c5df7e16841afed0a82b8a4d37ca5a0fd09a7385dd6597c80ba60d341927f4a6

Analysis

max time kernel
151s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2023, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MCreator.2023.1.Windows.64bit.exe
Size

226.2MB
MD5

249b8ea8075cfc731ffe17e656ef91b6
SHA1

c7fb2e6abd3fc17b07294294ae6672db7e5114a4
SHA256

c5df7e16841afed0a82b8a4d37ca5a0fd09a7385dd6597c80ba60d341927f4a6
SHA512

157d10b84dfa37f7a34104bb15472b037a42eab304df778d0851ae4eb4a48b52f8e5087ee341d0ff7636dc77329050a4c214d2cc1c0a466eb650e5397bf54ab0
SSDEEP

6291456:YFnbAQd4nExIyC5zZuFM8CjLKRx17fPLNMcQ:YN0qSuu8Cf41ZQ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	javaw.exe

Executes dropped EXE 4 IoCs

pid	Process
4664	mcreator.exe
3756	javaw.exe
4316	mcreator.exe
2860	javaw.exe

Loads dropped DLL 64 IoCs

pid	Process
4788	MCreator.2023.1.Windows.64bit.exe
4788	MCreator.2023.1.Windows.64bit.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe
3756	javaw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Pylo\MCreator\license\JUnidecode License.txt	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\api-ms-win-crt-math-l1-1-0.dll	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\sunmscapi.dll	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\lib\modules	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\lib\commonmark-ext-gfm-tables-0.17.0.jar	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\lib\paulscode-soundsystem.jar	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\java.exe	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.jartool\ASSEMBLY_EXCEPTION	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.nio.mapmode\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.jsobject\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.random\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\license\Gson License.txt	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\license\SoundSystem LibraryJavaSound License.txt	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\license\SoundSystem License.txt	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\jimage.dll	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\java.smartcardio\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\java.xml.crypto\ASSEMBLY_EXCEPTION	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\java.base\wepoll.md	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.httpserver\ASSEMBLY_EXCEPTION	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\conf\security\java.policy	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.editpad\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.management.agent\ASSEMBLY_EXCEPTION	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\license\Noto Font License.txt	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.security.auth\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\lib\guava-31.1-jre.jar	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.random\ASSEMBLY_EXCEPTION	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.security.jgss\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\lib\slf4j-api-2.0.6.jar	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\api-ms-win-core-util-l1-1-0.dll	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\jstat.exe	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\keytool.exe	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\vcruntime140_1.dll	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.management.jfr\ADDITIONAL_LICENSE_INFO	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\lib\slf4j-nop-2.0.6.jar	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\java.desktop\jpeg.md	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.javadoc\jquery.md	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.jconsole\ADDITIONAL_LICENSE_INFO	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.jdi\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\net.dll	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.incubator.vector\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\lib\jfr\profile.jfc	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\plugins\mcreator-themes.zip	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\api-ms-win-crt-utility-l1-1-0.dll	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\jmap.exe	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\jmods\jdk.crypto.cryptoki.jmod	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\jmods\jdk.incubator.foreign.jmod	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.internal.ed\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\dt_shmem.dll	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\jmods\jdk.javadoc.jmod	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.httpserver\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.incubator.foreign\ASSEMBLY_EXCEPTION	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.management\LICENSE	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\api-ms-win-core-synch-l1-1-0.dll	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\jmods\jdk.management.jmod	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.unsupported\ASSEMBLY_EXCEPTION	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\license\Blockly License.txt	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\license\YamlBeans License.txt	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\jmods\jdk.jlink.jmod	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\java.security.jgss\ASSEMBLY_EXCEPTION	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.dynalink\dynalink.md	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.internal.opt\ADDITIONAL_LICENSE_INFO	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\legal\jdk.jpackage\ADDITIONAL_LICENSE_INFO	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\lib\javafx-media-19-win.jar	MCreator.2023.1.Windows.64bit.exe
File created	C:\Program Files\Pylo\MCreator\jdk\bin\api-ms-win-core-string-l1-1-0.dll	MCreator.2023.1.Windows.64bit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\shell\open	MCreator.2023.1.Windows.64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\shell\open\command\ = "\"C:\\Program Files\\Pylo\\MCreator\\mcreator.exe\" \"%1\""	MCreator.2023.1.Windows.64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\shell	MCreator.2023.1.Windows.64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\shell\edit\command\ = "\"C:\\Program Files\\Pylo\\MCreator\\mcreator.exe\" \"%1\""	MCreator.2023.1.Windows.64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\shell\open\command	MCreator.2023.1.Windows.64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\ = "MCreator workspace file"	MCreator.2023.1.Windows.64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\DefaultIcon\ = "C:\\Program Files\\Pylo\\MCreator\\mcreator.exe,0"	MCreator.2023.1.Windows.64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\shell\edit	MCreator.2023.1.Windows.64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\shell\edit\ = "Edit this MCreator workspace"	MCreator.2023.1.Windows.64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\shell\edit\command	MCreator.2023.1.Windows.64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mcreator	MCreator.2023.1.Windows.64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mcreator\ = "MCreatorWorkspaceFile"	MCreator.2023.1.Windows.64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile	MCreator.2023.1.Windows.64bit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\shell\ = "open"	MCreator.2023.1.Windows.64bit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MCreatorWorkspaceFile\DefaultIcon	MCreator.2023.1.Windows.64bit.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3756	javaw.exe
2860	javaw.exe
3756	javaw.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4664	4788	MCreator.2023.1.Windows.64bit.exe	102
PID 4788 wrote to memory of 4664	4788	MCreator.2023.1.Windows.64bit.exe	102
PID 4788 wrote to memory of 4664	4788	MCreator.2023.1.Windows.64bit.exe	102
PID 4664 wrote to memory of 3756	4664	mcreator.exe	103
PID 4664 wrote to memory of 3756	4664	mcreator.exe	103
PID 4316 wrote to memory of 2860	4316	mcreator.exe	106
PID 4316 wrote to memory of 2860	4316	mcreator.exe	106

C:\Users\Admin\AppData\Local\Temp\MCreator.2023.1.Windows.64bit.exe
"C:\Users\Admin\AppData\Local\Temp\MCreator.2023.1.Windows.64bit.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files\Pylo\MCreator\mcreator.exe
  "C:\Program Files\Pylo\MCreator\mcreator.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Program Files\Pylo\MCreator\jdk\bin\javaw.exe
    "C:\Program Files\Pylo\MCreator\jdk\bin\javaw.exe" --add-opens=java.base/java.lang=ALL-UNNAMED -classpath "null\mcreator.jar;.\lib\.;.\lib\..;.\lib\autocomplete-3.3.1.jar;.\lib\autolink-0.10.0.jar;.\lib\balloontip-1.2.4.1.jar;.\lib\blockly.jar;.\lib\checker-qual-3.12.0.jar;.\lib\commonmark-0.17.0.jar;.\lib\commonmark-ext-autolink-0.17.0.jar;.\lib\commonmark-ext-gfm-tables-0.17.0.jar;.\lib\commons-io-2.11.0.jar;.\lib\commons-lang3-3.12.0.jar;.\lib\commons-text-1.10.0.jar;.\lib\discord-rpc.jar;.\lib\error_prone_annotations-2.11.0.jar;.\lib\failureaccess-1.0.1.jar;.\lib\flag-icons.jar;.\lib\freemarker-2.3.32.jar;.\lib\gradle-tooling-api-8.0.2.jar;.\lib\gson-2.10.1.jar;.\lib\guava-31.1-jre.jar;.\lib\j2objc-annotations-1.3.jar;.\lib\JavaEWAH-1.1.13.jar;.\lib\javafx-base-19-win.jar;.\lib\javafx-base-19.jar;.\lib\javafx-controls-19-win.jar;.\lib\javafx-controls-19.jar;.\lib\javafx-graphics-19-win.jar;.\lib\javafx-graphics-19.jar;.\lib\javafx-media-19-win.jar;.\lib\javafx-media-19.jar;.\lib\javafx-swing-19-win.jar;.\lib\javafx-web-19-win.jar;.\lib\javassist-3.28.0-GA.jar;.\lib\jna-5.13.0.jar;.\lib\jnbt.jar;.\lib\jsr305-3.0.2.jar;.\lib\junidecode-0.3.jar;.\lib\languagesupport-3.3.0.jar;.\lib\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;.\lib\log4j-api-2.19.0.jar;.\lib\log4j-core-2.19.0.jar;.\lib\mcreator.jar;.\lib\obj-0.3.0.jar;.\lib\org.eclipse.jgit-6.4.0.202211300538-r.jar;.\lib\paulscode-codecjorbis.jar;.\lib\paulscode-libraryjavasound.jar;.\lib\paulscode-soundsystem.jar;.\lib\reflections-0.10.2.jar;.\lib\roaster-api-2.28.0.Final.jar;.\lib\roaster-jdt-2.28.0.Final.jar;.\lib\rsyntaxtextarea-3.3.2.jar;.\lib\slf4j-api-2.0.6.jar;.\lib\slf4j-nop-2.0.6.jar;.\lib\univocity-parsers-2.9.1.jar;.\lib\yamlbeans-1.15.jar" net.mcreator.Launcher
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:3756

C:\Program Files\Pylo\MCreator\mcreator.exe
"C:\Program Files\Pylo\MCreator\mcreator.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files\Pylo\MCreator\jdk\bin\javaw.exe
  "C:\Program Files\Pylo\MCreator\jdk\bin\javaw.exe" --add-opens=java.base/java.lang=ALL-UNNAMED -classpath "null\mcreator.jar;.\lib\.;.\lib\..;.\lib\autocomplete-3.3.1.jar;.\lib\autolink-0.10.0.jar;.\lib\balloontip-1.2.4.1.jar;.\lib\blockly.jar;.\lib\checker-qual-3.12.0.jar;.\lib\commonmark-0.17.0.jar;.\lib\commonmark-ext-autolink-0.17.0.jar;.\lib\commonmark-ext-gfm-tables-0.17.0.jar;.\lib\commons-io-2.11.0.jar;.\lib\commons-lang3-3.12.0.jar;.\lib\commons-text-1.10.0.jar;.\lib\discord-rpc.jar;.\lib\error_prone_annotations-2.11.0.jar;.\lib\failureaccess-1.0.1.jar;.\lib\flag-icons.jar;.\lib\freemarker-2.3.32.jar;.\lib\gradle-tooling-api-8.0.2.jar;.\lib\gson-2.10.1.jar;.\lib\guava-31.1-jre.jar;.\lib\j2objc-annotations-1.3.jar;.\lib\JavaEWAH-1.1.13.jar;.\lib\javafx-base-19-win.jar;.\lib\javafx-base-19.jar;.\lib\javafx-controls-19-win.jar;.\lib\javafx-controls-19.jar;.\lib\javafx-graphics-19-win.jar;.\lib\javafx-graphics-19.jar;.\lib\javafx-media-19-win.jar;.\lib\javafx-media-19.jar;.\lib\javafx-swing-19-win.jar;.\lib\javafx-web-19-win.jar;.\lib\javassist-3.28.0-GA.jar;.\lib\jna-5.13.0.jar;.\lib\jnbt.jar;.\lib\jsr305-3.0.2.jar;.\lib\junidecode-0.3.jar;.\lib\languagesupport-3.3.0.jar;.\lib\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;.\lib\log4j-api-2.19.0.jar;.\lib\log4j-core-2.19.0.jar;.\lib\mcreator.jar;.\lib\obj-0.3.0.jar;.\lib\org.eclipse.jgit-6.4.0.202211300538-r.jar;.\lib\paulscode-codecjorbis.jar;.\lib\paulscode-libraryjavasound.jar;.\lib\paulscode-soundsystem.jar;.\lib\reflections-0.10.2.jar;.\lib\roaster-api-2.28.0.Final.jar;.\lib\roaster-jdt-2.28.0.Final.jar;.\lib\rsyntaxtextarea-3.3.2.jar;.\lib\slf4j-api-2.0.6.jar;.\lib\slf4j-nop-2.0.6.jar;.\lib\univocity-parsers-2.9.1.jar;.\lib\yamlbeans-1.15.jar" net.mcreator.Launcher
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Pylo\MCreator\jdk\bin\VCRUNTIME140.dll

Filesize
93KB

MD5
aa758bec560241ad6a2e4f2ec309caa9

SHA1
f1900d855d7b7a7ddff060d6bd15739f49c8bfea

SHA256
36156f164b8e260e4fd0b4a5da3d817967cad1b249a9ccbdc97ad0a16d1deb19

SHA512
a074a7dcffc98d8822c50936c92623e0d610285253524d05a483ed7905ee82919fba769d9d661a85a5e3978ac21e695a353f80959a84d893a6711a87b916aba4

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\java.dll

Filesize
142KB

MD5
be62513fa4d676b6c2e9ded257a1e886

SHA1
ea4b72e8bce2226007440f62207b82e370dd6732

SHA256
86f8fe2522afe0af4217dced3cf7348e0c55d9f677a24e42e8f8342e1d7081dc

SHA512
b4512bbdea3f2eb60ce0dc0224bb4d6eef4963debd213e816267121932fed0b7c076a5118666a7036e442b30d606583885bd7b9f4859525633e05e1ac5a0df77

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\java.dll

Filesize
142KB

MD5
be62513fa4d676b6c2e9ded257a1e886

SHA1
ea4b72e8bce2226007440f62207b82e370dd6732

SHA256
86f8fe2522afe0af4217dced3cf7348e0c55d9f677a24e42e8f8342e1d7081dc

SHA512
b4512bbdea3f2eb60ce0dc0224bb4d6eef4963debd213e816267121932fed0b7c076a5118666a7036e442b30d606583885bd7b9f4859525633e05e1ac5a0df77

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\javaw.exe

Filesize
48KB

MD5
09c545f1faf76491ee6a3c4dfc2c04d1

SHA1
73b14ba87370201e57fe9a284b7e25a89eac137e

SHA256
954c9c7ac1ba9481d547ab97029283203bd93ac5d658de18409968e08a5f7ff1

SHA512
418ccd60a129dc2f342b2fa583a49a7ddc8c98fdcdfb1269889ea41a55f11f7451ce4f6ace102c9cc82caf3743e80b54197dcd2ca8753476d74dc9483b1a8834

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\jimage.dll

Filesize
32KB

MD5
b836040eb999770cc8c3099c51b3a3aa

SHA1
45031c1769533449437089f58c65b4d69f4fd670

SHA256
a17cc18df49653182b0f08e85dcebf42acc8b90d4504386bc439dfee92abf1ce

SHA512
20f622d6351c83c806601ac7938fcb433fc28a7e3bd24022880a34323cce32570dcb3b36532730530cc4f42e0cfc5aa983727c627c6cc18e94167b0c9c3078a2

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\jimage.dll

Filesize
32KB

MD5
b836040eb999770cc8c3099c51b3a3aa

SHA1
45031c1769533449437089f58c65b4d69f4fd670

SHA256
a17cc18df49653182b0f08e85dcebf42acc8b90d4504386bc439dfee92abf1ce

SHA512
20f622d6351c83c806601ac7938fcb433fc28a7e3bd24022880a34323cce32570dcb3b36532730530cc4f42e0cfc5aa983727c627c6cc18e94167b0c9c3078a2

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\jli.dll

Filesize
84KB

MD5
dd69b2e99672eea78cad885a8b78a45f

SHA1
4c39d1ba41a98f65d11af1e9ce69a79d66fd47d9

SHA256
dd1d1ac7756f9a36d2fd1d5b983cc1acf0b3b09eb955103a170f3b7c5a4c170b

SHA512
1b21ee5cfb3fe1065930d776a5abfcf7ded1a214f6d344d7758e655d77a8fb185150fd2aecaafdfbb9a9be64422d777e4da7b6113010777181b7c1f47dea402f

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\jli.dll

Filesize
84KB

MD5
dd69b2e99672eea78cad885a8b78a45f

SHA1
4c39d1ba41a98f65d11af1e9ce69a79d66fd47d9

SHA256
dd1d1ac7756f9a36d2fd1d5b983cc1acf0b3b09eb955103a170f3b7c5a4c170b

SHA512
1b21ee5cfb3fe1065930d776a5abfcf7ded1a214f6d344d7758e655d77a8fb185150fd2aecaafdfbb9a9be64422d777e4da7b6113010777181b7c1f47dea402f

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\jsvml.dll

Filesize
849KB

MD5
cef40a5abf375a818311fe1e739b4cef

SHA1
2ff7f81be209d9537a3d876b4000aedbcfcbbe94

SHA256
bb6353567e91e9ae8aec93967f0d644fa0245609a1d512e8559e5d9cbacb19c3

SHA512
a2881fd71086d864c8acfbef82b0bcacfa6df317eface29c7738fa389143cc3407f42d85ab21268d2803644d09d8e8339c42f5b18935a880fdd862a2b35f50e0

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\jsvml.dll

Filesize
849KB

MD5
cef40a5abf375a818311fe1e739b4cef

SHA1
2ff7f81be209d9537a3d876b4000aedbcfcbbe94

SHA256
bb6353567e91e9ae8aec93967f0d644fa0245609a1d512e8559e5d9cbacb19c3

SHA512
a2881fd71086d864c8acfbef82b0bcacfa6df317eface29c7738fa389143cc3407f42d85ab21268d2803644d09d8e8339c42f5b18935a880fdd862a2b35f50e0

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\msvcp140.dll

Filesize
570KB

MD5
9ddeb9deac93305950a23fc8acae87a5

SHA1
f4abff7004b49030a8f631f7b87242f19c46e5d2

SHA256
a393ff44358412cbbe04ec48d2e69ba4c3c3cd5bcfbc37e717d54a50c82ead8c

SHA512
c1e1ec9de1894809b9eda6634f2f5500c4ef9a0e115e902624261a828cf8f7b70d3f10d3feeb3971884f62a496591b76d079f7e554e8272585a4ff0b5901c3e7

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\msvcp140.dll

Filesize
570KB

MD5
9ddeb9deac93305950a23fc8acae87a5

SHA1
f4abff7004b49030a8f631f7b87242f19c46e5d2

SHA256
a393ff44358412cbbe04ec48d2e69ba4c3c3cd5bcfbc37e717d54a50c82ead8c

SHA512
c1e1ec9de1894809b9eda6634f2f5500c4ef9a0e115e902624261a828cf8f7b70d3f10d3feeb3971884f62a496591b76d079f7e554e8272585a4ff0b5901c3e7

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\net.dll

Filesize
94KB

MD5
5a5c177dce771c71194f796542ab1e0b

SHA1
2d08166e6b246b8f24ded8a36e793ff8ab415bd3

SHA256
89b36e95cff3edd01f6de98a933560e3608c5d0db636397bcae88b7bff27486c

SHA512
1b37b12757c22bfef3a9a4042438663d092dd84ab63f30c725a916f79eb444f29d5b796b99da6e924bf4875929bba0e98ab8ebb9faaaf9d127a277d6b1f46551

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\net.dll

Filesize
94KB

MD5
5a5c177dce771c71194f796542ab1e0b

SHA1
2d08166e6b246b8f24ded8a36e793ff8ab415bd3

SHA256
89b36e95cff3edd01f6de98a933560e3608c5d0db636397bcae88b7bff27486c

SHA512
1b37b12757c22bfef3a9a4042438663d092dd84ab63f30c725a916f79eb444f29d5b796b99da6e924bf4875929bba0e98ab8ebb9faaaf9d127a277d6b1f46551

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\nio.dll

Filesize
77KB

MD5
89f7195b35b40ab7e90d3c7ded73fdbc

SHA1
5b3ef7c20ff07596d7ae5d1ef5104a18c16ab682

SHA256
8fd661f97818010b77609c13c88c1c9ae6ffb95ee57c1299f7bb7df0d682b6a4

SHA512
c2ca283fd5816314b9e8ef7d35f7dd31c23f4b2314090b959237594af21c7af1aade1d65a10961db817a62313b781fa0b19e7744c2a0fb382a755a1d04174083

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\nio.dll

Filesize
77KB

MD5
89f7195b35b40ab7e90d3c7ded73fdbc

SHA1
5b3ef7c20ff07596d7ae5d1ef5104a18c16ab682

SHA256
8fd661f97818010b77609c13c88c1c9ae6ffb95ee57c1299f7bb7df0d682b6a4

SHA512
c2ca283fd5816314b9e8ef7d35f7dd31c23f4b2314090b959237594af21c7af1aade1d65a10961db817a62313b781fa0b19e7744c2a0fb382a755a1d04174083

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\server\classes.jsa

Filesize
12.0MB

MD5
eea1a21781831aa5da87abc825623cef

SHA1
015fe29e28e4963705cf6158b4416f42d53ccfe7

SHA256
31ab62c955248682cc47110d0768e46f2f6d3338562e790b3a170cc482e651b9

SHA512
d1ac66f887acb66b58fcbb3dcc8d3f4946bcdf6982602c59ffc7f640adc098216a3d7988ef8676de670fbc1fa40e5370f49d660650fd1fc7e2db149248050128

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\server\jvm.dll

Filesize
11.9MB

MD5
0e996545932fd7b447a24e7c7f1b46e0

SHA1
9f281d82c264ef69b77ca6efb9639286d742d6a3

SHA256
174ed77ca43fb96c87a66dd4f1c22d76c3b1c6c2a81ed416ff1ada6c56663903

SHA512
68619344087d19d98df1729743a9c8990c7b483b670799c9a80025f4e14f311cecb0401815404cd0612733a4cd69bf1769a9358d39245a6859664fba461a45c8

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\server\jvm.dll

Filesize
11.9MB

MD5
0e996545932fd7b447a24e7c7f1b46e0

SHA1
9f281d82c264ef69b77ca6efb9639286d742d6a3

SHA256
174ed77ca43fb96c87a66dd4f1c22d76c3b1c6c2a81ed416ff1ada6c56663903

SHA512
68619344087d19d98df1729743a9c8990c7b483b670799c9a80025f4e14f311cecb0401815404cd0612733a4cd69bf1769a9358d39245a6859664fba461a45c8

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\vcruntime140.dll

Filesize
93KB

MD5
aa758bec560241ad6a2e4f2ec309caa9

SHA1
f1900d855d7b7a7ddff060d6bd15739f49c8bfea

SHA256
36156f164b8e260e4fd0b4a5da3d817967cad1b249a9ccbdc97ad0a16d1deb19

SHA512
a074a7dcffc98d8822c50936c92623e0d610285253524d05a483ed7905ee82919fba769d9d661a85a5e3978ac21e695a353f80959a84d893a6711a87b916aba4

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\vcruntime140_1.dll

Filesize
37KB

MD5
1437e1e8cc0b8fe16fb40f7b5f3ff9a8

SHA1
113e5793148504423e9cd6ac9d79750923d75b85

SHA256
2371a3f1a3eb30f51181d01ac013291e4334e9e7b4cf1a146d341b86b87d3317

SHA512
80a3d8cffe8088b9edbaa4cc3cc6c171ff6c4c61c709d88df848568b5ea622e6f83c5079a06ea1dbccbc3efebe9d30cb0d8292b08b7500351430a7bdc2b0fe5f

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\vcruntime140_1.dll

Filesize
37KB

MD5
1437e1e8cc0b8fe16fb40f7b5f3ff9a8

SHA1
113e5793148504423e9cd6ac9d79750923d75b85

SHA256
2371a3f1a3eb30f51181d01ac013291e4334e9e7b4cf1a146d341b86b87d3317

SHA512
80a3d8cffe8088b9edbaa4cc3cc6c171ff6c4c61c709d88df848568b5ea622e6f83c5079a06ea1dbccbc3efebe9d30cb0d8292b08b7500351430a7bdc2b0fe5f

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\zip.dll

Filesize
84KB

MD5
cd483bc473456f598087074df9e10a9c

SHA1
d3fbf1ea94459146b20b12992f2fddb7a2db0cee

SHA256
bb5f0843808b429fd72714bda18722c1f6a1695330660ffaea1e15f5292430e3

SHA512
f65f5fbcd377853aae24dd2ae2bf865a48ddf202f1b7b6b5910ac417e6b50c7e0b0ddba8e68c1fd139950496b458708d640c3feadcf80af2a4c0a095cc02f6f3

Download Submit
C:\Program Files\Pylo\MCreator\jdk\bin\zip.dll

Filesize
84KB

MD5
cd483bc473456f598087074df9e10a9c

SHA1
d3fbf1ea94459146b20b12992f2fddb7a2db0cee

SHA256
bb5f0843808b429fd72714bda18722c1f6a1695330660ffaea1e15f5292430e3

SHA512
f65f5fbcd377853aae24dd2ae2bf865a48ddf202f1b7b6b5910ac417e6b50c7e0b0ddba8e68c1fd139950496b458708d640c3feadcf80af2a4c0a095cc02f6f3

Download Submit
C:\Program Files\Pylo\MCreator\jdk\legal\java.logging\ADDITIONAL_LICENSE_INFO

Filesize
49B

MD5
19c9d1d2aad61ce9cb8fb7f20ef1ca98

SHA1
2db86ab706d9b73feeb51a904be03b63bee92baf

SHA256
ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9

SHA512
7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b

Download Submit
C:\Program Files\Pylo\MCreator\jdk\legal\java.logging\ASSEMBLY_EXCEPTION

Filesize
44B

MD5
7caf4cdbb99569deb047c20f1aad47c4

SHA1
24e7497426d27fe3c17774242883ccbed8f54b4d

SHA256
b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a

SHA512
a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619

Download Submit
C:\Program Files\Pylo\MCreator\jdk\legal\java.logging\LICENSE

Filesize
33B

MD5
16989bab922811e28b64ac30449a5d05

SHA1
51ab20e8c19ee570bf6c496ec7346b7cf17bd04a

SHA256
86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192

SHA512
86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608

Download Submit
C:\Program Files\Pylo\MCreator\jdk\lib\jvm.cfg

Filesize
29B

MD5
7ce21bdcfa333c231d74a77394206302

SHA1
c5a940d2dee8e7bfc01a87d585ddca420d37e226

SHA256
aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0

SHA512
8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b

Download Submit
C:\Program Files\Pylo\MCreator\jdk\lib\modules

Filesize
122.1MB

MD5
519427e2c43c7528e2a76a8fcb7ca9ee

SHA1
d2a74f29aa308b1e0ebca014752fe8fd66a3df80

SHA256
8093c1e72e3ec66dc1e5c264a17d70af0e74c7d6704ccf536a4b242bc9d59ca1

SHA512
4941675e466588cb44646fa246b3aebcb9f8d0378b3bf1c3455ab1d7e4b001c37a9e6571b4bcbef2b741a3208f5087eeb5b057f236a66fa955143cb5036f5985

Download Submit
C:\Program Files\Pylo\MCreator\lib\JavaEWAH-1.1.13.jar

Filesize
162KB

MD5
a1eb305e5cc5bba238d4360e3139abb4

SHA1
32cd724a42dc73f99ca08453d11a4bb83e0034c7

SHA256
4c0fda2b1d317750d7ea324e36c70b2bc48310c0aaae67b98df0915d696d7111

SHA512
5a3821a07eebc9b56f87054c71b9bafa0d9d0b556aa16191f8676d748cec755a741cd5500e8676493ffca69e6c9608caf86d80b60b5934ee108d77030c490194

Download Submit
C:\Program Files\Pylo\MCreator\lib\autocomplete-3.3.1.jar

Filesize
150KB

MD5
da396024b8a9302b07c35c7d436b1d58

SHA1
27b0ed1f8706fb07455bd329ad0fcc54b75e9219

SHA256
0b8e0f6286442f3ede8c359dd42032ef9fdf1a6bbace8512418f7cca90acb5c9

SHA512
62913e74d80710d1108ad0bfdeb926bccf8039fa0594677abeec718287d0540c82f9fee675a87e57e9ab7538c7b4326c30952aded5c8b39d41776df12b635b89

Download Submit
C:\Program Files\Pylo\MCreator\lib\autolink-0.10.0.jar

Filesize
19KB

MD5
be771f6d4d82b9098596afa30b4f48ea

SHA1
6579ea7079be461e5ffa99f33222a632711cc671

SHA256
302b30160968415ee6cd1907987138c7575a6315f9b6ef13b9fe3abc87367857

SHA512
42f7f0b21112d5d9b43f3bf255cfe1e99896afd5b63da0fb21e528e60c2319bf2b6add3964d3a223966b0a6bd2f17b4bbc8a3080a0f7c4dd92abfccfeb44e38b

Download Submit
C:\Program Files\Pylo\MCreator\lib\balloontip-1.2.4.1.jar

Filesize
60KB

MD5
7de48c78c812fdb9ed52d122654802a6

SHA1
eb475b60f7270cd8a70e0fc5904d1efbaffc16be

SHA256
22b5b40af9ef91e3072745bd445aa098d781586aa3c23300b468e2f24aff4d0d

SHA512
6eb291d18f358f275055d0b17402105ad939f1fecb35eba2d6718a99643a3d87f1ebe98c98f37d857ea65704fdd9256a335d3c7d665c4e8341c13e5b965c5ac0

Download Submit
C:\Program Files\Pylo\MCreator\lib\blockly.jar

Filesize
1.1MB

MD5
7cc214b744201691106823d672ad7351

SHA1
1b4300554b3bb53b67c81303a2e2c5473765b26f

SHA256
68ab1965d3e1a993e6cf6ec43691cd9278b4448a8e59622f05149ea10754c56d

SHA512
07edc2e82fd1cc6137456d7426db1fe471f817a9d4388e267a354f759d13a2d8a26b44f5e5484e85950618e67fec2a160db6b933bdb9dd341a88514b090f66b4

Download Submit
C:\Program Files\Pylo\MCreator\lib\checker-qual-3.12.0.jar

Filesize
203KB

MD5
ab1ae0e2f2f63601597a5a96fca8a54f

SHA1
d5692f0526415fcc6de94bb5bfbd3afd9dd3b3e5

SHA256
ff10785ac2a357ec5de9c293cb982a2cbb605c0309ea4cc1cb9b9bc6dbe7f3cb

SHA512
ff20c424e130c31c30b4f4f5b4374f8f98f94ddae2b123f3c213f147be6b3de57854ee5651b02dd97d352c1c1df2a8bfeef73d5307a71372f46a6002eab24d78

Download Submit
C:\Program Files\Pylo\MCreator\lib\commonmark-0.17.0.jar

Filesize
163KB

MD5
fb0d276191ca46372c004b39adc1965c

SHA1
0a344223d4c3b5113fa9cbbd3afa2738c138f03b

SHA256
39711999901600d6366d2ef461e20ee8a46c1c21c8464f37bc9cb9a94cc3789f

SHA512
4b97dda9867e1c46abf3be56bff243216c77ed1ac624c67f62e2a9cbb0adb993bec0758ca3997f77d295c1d73d57aa80f776a8f49ce98ef0c15f80cabdebf3cf

Download Submit
C:\Program Files\Pylo\MCreator\lib\commonmark-ext-autolink-0.17.0.jar

Filesize
6KB

MD5
6393bf1af231c712274d9372818c96c1

SHA1
b31a6ed5bc6f804d3aa878d69e954c2461f40ed9

SHA256
b279fa170a6bfeed8431fd367efd8be1221114719429494ed8c808eec5ccd7de

SHA512
23f1e3548a7531f2d074fc530e81396a9d6d1e55acf1829e007b0acee655ce141cc1ae07e78c67e4974c99dbd7f5a78503f0869a7cecd2d9369ab70a92efe992

Download Submit
C:\Program Files\Pylo\MCreator\lib\commonmark-ext-gfm-tables-0.17.0.jar

Filesize
18KB

MD5
9cf1dec8c321810acc9bd647be2efe8f

SHA1
94c02caa72a3c736bdae9076e354209eaa7fa9ed

SHA256
c552e6f47a08ce0318aaa7a2a638f3b1c35b2cb1877d0bc4aac5d23e3651ec19

SHA512
a0d1bc29aee666f2634795a1e7b207d0ea79bb16a7ee0c5c89dd468340525046fd7ea974cd9a6c153f942dfffd6ffcc41f3284998b91480796d8bc75cdd67a16

Download Submit
C:\Program Files\Pylo\MCreator\lib\commons-io-2.11.0.jar

Filesize
319KB

MD5
3b4b7ccfaeceeac240b804839ee1a1ca

SHA1
a2503f302b11ebde7ebc3df41daebe0e4eea3689

SHA256
961b2f6d87dbacc5d54abf45ab7a6e2495f89b75598962d8c723cea9bc210908

SHA512
5bd78eed456ede30119319c5bed8e3e4c443b6fd7bdb3a7a5686647bd83094d0c3e2832a7575cfb60e4ef25f08106b93476939d3adcfecf5533cc030b3039e10

Download Submit
C:\Program Files\Pylo\MCreator\lib\commons-lang3-3.12.0.jar

Filesize
573KB

MD5
19fe50567358922bdad277959ea69545

SHA1
c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e

SHA256
d919d904486c037f8d193412da0c92e22a9fa24230b9d67a57855c5c31c7e94e

SHA512
fbdbc0943cb3498b0148e86a39b773f97c8e6013740f72dbc727faeabea402073e2cc8c4d68198e5fc6b08a13b7700236292e99d4785f2c9989f2e5fac11fd81

Download Submit
C:\Program Files\Pylo\MCreator\lib\commons-text-1.10.0.jar

Filesize
232KB

MD5
4afc9bfa2d31dbf7330c98fcc954b892

SHA1
3363381aef8cef2dbc1023b3e3a9433b08b64e01

SHA256
770cd903fa7b604d1f7ef7ba17f84108667294b2b478be8ed1af3bffb4ae0018

SHA512
afd836a1094449e0a791fee67363666c47b6d24acff353a5089b837b332c0f4af89565c354682521e37062d20e6b52d70c77bb4f24cca9b9532c274fc708a831

Download Submit
C:\Program Files\Pylo\MCreator\lib\discord-rpc.jar

Filesize
604KB

MD5
9b6479129115fa57d1b5e9b0873bcb32

SHA1
f4ce873072ea816408d085f9d66615407cba0e83

SHA256
ca9a767bac0bab603a6f9f0acdcb12b63c3196b19c70ea0206e62a7c9086c28b

SHA512
5d26b1d9f91186b7159f11b08898bf324f99284bf624a2da2427269415115b0745a7ef1184c0d8dc60545e9d7caa07377f5683104a67babbf6b97efdb7b88e9b

Download Submit
C:\Program Files\Pylo\MCreator\lib\error_prone_annotations-2.11.0.jar

Filesize
15KB

MD5
656ad66261b7e7ea472ed0ffeea773ea

SHA1
c5a0ace696d3f8b1c1d8cc036d8c03cc0cbe6b69

SHA256
721cb91842b46fa056847d104d5225c8b8e1e8b62263b993051e1e5a0137b7ec

SHA512
defcaf30b7def5071243f3982d0d81c47c05b1a95c4d6143b3af86451e97c212c8d620d7220784e541fe8ee95f7fc59452fa6392fa37dac2d5705bfaf06105ba

Download Submit
C:\Program Files\Pylo\MCreator\lib\failureaccess-1.0.1.jar

Filesize
4KB

MD5
091883993ef5bfa91da01dcc8fc52236

SHA1
1dcf1de382a0bf95a3d8b0849546c88bac1292c9

SHA256
a171ee4c734dd2da837e4b16be9df4661afab72a41adaf31eb84dfdaf936ca26

SHA512
f8d59b808d6ba617252305b66d5590937da9b2b843d492d06b8d0b1b1f397e39f360d5817707797b979a5bf20bf21987b35333e7a15c44ed7401fea2d2119cae

Download Submit
C:\Program Files\Pylo\MCreator\lib\flag-icons.jar

Filesize
88KB

MD5
a870b5e4549874fa92cd832a15946765

SHA1
699f9b54012ad958c7a5df5f301f764f6ffb0bef

SHA256
3e3a3c00dc47cc53ad39fb5716191d90579e0ec8c002f1c58d982e11f90cffca

SHA512
c68d077564eee3d98f945dc2bc96fd0566f081c39f6835eb5c834f382a4ed0f0928338549406fd43280e1ce6b72a0474ed87bddf9c61df84ba853fa138d48679

Download Submit
C:\Program Files\Pylo\MCreator\lib\freemarker-2.3.32.jar

Filesize
1.7MB

MD5
22624adfe32b76fe3be07a84de4e1c03

SHA1
8607259125d4fbe982754227ea4f75dd513c6d19

SHA256
04d65ec1bde6cea20e3495d5e78ef96ab774d9936434861d3254bd88e7e94f92

SHA512
934c6c2bf47c1b88b1f81c25294cd83f5105f90f565e1fce75a09a54e51424fb8335542a6d5c3eb9df19dbc0007e869e9b6aebaf37880eac09759529dc0c5ca7

Download Submit
C:\Program Files\Pylo\MCreator\lib\gradle-tooling-api-8.0.2.jar

Filesize
2.4MB

MD5
ffaf36be100cbf3aea33b5c742e46ef6

SHA1
9632294b8d455f340939e9bc54c0c9da3db0b656

SHA256
753fcf95a7fb30b5210345c183184ae39a8ef02412006f132c2eec670da601f9

SHA512
ab2257b883ed35fd4285fe9f69230cfe7a73d7c62eed6a8ec5613987aed120ebcf3e68336baade9bbe59d99a840384086325ac30f68d193160464de36428c746

Download Submit
C:\Program Files\Pylo\MCreator\lib\gson-2.10.1.jar

Filesize
276KB

MD5
df6097815738cb31fc56391553210843

SHA1
b3add478d4382b78ea20b1671390a858002feb6c

SHA256
4241c14a7727c34feea6507ec801318a3d4a90f070e4525681079fb94ee4c593

SHA512
7503e4b8d05c6cc0ecb3a94c5a2e070e049083a441003a79a0cdf474f4286699b4ba1d2a655ddabb8ba10c50e7c36a7045cccdaee465166d4630db647aba2727

Download Submit
C:\Program Files\Pylo\MCreator\lib\guava-31.1-jre.jar

Filesize
2.8MB

MD5
e37782d974104aa3b0a7bee9927c8042

SHA1
60458f877d055d0c9114d9e1a2efb737b4bc282c

SHA256
a42edc9cab792e39fe39bb94f3fca655ed157ff87a8af78e1d6ba5b07c4a00ab

SHA512
532664e3dd33699bdfb296e355bc58fde77edc019c10f464ae49fe2494a68fd25d1623a9c86bc72830ca9f1354226366ac6f3c09d77be952641e971386a4ebbb

Download Submit
C:\Program Files\Pylo\MCreator\lib\j2objc-annotations-1.3.jar

Filesize
8KB

MD5
5fa4ec4ec0c5aa70af8a7d4922df1931

SHA1
ba035118bc8bac37d7eff77700720999acd9986d

SHA256
21af30c92267bd6122c0e0b4d20cccb6641a37eaf956c6540ec471d584e64a7b

SHA512
51ea975179f809cb260751d11a513881b643bf016d15949bcb63b57d3c8868a2197e0620ccbaa5739e032797ec6faa3aa6d64606e999fce32930314780ca4115

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-base-19-win.jar

Filesize
734KB

MD5
721bf81c3f9474fb7dc4028ab4f2a9e8

SHA1
0430bec8a362edb04667972905a7cb34cb165d6d

SHA256
32d51dabda569005f8e13bc97367277acb8b164b7d38726aebcf715eec5a3390

SHA512
74d80f6e2e8fda349c0e0e9ea5f43cf0c7b0b0c17d15b9f8027102ec8198f1f2f4b0d8bf2b5f317459ff1bd6897815012afe30fac29029bde0915022cf0fd3f0

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-base-19.jar

Filesize
302B

MD5
07e1004d5584cd0800d9b8145f064ccd

SHA1
80d1a58c5345af9151f1b4b01f8eb92f86fe49ae

SHA256
12a3fe52027ef01c447f59a34f08bec69aecf0bb6c547fc62a4b81b464b36b58

SHA512
20fc07a60284fad0ab3043589e0f78b39530a5175f30760dd21f6b3deb90f87fe850ac9fe1a1cadbafcd3bf32879cf39ea9ff6f740a3d1c172fc57af8f6c7f19

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-controls-19-win.jar

Filesize
2.4MB

MD5
9201d4ec0b82a73ea6a7a5f99dc729ab

SHA1
1227311caf209b428591fb7d2cca27e25f06f0b4

SHA256
837cead2490c54c2fff1d9ecdb64d09177992ff21d0014fdaefcac5031c27f53

SHA512
c6da1ae0e93028e515eb8d2fe77dcea20ea04921f8f9264e0dc2fa043d3b1943308e75c0bb7cc2eb8091e3be0fbdecbe68fdc5f7295f8be7685b458d115e043b

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-controls-19.jar

Filesize
306B

MD5
cf88a5d14c121cb3e7091c82c2a5c4e3

SHA1
9f8d4f41bff27d8ac956b21e5223eaaebb7d9413

SHA256
fe57a4a81c31e7997e06891c11ef54f4654af42b1a6475ffad1638de0c6f858a

SHA512
cd92b440706106e32791e2a863327dd65b0f6d11616ceba010b4b23ebdea7ede6d56cdcd082316aa86d58aec296ac4d5761447e2dea28fbd724bd20a15ee4aa3

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-graphics-19-win.jar

Filesize
5.6MB

MD5
c548992577bacd0b31a020a013e9f68f

SHA1
8e98e30310844cd501f4e03fa3415f6d897c7215

SHA256
30b97d0a4c5e907db1800b42a5c936bfeef409c3352ba0592b3b38f3ab0c8cee

SHA512
b3bc6d9e86f4e25c3b3c5abfc4069b64b2da22ae957582eea5c6c57ac68d3fff578046f470c4e5fc95de1379673f90fa6de3e727d815e5fc929914b34bb70f59

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-graphics-19.jar

Filesize
306B

MD5
15ae4e8adf2e1031cc07d9be2f88e0d1

SHA1
44dbcee46b9e902629bb4e0f409b3d6e10ac8e8b

SHA256
d14546d4b8bd4b7fab43231a418a010a8a72a32f7ff60179b6f80595b33e953d

SHA512
171d33578edd1024bee171a03759a407d96a5feb98068faf65af0cab8ad87de10e32f5a653d0aa318035481ed37fc8dff374d3aa82164b7953682f8f226ce6c0

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-media-19-win.jar

Filesize
1.1MB

MD5
b1d07f42513913606e3821febb95d8fe

SHA1
50bd7cd35678978ec898cf5f9fcca631a106d29d

SHA256
1b80c11d0c1a60f118db21b5151529300d4d551cda0ae82f1a3c276eeff3b2cd

SHA512
5a13263ac7752f7ee72f2b9071156200ddddd219883ab9161ea15ec6ecfca0160a79599fd11fd4201369c35834ac54e2855f3dfae4bc4009944c4d685d682975

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-media-19.jar

Filesize
303B

MD5
d48cbd147d0caed6084557afc01df7a4

SHA1
0937b4f7b378451165c076ab2f51310a19e5a618

SHA256
64998fe2c1c53ef44cec5b0b1e24569c37f3bd3bdfbd32a9b9425ccd74c34106

SHA512
d579886db19edce65891af222b2f5adcdc92f3a01e213123f11043a9ad686c3296998dbbbe2341cdf6ddc54f9dedc275827bc7b5f1b2ea0115f4548339913a7f

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-swing-19-win.jar

Filesize
86KB

MD5
8e536127b60781d7e73f25eaf07823bc

SHA1
562878eb4e5c1d5acebf1e40953c6557196e10ff

SHA256
181de183910d871d226a40264d7ffd3c0ea65dd969eb1e8e573cf3fd15403988

SHA512
c0b25a942dc6a8c3408823f8d35a92c75248279cf0a8b852ddfc2f8495042125ac1596d66b0282489b5acc8d9de49be542896b44225432075b9cd0cac5ded5f2

Download Submit
C:\Program Files\Pylo\MCreator\lib\javafx-web-19-win.jar

Filesize
26.4MB

MD5
53179de9b78741a0fb6d6c0abbd2d81a

SHA1
6be4c7f0560267f658bd34e910dcacc231ac7681

SHA256
4796a37e6830076986e8586f59cf6b36da17831c8dccfcbef9bace9ca6e99575

SHA512
29da0692bbce6036ec0c8fcf4d0ef9cc116730882d60b090a4b8e956974d84ef6037bf88975531f6faf995332cb6a91abec5d1011b5f4baf9f4312abe6a4c5ba

Download Submit
C:\Program Files\Pylo\MCreator\lib\javassist-3.28.0-GA.jar

Filesize
831KB

MD5
1a2dd8c76321cef26cc2669fe70a2557

SHA1
9a958811a88381bb159cc2f5ed79c34a45c4af7a

SHA256
57d0a9e9286f82f4eaa851125186997f811befce0e2060ff0a15a77f5a9dd9a7

SHA512
49d3109104f01efda1ae8a6145fdb91d1b1331587e2981f6cc1a1b991c50af97e8febfea5d9d224a106cab877c1e4850d183eb3c7316b82e62e51b6ca3fc29e8

Download Submit
C:\Program Files\Pylo\MCreator\lib\jna-5.13.0.jar

Filesize
1.8MB

MD5
bd2e5bc6b4b020c2d9a6e17a8e9bcef1

SHA1
1200e7ebeedbe0d10062093f32925a912020e747

SHA256
66d4f819a062a51a1d5627bffc23fac55d1677f0e0a1feba144aabdd670a64bb

SHA512
954b2fbf88e30597276beeceba7d0d0915248f666ea4f7df0bc6283bdb03ab92967421336e2b029a87335dcb07ec5e6af1eb5ea776a6d391727df56c16fc97e7

Download Submit
C:\Program Files\Pylo\MCreator\lib\jnbt.jar

Filesize
16KB

MD5
e4056ea838b897e6afa6b3afd3ce3ea6

SHA1
cee33f21a665f806e24d366971c01177e24e44b5

SHA256
d9a778bf2329c26a8e4cb6cf8721b953a4582ab4c38f971fb1b4c77768401d73

SHA512
05be78ed080368c26cedcf9c21393fee196bb05c47f3c1c3efee418f58406d940d16531b6e8df515f15803bd559a8bd8ef66d77af6504de02ab2c830682ee841

Download Submit
C:\Program Files\Pylo\MCreator\license\JNA License.txt

Filesize
11KB

MD5
0ba5044c64ef53cb0189c9546081e228

SHA1
c8bc7df08db9dd3b39c2c2259a163a36cf2f6808

SHA256
49bbe9114e49214df2ccc324cb3ac8d1d1aa1c3a0947f94c286765e86647b32e

SHA512
a7ce8c7f21c031e4e6d037f4eabe8b200b8f1470731c05ea86028171f2964310dadc5def814d2d65164fbd23d720ecfd4d479ff5e269e519c787b4db96c7724f

Download Submit
C:\Program Files\Pylo\MCreator\mcreator.exe

Filesize
162KB

MD5
0675979320d7906d9e00aa937419f3e8

SHA1
778abd54a5e1feeb481653161ea90b0b6e6e9cfc

SHA256
c074b4fe6fb1c723875e99bd841fc1c948de5221fc775efcd674610a0da95d08

SHA512
214566b65e6357772ee832bff1399f3e7568444c6e8855f15a21f31caf1a40127f99284fb214c2b11e802cd234c9aedab7521dfa6a2383b6d628be05e11f3334

Download Submit
C:\Program Files\Pylo\MCreator\mcreator.exe

Filesize
162KB

MD5
0675979320d7906d9e00aa937419f3e8

SHA1
778abd54a5e1feeb481653161ea90b0b6e6e9cfc

SHA256
c074b4fe6fb1c723875e99bd841fc1c948de5221fc775efcd674610a0da95d08

SHA512
214566b65e6357772ee832bff1399f3e7568444c6e8855f15a21f31caf1a40127f99284fb214c2b11e802cd234c9aedab7521dfa6a2383b6d628be05e11f3334

Download Submit
C:\Program Files\Pylo\MCreator\mcreator.exe

Filesize
162KB

MD5
0675979320d7906d9e00aa937419f3e8

SHA1
778abd54a5e1feeb481653161ea90b0b6e6e9cfc

SHA256
c074b4fe6fb1c723875e99bd841fc1c948de5221fc775efcd674610a0da95d08

SHA512
214566b65e6357772ee832bff1399f3e7568444c6e8855f15a21f31caf1a40127f99284fb214c2b11e802cd234c9aedab7521dfa6a2383b6d628be05e11f3334

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrB210.tmp\System.dll

Filesize
29KB

MD5
26c8a92678f1b970ac2a700bb844c309

SHA1
c821a5980c31b0b35f1505cde836d6769f45e3a3

SHA256
2a7b5d1cab96a5280b0694d0ed54510129626a1ba36a51bd34d546972b7d18b8

SHA512
fba6e371853fd6c27097eb7cce7ffc59d71e4f0a9b5e55de06472d094b70c44a409bd82f39d9a27a814e826ab8468c59e947401a3c3ead1f057cbac236588860

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrB210.tmp\modern-wizard.bmp

Filesize
201KB

MD5
995086b33084c40fdc410a2b45b9fcb3

SHA1
270a4501c76d644350be9e21a700a76560e663c4

SHA256
947f67d9b686e9170d6796a4bf1754ea8222624ccc521747060c261ce98b159f

SHA512
9acfe96ab44d07dff8c0544341d8fbd85fc23cd4d3accc371768071c4b6acb29075faa3b24348a3e97b11251b74effed24dc82ac308cb2bcd06e1eb55f09f19f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrB210.tmp\nsDialogs.dll

Filesize
14KB

MD5
8f45e78d9d02ca8a9f9c274a8bfe2a57

SHA1
9b3838e1d2d4fbc1c84e1252747e96aa1b223d83

SHA256
78f9594721361fd3415b8c5194f9c9b87c580d6a70ddb95f2c4743c61ce68ebe

SHA512
125f1bcf833e0c233ebee552c164d9726769f06e5163467888abea08048fdae60a94b903ef97ba82ca9cf684f3c027d9605d54e9efe794df3e452f9b20e4ca96

Download Submit
memory/3756-1013-0x0000016E0FFD0000-0x0000016E1019E000-memory.dmp

Filesize
1.8MB

Download
memory/4316-1021-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4664-793-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4788-693-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4788-633-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4788-758-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4788-340-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4788-147-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4788-149-0x0000000074890000-0x000000007489F000-memory.dmp

Filesize
60KB

Download
memory/4788-148-0x0000000074940000-0x000000007494C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads