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjIwNzcwNjE1MTgxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjkwIiBkb3dubG9hZF90aW1lX21zPSIxMjMyMyIgZG93bmxvYWRlZD0iMTg2NjMzMjcyIiB0b3RhbD0iMTg2NjMzMjcyIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIzMjIwNCIvPjwvYXBwPjwvcmVxdWVzdD4C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.225.7
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
Total events
18 736
Read events
17 057
Write events
1 604
Delete events
75

Modification events

(PID) Process:(8716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000C29FF0BC22B0DC010C2200006C1B0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000C29FF0BC22B0DC010C2200006C1B0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000055C254BD22B0DC010C2200006C1B0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000055C254BD22B0DC010C2200006C1B0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000055C254BD22B0DC010C2200006C1B0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000B42457BD22B0DC010C2200006C1B0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
15
(PID) Process:(8716) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000DF3676BD22B0DC010C2200006C1B0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7000) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000C43589BD22B0DC01581B000098040000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7000) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000C43589BD22B0DC01581B000060200000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
209
Suspicious files
33
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
8716msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
8716msiexec.exeC:\Windows\Installer\1ed639.msi —
MD5:—
SHA256:—
8716msiexec.exeC:\Windows\Installer\MSID8F9.tmpbinary
MD5:07F9D25E88014A498C0857266D62B8EA
SHA256:215EE5D0D25ACD4DE99DB06EE8154CA2F64D85A91EE357C5B5A66A37589BA380
8716msiexec.exeC:\Windows\Temp\~DF7FABBD41DACCDCEA.TMPbinary
MD5:9FC651FA726CB4FD25635FE63AED3F29
SHA256:137E6FB19715945809FBBDDA1366C863D866704BB58781220428D96B7A5E47B7
8716msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:A4CE0DE04CE2AD92B76CC60CF55BD402
SHA256:382B6E740322EF795928FE2AB5B727050D2E7CE3B304A90D903B460952E81E88
8716msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{82724c31-8978-44c2-9005-338c3a83998d}_OnDiskSnapshotPropbinary
MD5:A4CE0DE04CE2AD92B76CC60CF55BD402
SHA256:382B6E740322EF795928FE2AB5B727050D2E7CE3B304A90D903B460952E81E88
8716msiexec.exeC:\Program Files\jjsploit\jjsploit.exeexecutable
MD5:8A5526391FD33CB9B95B1D5EA2139990
SHA256:A0D82C2D365045D1F2FC0E488FA1BDFCCD43E3DDC130792A33E3727015F1B7A7
8716msiexec.exeC:\Program Files\jjsploit\resources\luascripts\animations\levitate.luatext
MD5:D09DA2B730602A59C3289B72E63137BB
SHA256:2AF3980171CC17A4D7687B7489FE8B0BB193E5080C0CA76E5501983A0B3EFADB
6544msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI7414.tmpexecutable
MD5:CFBB8568BD3711A97E6124C56FCFA8D9
SHA256:7F47D98AB25CFEA9B3A2E898C3376CC9BA1CD893B4948B0C27CAA530FD0E34CC
8716msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:A46C3B54F2C9871CD81DAF7A932499C0
SHA256:E4F60D0AA6D7F3D3B6A6494B1C861B99F649C6F9EC51ABAF201B20F297327C95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
55
TCP/UDP connections
42
DNS requests
29
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6768
MoUsoCoreWorker.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
7288
svchost.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
958 b
whitelisted
5568
SearchApp.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
US
binary
313 b
whitelisted
356
svchost.exe
POST
400
20.190.159.4:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
7728
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
356
svchost.exe
POST
400
20.190.159.4:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
7288
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
7728
SIHClient.exe
GET
200
74.178.240.51:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
7728
SIHClient.exe
GET
200
74.179.77.204:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7288
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
8740
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5568
SearchApp.exe
2.16.204.161:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
5568
SearchApp.exe
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
356
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.16.204.161
  • 2.16.204.141
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
google.com
  • 142.251.208.174
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.131
  • 40.126.31.69
  • 40.126.31.128
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.75
  • 40.126.31.3
  • 20.190.160.14
  • 20.190.160.128
  • 40.126.32.72
  • 20.190.160.17
  • 20.190.160.67
  • 40.126.32.134
  • 20.190.160.2
  • 40.126.32.68
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.42
  • 23.216.77.20
  • 23.216.77.25
  • 23.216.77.19
  • 23.216.77.38
  • 23.216.77.22
  • 23.216.77.18
  • 23.216.77.30
whitelisted
www.microsoft.com
  • 23.59.18.102
  • 72.246.29.11
whitelisted
slscr.update.microsoft.com
  • 74.179.77.204
whitelisted

Threats

PID
Process
Class
Message
7288
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
6900
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6900
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6900
powershell.exe
Misc activity
ET INFO Request for EXE via Powershell
6900
powershell.exe
Misc activity
ET INFO Packed Executable Download
3664
svchost.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
jjsploit_8.17.8_x64_en-US.msi