asyncrat | 56c80332c946c8585e38752b0eeacaee9fb330587d8b308e669a7be1b1e88722

Analysis

max time kernel
210s
max time network
211s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
25/07/2025, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Social_Security_Statement_852541.exe
Size 34.0MB
Sample250725-pm3vpazzbz
SHA256 45021e94e37d2f969ea06ebbb899e79c5c3a75e4ecdc3d3a65a419d580e036cc
MD5 f2d387d21b7b57771a1115fb7277d198
SHA1 a578117356814f127a806dad2dae52f773307b2e
SHA512 460ae047db5fbe7db765a065cbdee0543fa6cd5b1f8f917f33a8105a70bf508a7b00e27899815d30895a63bdf3d95a4d1b717fb959a4fc11ffa99510f1191ab4
SSDEEP 786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcd:K/jkCgpPUK8PyL7M8aE1VWhroHFcd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat ai defense_evasion discovery execution persistence privilege_escalation rat

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

private.dynuddns.net:56001

Mutex

AsyncMutex_alosh

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1500-1153-0x0000000002590000-0x00000000025A6000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
1518	1500	PowerShell.exe
1519	1500	PowerShell.exe
1520	1500	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1500	PowerShell.exe
3172	PowerShell.exe

Modifies file permissions 1 TTPs 16 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3556	icacls.exe
4920	icacls.exe
5548	icacls.exe
2164	icacls.exe
6068	icacls.exe
2424	icacls.exe
2060	icacls.exe
3356	icacls.exe
1696	icacls.exe
1628	icacls.exe
940	icacls.exe
5512	icacls.exe
756	icacls.exe
5176	icacls.exe
8	icacls.exe
2620	icacls.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
568	session_win.exe

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
700	netsh.exe
2076	netsh.exe
780	netsh.exe
1692	netsh.exe
5264	netsh.exe
5972	netsh.exe
5988	netsh.exe
5836	netsh.exe
2260	netsh.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/1500-1150-0x0000000007620000-0x0000000007632000-memory.dmp	ConfuserEx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	PowerShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log	PowerShell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3989159129\2095616857.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4052159476\3598151710.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2879188468\1096143953.pri	netsh.exe
File created	C:\Windows\rescache\_merged\718100698\2059536100.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1388509667\1862181919.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2343073371\1743043770.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4062111013\1645887395.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3766950118\3234181149.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3559780703\2527627775.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2878548818\3208577207.pri	netsh.exe
File created	C:\Windows\rescache\_merged\566188972\958950874.pri	netsh.exe
File created	C:\Windows\rescache\_merged\98783150\2121392121.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1831202810\4009274638.pri	netsh.exe

Executes dropped EXE 24 IoCs

pid	Process
4476	windowslauncher.exe
2676	Remote AccessLauncher.exe
2752	Remote Access.exe
3028	SimpleService.exe
3620	SimpleService.exe
4756	SimpleService.exe
928	Remote Access Service.exe
5644	Remote Access.exe
3184	session_win.exe
5840	Remote Access Monitoring.exe
3192	session_win.exe
4872	Remote Access.exe
2348	session_win.exe
2012	elev_win.exe
3296	Remote Access Monitoring.exe
568	session_win.exe
660	session_win.exe
3264	elev_win.exe
1748	session_win.exe
4720	elev_win.exe
5296	session_win.exe
3584	elev_win.exe
3360	session_win.exe
5176	elev_win.exe

Loads dropped DLL 64 IoCs

pid	Process
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe
2092	Social_Security_Statement_852541.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Social_Security_Statement_852541.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Remote AccessLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Remote Access.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Remote Access.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Remote Access.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Remote Access.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Remote Access.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Remote Access Monitoring.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Social_Security_Statement_852541.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Remote AccessLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Remote Access.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Remote Access Monitoring.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Remote Access Monitoring.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Remote Access Monitoring.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1\a01460c8\@{Microsoft.Windows.StartMenuExperienceHost_10.0.22000.37_neutral_n = "Start"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870\a01460c8\@{Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy?ms-re = "Work or school account"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@wlansvc.dll,-36864 = "WLAN Service - WFD Application Services Platform Coordination Protocol (Uses UDP)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3\a01460c8\@{Microsoft.Windows.NarratorQuickStart_10.0.22000.1_neutral_neutral_8wek = "Narrator"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-60501 = "Cloud Identity"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68\a01460c8\@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resour = "Desktop App Web Viewer"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d75a031035819f\a01460c8\@{Microsoft.Windows.Apprep.ChxApp_1000.22000.1.0_neutral_neutral_cw5n1h2txye = "Windows Defender SmartScreen"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d75a03dcbf1be	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	PowerShell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\icsvc.dll,-700 = "Virtual Machine Monitoring"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-53500 = "Recommended Troubleshooting"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be\a01460c8\@{Microsoft.XboxGameCallableUI_1000.22000.1.0_neutral_neutral_cw5n1h2txyewy?ms-r = "Xbox Game UI"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39\a01460c8\@{MicrosoftWindows.Client.CBS_1000.22000.493.0_x64__cw5n1h2txyewy?ms-resource:// = "Windows Feature Experience Pack"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7d187d47a1c02\a01460c8\@{Microsoft.Windows.Search_1.16.0.22000_neutral_neutral_cw5n1h2txyewy?ms-resource:/ = "Windows Search"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6\a01460c8\@{Microsoft.Windows.CloudExperienceHost_10.0.22000.1_neutral_neutral_c = "Your account"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a	netsh.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3184	session_win.exe
3184	session_win.exe
3192	session_win.exe
3192	session_win.exe
2348	session_win.exe
2348	session_win.exe
3172	PowerShell.exe
3172	PowerShell.exe
3172	PowerShell.exe
1500	PowerShell.exe
1500	PowerShell.exe
1500	PowerShell.exe
1500	PowerShell.exe
660	session_win.exe
660	session_win.exe
1748	session_win.exe
1748	session_win.exe
5296	session_win.exe
5296	session_win.exe
3360	session_win.exe
3360	session_win.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	session_win.exe
Token: SeDebugPrivilege	3172	PowerShell.exe
Token: SeDebugPrivilege	1500	PowerShell.exe
Token: SeAssignPrimaryTokenPrivilege	5500	wmic.exe
Token: SeIncreaseQuotaPrivilege	5500	wmic.exe
Token: SeSecurityPrivilege	5500	wmic.exe
Token: SeTakeOwnershipPrivilege	5500	wmic.exe
Token: SeLoadDriverPrivilege	5500	wmic.exe
Token: SeBackupPrivilege	5500	wmic.exe
Token: SeRestorePrivilege	5500	wmic.exe
Token: SeShutdownPrivilege	5500	wmic.exe
Token: SeSystemEnvironmentPrivilege	5500	wmic.exe
Token: SeUndockPrivilege	5500	wmic.exe
Token: SeManageVolumePrivilege	5500	wmic.exe
Token: 31	5500	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	5500	wmic.exe
Token: SeIncreaseQuotaPrivilege	5500	wmic.exe
Token: SeSecurityPrivilege	5500	wmic.exe
Token: SeTakeOwnershipPrivilege	5500	wmic.exe
Token: SeLoadDriverPrivilege	5500	wmic.exe
Token: SeBackupPrivilege	5500	wmic.exe
Token: SeRestorePrivilege	5500	wmic.exe
Token: SeShutdownPrivilege	5500	wmic.exe
Token: SeSystemEnvironmentPrivilege	5500	wmic.exe
Token: SeUndockPrivilege	5500	wmic.exe
Token: SeManageVolumePrivilege	5500	wmic.exe
Token: 31	5500	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	1648	wmic.exe
Token: SeIncreaseQuotaPrivilege	1648	wmic.exe
Token: SeSecurityPrivilege	1648	wmic.exe
Token: SeTakeOwnershipPrivilege	1648	wmic.exe
Token: SeLoadDriverPrivilege	1648	wmic.exe
Token: SeBackupPrivilege	1648	wmic.exe
Token: SeRestorePrivilege	1648	wmic.exe
Token: SeShutdownPrivilege	1648	wmic.exe
Token: SeSystemEnvironmentPrivilege	1648	wmic.exe
Token: SeUndockPrivilege	1648	wmic.exe
Token: SeManageVolumePrivilege	1648	wmic.exe
Token: 31	1648	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	1648	wmic.exe
Token: SeIncreaseQuotaPrivilege	1648	wmic.exe
Token: SeSecurityPrivilege	1648	wmic.exe
Token: SeTakeOwnershipPrivilege	1648	wmic.exe
Token: SeLoadDriverPrivilege	1648	wmic.exe
Token: SeBackupPrivilege	1648	wmic.exe
Token: SeRestorePrivilege	1648	wmic.exe
Token: SeShutdownPrivilege	1648	wmic.exe
Token: SeSystemEnvironmentPrivilege	1648	wmic.exe
Token: SeUndockPrivilege	1648	wmic.exe
Token: SeManageVolumePrivilege	1648	wmic.exe
Token: 31	1648	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	3704	wmic.exe
Token: SeIncreaseQuotaPrivilege	3704	wmic.exe
Token: SeSecurityPrivilege	3704	wmic.exe
Token: SeTakeOwnershipPrivilege	3704	wmic.exe
Token: SeLoadDriverPrivilege	3704	wmic.exe
Token: SeBackupPrivilege	3704	wmic.exe
Token: SeRestorePrivilege	3704	wmic.exe
Token: SeShutdownPrivilege	3704	wmic.exe
Token: SeSystemEnvironmentPrivilege	3704	wmic.exe
Token: SeUndockPrivilege	3704	wmic.exe
Token: SeManageVolumePrivilege	3704	wmic.exe
Token: 31	3704	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	3704	wmic.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5644	Remote Access.exe
4872	Remote Access.exe
3296	Remote Access Monitoring.exe
1500	PowerShell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4476	2092	Social_Security_Statement_852541.exe	78
PID 2092 wrote to memory of 4476	2092	Social_Security_Statement_852541.exe	78
PID 2092 wrote to memory of 6068	2092	Social_Security_Statement_852541.exe	79
PID 2092 wrote to memory of 6068	2092	Social_Security_Statement_852541.exe	79
PID 2092 wrote to memory of 1628	2092	Social_Security_Statement_852541.exe	81
PID 2092 wrote to memory of 1628	2092	Social_Security_Statement_852541.exe	81
PID 2092 wrote to memory of 2676	2092	Social_Security_Statement_852541.exe	83
PID 2092 wrote to memory of 2676	2092	Social_Security_Statement_852541.exe	83
PID 2092 wrote to memory of 2752	2092	Social_Security_Statement_852541.exe	84
PID 2092 wrote to memory of 2752	2092	Social_Security_Statement_852541.exe	84
PID 2752 wrote to memory of 5176	2752	Remote Access.exe	85
PID 2752 wrote to memory of 5176	2752	Remote Access.exe	85
PID 2752 wrote to memory of 3556	2752	Remote Access.exe	87
PID 2752 wrote to memory of 3556	2752	Remote Access.exe	87
PID 2752 wrote to memory of 4920	2752	Remote Access.exe	89
PID 2752 wrote to memory of 4920	2752	Remote Access.exe	89
PID 2752 wrote to memory of 2424	2752	Remote Access.exe	91
PID 2752 wrote to memory of 2424	2752	Remote Access.exe	91
PID 2752 wrote to memory of 5548	2752	Remote Access.exe	93
PID 2752 wrote to memory of 5548	2752	Remote Access.exe	93
PID 2752 wrote to memory of 8	2752	Remote Access.exe	95
PID 2752 wrote to memory of 8	2752	Remote Access.exe	95
PID 2752 wrote to memory of 3028	2752	Remote Access.exe	97
PID 2752 wrote to memory of 3028	2752	Remote Access.exe	97
PID 2752 wrote to memory of 3028	2752	Remote Access.exe	97
PID 2752 wrote to memory of 3620	2752	Remote Access.exe	98
PID 2752 wrote to memory of 3620	2752	Remote Access.exe	98
PID 2752 wrote to memory of 3620	2752	Remote Access.exe	98
PID 4756 wrote to memory of 928	4756	SimpleService.exe	100
PID 4756 wrote to memory of 928	4756	SimpleService.exe	100
PID 2752 wrote to memory of 2060	2752	Remote Access.exe	101
PID 2752 wrote to memory of 2060	2752	Remote Access.exe	101
PID 928 wrote to memory of 5644	928	Remote Access Service.exe	103
PID 928 wrote to memory of 5644	928	Remote Access Service.exe	103
PID 2752 wrote to memory of 3356	2752	Remote Access.exe	104
PID 2752 wrote to memory of 3356	2752	Remote Access.exe	104
PID 5644 wrote to memory of 1696	5644	Remote Access.exe	106
PID 5644 wrote to memory of 1696	5644	Remote Access.exe	106
PID 5644 wrote to memory of 2620	5644	Remote Access.exe	109
PID 5644 wrote to memory of 2620	5644	Remote Access.exe	109
PID 5644 wrote to memory of 2260	5644	Remote Access.exe	111
PID 5644 wrote to memory of 2260	5644	Remote Access.exe	111
PID 5644 wrote to memory of 5264	5644	Remote Access.exe	113
PID 5644 wrote to memory of 5264	5644	Remote Access.exe	113
PID 5644 wrote to memory of 5972	5644	Remote Access.exe	115
PID 5644 wrote to memory of 5972	5644	Remote Access.exe	115
PID 5644 wrote to memory of 700	5644	Remote Access.exe	117
PID 5644 wrote to memory of 700	5644	Remote Access.exe	117
PID 5644 wrote to memory of 2076	5644	Remote Access.exe	119
PID 5644 wrote to memory of 2076	5644	Remote Access.exe	119
PID 5644 wrote to memory of 5512	5644	Remote Access.exe	121
PID 5644 wrote to memory of 5512	5644	Remote Access.exe	121
PID 5644 wrote to memory of 756	5644	Remote Access.exe	123
PID 5644 wrote to memory of 756	5644	Remote Access.exe	123
PID 5644 wrote to memory of 3184	5644	Remote Access.exe	125
PID 5644 wrote to memory of 3184	5644	Remote Access.exe	125
PID 5644 wrote to memory of 3184	5644	Remote Access.exe	125
PID 3184 wrote to memory of 5840	3184	session_win.exe	126
PID 3184 wrote to memory of 5840	3184	session_win.exe	126
PID 5840 wrote to memory of 3192	5840	Remote Access Monitoring.exe	127
PID 5840 wrote to memory of 3192	5840	Remote Access Monitoring.exe	127
PID 5840 wrote to memory of 3192	5840	Remote Access Monitoring.exe	127
PID 3192 wrote to memory of 4872	3192	session_win.exe	128
PID 3192 wrote to memory of 4872	3192	session_win.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Social_Security_Statement_852541.exe
"C:\Users\Admin\AppData\Local\Temp\Social_Security_Statement_852541.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2092
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapperTemp-1753446576-3-app\bin\windowslauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapperTemp-1753446576-3-app\bin\windowslauncher.exe" "-Xshare:dump"
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /c /grant *S-1-5-32-545:RX
  2⤵
  - Modifies file permissions
  PID:6068
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /c /grant *S-1-5-32-545:RX
  2⤵
  - Modifies file permissions
  PID:1628
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote AccessLauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\remoteaccess-jar-with-dependencies.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\jwrapper_utils.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dsun.java2d.dpiaware=true -Dsun.java2d.uiScale.enabled=false -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 -Djdk.attach.allowAttachSelf=true -Dapple.awt.UIElement=true -Xrs jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\unrestricted\JWLaunchProperties-1753446580106-1"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:2676
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\remoteaccess-jar-with-dependencies.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\jwrapper_utils.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dsun.java2d.dpiaware=true -Dsun.java2d.uiScale.enabled=false -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 -Djdk.attach.allowAttachSelf=true -Dapple.awt.UIElement=true -Xrs jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\unrestricted\JWLaunchProperties-1753446580940-2"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:5176
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:3556
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:4920
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:2424
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:5548
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted" /t /c /grant *S-1-5-32-545:(OI)(CI)RX
    3⤵
    - Modifies file permissions
    PID:8
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3028
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    PID:3620
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:2060
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:3356

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access.exe" "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dsun.java2d.dpiaware=true" "-Dsun.java2d.uiScale.enabled=false" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3" "-Djdk.attach.allowAttachSelf=true" "-Dapple.awt.UIElement=true" "-Xrs" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\jwrapperlib\jwstandalonelaunch.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\jwagent.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\unrestricted\JWLaunchProperties-1099926050-24"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\ProgramData\JWrapper-Remote Access" /t /remove *S-1-1-0
      4⤵
      Modifies file permissions
      PID:1696
  - - C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /t /c /grant *S-1-5-32-545:(OI)(CI)RX
      4⤵
      Modifies file permissions
      PID:2620
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Drops file in Windows directory
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:2260
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service" "description=Inbound rule for the Remote Access Service to facilitate access sessions" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5264
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Updater" "description=Inbound rule for the Remote Access Service updater" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote AccessECompatibility.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5972
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Launcher" "description=Inbound rule for the launcher that can spawn the Remote Access Service" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote AccessLauncher.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:700
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:2076
  - - C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\ProgramData\SimpleHelp" /t /c /grant *S-1-1-0:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5512
  - - C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\ProgramData\SimpleHelp\ElevateSH" /t /c /grant *S-1-5-32-545:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:756
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access Monitoring.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\jwrapperlib/jwstandalonelaunch.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\jwagent.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dsun.java2d.dpiaware=true -Dsun.java2d.uiScale.enabled=false -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 -Djdk.attach.allowAttachSelf=true -Dapple.awt.UIElement=true -Xrs jwrapper.updater.GenericUpdaterLaunch "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\unrestricted\JWLaunchProperties-1753446592364-1"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access Monitoring.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access Monitoring.exe" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\jwrapperlib/jwstandalonelaunch.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\jwagent.jar" "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dsun.java2d.dpiaware=true" "-Dsun.java2d.uiScale.enabled=false" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3" "-Djdk.attach.allowAttachSelf=true" "-Dapple.awt.UIElement=true" "-Xrs" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\unrestricted\JWLaunchProperties-1753446592364-1"
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:5840
      - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\remoteaccess-jar-with-dependencies.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\jwrapper_utils.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dsun.java2d.dpiaware=true -Dsun.java2d.uiScale.enabled=false -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 -Djdk.attach.allowAttachSelf=true -Dapple.awt.UIElement=true -Xrs jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\unrestricted\JWLaunchProperties-1753446593616-2"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access.exe" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\remoteaccess-jar-with-dependencies.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\jwrapper_utils.jar" "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dsun.java2d.dpiaware=true" "-Dsun.java2d.uiScale.enabled=false" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3" "-Djdk.attach.allowAttachSelf=true" "-Dapple.awt.UIElement=true" "-Xrs" "jwrapper.JWrapper" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\unrestricted\JWLaunchProperties-1753446593616-2"
        7⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:4872
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3640
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3864
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:432
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:6072
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5756
        
        C:\Windows\SYSTEM32\icacls.exe
        
        icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\working\toolbox-17180772615269617520" /t /c /grant *S-1-5-32-545:(OI)(CI)F
        8⤵
        Modifies file permissions
        
        PID:2164
        
        C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe" --slSilent --slRunAsUser --slWaitForCompletion PowerShell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -WindowStyle Hidden -file RAT1-1-1753446653391-2b0fyzc7.ps1
        8⤵
        Hide Artifacts: Hidden Window
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" "-ExecutionPolicy" "Bypass" "-NoLogo" "-NonInteractive" "-WindowStyle" "Hidden" "-file" "RAT1-1-1753446653391-2b0fyzc7.ps1"
        9⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1500
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1956
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3288
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4148
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct get
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5500
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiSpywareProduct get
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH FirewallProduct get
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c netsh advfirewall show all State
        8⤵
        
        PID:1532
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall show all State
        9⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:780
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2044
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3328
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1356
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2496
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        
        PID:4708
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2264
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4144
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2556
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct get
        8⤵
        
        PID:1344
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiSpywareProduct get
        8⤵
        
        PID:5048
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH FirewallProduct get
        8⤵
        
        PID:1600
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c netsh advfirewall show all State
        8⤵
        
        PID:4716
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall show all State
        9⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5836
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5700
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2372
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3032
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5100
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2348
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2012
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access Monitoring.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\Remote Access Monitoring.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\jwrapperlib/jwstandalonelaunch.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\jwagent.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dsun.java2d.dpiaware=true -Dsun.java2d.uiScale.enabled=false -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 -Djdk.attach.allowAttachSelf=true -Dapple.awt.UIElement=true -Xrs jwrapper.updater.GenericUpdaterLaunch "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\unrestricted\JWLaunchProperties-1753446651551-1"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious use of SetWindowsHookEx
      PID:3296
    - - C:\Windows\SYSTEM32\icacls.exe
        
        icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\working" /c /grant *S-1-5-32-545:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        
        PowerShell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -WindowStyle Hidden -file HIDE-3-1753446653387-2v7q54ev.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1556
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5008
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3032
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct get
        5⤵
        
        PID:1552
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiSpywareProduct get
        5⤵
        
        PID:3628
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH FirewallProduct get
        5⤵
        
        PID:4672
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c netsh advfirewall show all State
        5⤵
        
        PID:1564
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall show all State
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5988
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4404
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2220
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct get
        5⤵
        
        PID:248
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiSpywareProduct get
        5⤵
        
        PID:4108
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH FirewallProduct get
        5⤵
        
        PID:3180
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c netsh advfirewall show all State
        5⤵
        
        PID:780
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall show all State
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1692
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:660
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:3264
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1748
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:4720
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5296
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:3584
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3360
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:5176

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2296

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1152

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Window

T1564.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DetectedProxies

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

alertsdb.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\alerts\httpGVVportalUelray2UcomG443\alertsdb.afos_complete
Size 16KB
SHA256 bf247dd56957e2c7865603c7dfc76da5618b0e8928a336cf55cffae84312d919
MD5 b85bfa36c6206c452f43f953ad7752ff
SHA1 4269764c73d7da63e8dc5decb6206cea83f846fc
SHA512 472bb808fbcc144273cf56e919e7095c7aa9638c5cd97bc2b721655489db3b460fbf2e94bfda09f376f75ec45aa5e3b7816283ec8fa95348a67d49516272bbae
SSDEEP 12:z653mEMG4B/fYzzmK5y5PEdp9nv/65LH7CvUFLy:m5WERMHQsEpZv/65L3W
MD5 SHA1 SHA512 SSDEEP

Submit Download

secmsg-httpGVVportalUelray2UcomG443.secmsg.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\secmsg\secmsg-httpGVVportalUelray2UcomG443.secmsg.afos_complete
Size 150B
SHA256 006c3b482ab734346ee6382afa59cc96ae2ba7d3d26370a97063fb7a9636b534
MD5 37c7f3863785410d6175c4695bf1ae6f
SHA1 3ab1548aa8f604cc5c48125f5cbb747e5f6d0135
SHA512 90580af071e72f156fda109d1191dc3a4c947fcb79e4cf91720d3390c3a53ec3c7c9e69cf4b070213ca3f127ded6c4e955e09a050f6106b8245d53cd26d226a7
MD5 SHA1 SHA512

Submit Download

serviceconfig.xml.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml.afos_complete
Size 337B
SHA256 53324c44e3043d0eefd571dd5fc54e30bcab031e7828851d3f3ca3332d351d5b
MD5 8a3464079a2b66f4fcdd43cb40f2690c
SHA1 ade8910f9588c4c739f63f280c83e3f9db604e96
SHA512 dfc9901f77914aa41bc83bd317bb1c7c997e97931cffe0e3fb5c80fa2bc8fcaff9cb809608954ad9d02403d84056c1d24efa36061f9f34ac37693c778a879b72
MD5 SHA1 SHA512

Submit Download

serviceid.dat.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.dat.afos_complete
Size 16KB
SHA256 163031970e412785ae21574007ca92adb571c02073ab3588f44a0f44283cb313
MD5 900565941f83ebd92744f398ba025da0
SHA1 0ab370dbc413ce674e63a60de290fe029ee6272b
SHA512 c783434fb17cf57eb8010518ffad439775f22f5b333eca792091de4800f378a27dfc78de8268115228b46468d8aa4110f229384b29d68fadd2ee0a4d7c6958f8
SSDEEP 3:h5V3r5XqjzxYs8yoqQhRIqRRdKrl:pEvVQhRIGRd
MD5 SHA1 SHA512 SSDEEP

Submit Download

JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00115399100-complete

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00115399100-complete
Size 318B
SHA256 6157805d313b19eb19fc5ef91c723f56e204c3424ad9cfc4f0d8c7aafb06dbae
MD5 70d55f4b996f1a3c9d8314dbab96f8df
SHA1 0927f8fd4bebe54689f5fb8866b10e98d4021af0
SHA512 5445b1a640563b16d1bc156da4e047030851c42599161109c8fd25a3c5b271da587c7f9aa4e156a3676cd469605d2debb7ad98d5b240450c810d8af1036a5508
MD5 SHA1 SHA512

Submit Download

JreNameOverride.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JreNameOverride.afos_complete
Size 13B
SHA256 e4c596fe101978f244b8f74be616d62bbaae083f881928da51255b0dba50d440
MD5 8199887131477d02232d372bc808cfd5
SHA1 c172ffd15c0fb02432429632272a066b8516e077
SHA512 8623a7e6bb4673572c47035280cecbf09d02a71de54f86a2a3376de080df33af8dbe0d2e5c460779a899ca3d51e5b4c7b1a264ed4089af40b05c187524606026
MD5 SHA1 SHA512

Submit Download

nativesplash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-JWrapper-00115411574-complete\nativesplash.png
Size 9KB
SHA256 ddaa92ae2173077ac62bca8f4429b5990febfd9480dce5c88fcf243212b2557c
MD5 ccca3d4f98439b4f2059a91f93572cac
SHA1 e8dbf2129fec0266da49e1fa1a22700022bc1c14
SHA512 d44ccd1a4baa8c0b86ce2e81b5e500312db24a6cc3d75b5a097d9b3b52bfa9d32c46d07bde2bcc6396b7ee11a4dfcd1507efe51feedba998ac74e7e6caf130a9
SSDEEP 192:UwsSrr1vMyT3kWUaMSrY6yAG2IaDu07pz1LYmFxuA0HBNICe:UwsmJAPIyAGbaDuKJBYmiHZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

JWrapperUseJRE

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\JWrapperUseJRE
Size 12B
SHA256 300a414eb2e3bb5b34d3fbb4db02b0c2244499464e6d71de33df0a2f79795e9c
MD5 31448f811ade52a24c3fddb80734b7d7
SHA1 88268af3192229f227fc472bc66588f94d5a078f
SHA512 5140f4e9b81cab425cd48309b007b7c1be2c4aedbf69ce4d30a9a9be0c0ab1df15c38239c3b73f64931e703a4211d9b8cb9b2776c06fbe80e7ad05739e3fb1ab
MD5 SHA1 SHA512

Submit Download

JWLaunchProperties-1753446652880-2

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\unrestricted\JWLaunchProperties-1753446652880-2
Size 16KB
SHA256 b322145fc97ff5b21acb549922f5f5e1f01de1b9c41b622f54c9eed8b4282a1c
MD5 a16cc894e2fc32aeafe91ad7dff6ee7a
SHA1 e39037aa39d3c19a4daa69b0e6275bb435a02ea5
SHA512 1b323af5adf37a3ae61f80cd6f6ce1cbe84c4521d52877bc93bb9b577b1709ae61758e427a52d9f344150aebaa056718ef4f83fe43bbba2dd98f5047692a4916
SSDEEP 384:JBCbyc8MkpXuKlkzXEpdHQTONuCPIq3jYT767PmVdf1YK3:JOyWEuKlkz0kTO4CJ30T767OVdf1p
MD5 SHA1 SHA512 SSDEEP

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\unrestricted\jwLastRun
Size 13B
SHA256 e5beff1434b5db3e7bb4cdccf8c54203535da3eee0d429f671ad912102e446fa
MD5 a50b6836302e71ab9d418d91d9756c7c
SHA1 d39df9ac5878770a942c65f8b980e192a0a12557
SHA512 74111e1c6102a241d82e27bf3f867cf9a353af23142def7552a5058084e7e4e376139df057990e9d765537cedafaeaa35e4beaa2d14556af5ca5f3ba7b0fa1f6
MD5 SHA1 SHA512

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Remote Access-00115411648-complete\unrestricted\jwLastRun
Size 13B
SHA256 6f8ba9ed0992bf2ad05d88565018c6d3e7d60ce45aa560c33b174fc913300669
MD5 df4fb5c88e043dd605869425569e2ec4
SHA1 e0cbc0c2d621f4e9aaa50afbe2f578332a5f0dba
SHA512 7ae1cc9cc8cbb0b22b9bc5dc60dd243c27c026b6d6f1dc9ce57bf18f43c71c6fbe5a6571ae80a3c61e6035212561243ebd4bff78e1fd38b9b29352cf19ac4dd8
MD5 SHA1 SHA512

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-console-l1-1-0.dll
Size 20KB
SHA256 191e08dea0ad5ac02e7e84669d9fffa5aa67dc696e36077c5fa20d81c80b6a56
MD5 39852d24acf76cf0b3a427f46663efdf
SHA1 92b9730c276c6f2a46e583fc815374c823e6098b
SHA512 e6f0898871b769244818d93117fe3cb82cc8f12bb24d6b3406ffcaa2a26f0b5754246b5c739e9cbcf07cb94aabba2fd934e7054607b4086b2f4c5592607e8385
SSDEEP 192:POiWBhWnWYnO/VWQ4SWSUPKUH0jpC52qnajc5x8D:P5WBhWXU8H0Nlg5uD
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-console-l1-2-0.dll
Size 20KB
SHA256 9e04918d9e751dbc56d0251d3ada573381b469a012599554d72aa4affda9658a
MD5 f33ec623aa4a2bd4c004d3befe0bdd08
SHA1 79a3c89d842d502f989fb5a3eaeabccb0abae8d2
SHA512 be24a3cb876d617f8054fd49dd815d89473b053bab175373169a1cb0f016ccd05a718da9a8c29de66690f02bdd60782222928ecd2e24aa5128573e67356e5af2
SSDEEP 192:Q6WBhWvWYnO/VWQ4uWp0QLCamylqnajP3Tx7:DWBhWfUJQ3Jllz3V7
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-datetime-l1-1-0.dll
Size 20KB
SHA256 a94b80a5111aabefb1309609abdd300bb626d861cd8e0938b9735ab711a43c22
MD5 b71c18f8966cead654800ff402c6520f
SHA1 a6f658ea85ad754cf571f7b67f3360d5417f94bd
SHA512 17867aaa57542c1cd989ca3000f3d93bbb959eb5a69100c70c694bde10db8f8422d3e86e1a5fc0848677e4343c424013cdf496b8bb685f8875c3330271242369
SSDEEP 192:CWBhWg8WYnO/VWQ4eWQLoQLCamylqnajP3Txv4:CWBhWgqU7oQ3Jllz3Vv4
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-debug-l1-1-0.dll
Size 20KB
SHA256 263e038363527b7bed05110f37f7e5b95f82aab9c0280c9c522cf7bfce10fd7d
MD5 a998282826d6091984d7d5f0bf476a31
SHA1 b958281ad7b861e0adcbeb0033932057082ae4fc
SHA512 ba46b6e7649cded62e9c097c29d42a8ea3da52109d285b8ed7aaea9a93c203efcfd856d25cee9bd825c0835b37a1d7a37a8ae55e0e10dc237f0da7013056cf5d
SSDEEP 192:6oWBhW6WYnO/VWQ4eW4IUTyvQLCamylqnajP3TxfMuS:6oWBhWQUVGvQ3Jllz3V/
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-errorhandling-l1-1-0.dll
Size 20KB
SHA256 085968d938ea924827c4740697713674850218a8fe91dd9982e93b0effacc820
MD5 c148a26d3d9d39777dabe28dc08cee60
SHA1 4f7537ba8cee5ff774f8d7c3fe4174fc512b70d4
SHA512 6689dfb19898f420632295fb9982668919011784278dc6840716c91ca8dcb434057096640a15fab7a93edf722530451da274d02bb344cd429388412ad11a79e0
SSDEEP 192:IcmxD3mTWBhWnWYnO/VWQ4eWFsz2cA5E8qnajTwgYWmlgF:BVTWBhWXUT2x5E8lvwzWC
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-fibers-l1-1-0.dll
Size 20KB
SHA256 c86ebc9f48e2db659e80d9c7ad5f29e6b6c850eea58813c041baeff496ae4f18
MD5 ee3f0d24e7e32e661ac407c60b84b7db
SHA1 09107fb9ace59a1ac3a8b8dbb4ff00b91182929b
SHA512 c3fbba7fad4fe03a3a763ad86681655f1bb04d6dd9f64c0083aaa0262ce18f82970365532337825d44ec92b3d79b3212817b25f188537a3771807ad17e7f8d05
SSDEEP 192:bsWBhWxWYnO/VWQ4SWGvYa/uuOiqnajBhda:IWBhWxU6Tillhda
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-file-l1-1-0.dll
Size 24KB
SHA256 120c3afed9ce2a981c61208757fca0665f43926751ec8d0d13e10ef1096a0d48
MD5 e933cdd91fd5725873f57532f262f815
SHA1 e48f6f301a03beb5e57a0727a09e7c28a68e19f3
SHA512 d1c598f964a98a30c6a4926f6b19f8213884224861c36aba839f5a91acefaa8c0e8b3d7cd555103885520432a343b489044e4ad3a1c33d77cf3fda4493eb48fb
SSDEEP 192:7ESaNYPvVX8rFTs4WBhWPWYnO/VWQ4SW3WWd/uuOiqnajBhu:fPvVXqWBhW/UxWKillhu
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-file-l1-2-0.dll
Size 20KB
SHA256 0dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0
MD5 b59d773b0848785a76baba82d3f775fa
SHA1 1b8dcd7f0e2ab0ba9ba302aa4e9c4bfa8da74a82
SHA512 cbd52ed8a7471187d74367aa03bf097d9eac3e0d6dc64baf835744a09da0b050537ea6092dcb8b1e0365427e7f27315be2145c6f853ef936755ad07ef17d4a26
SSDEEP 192:NKtnWBhWzWYnO/VWQ4eWrb/QLCamylqnajP3Tx:N6nWBhWzUOQ3Jllz3V
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 18655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4
MD5 4c9bf992ae40c7460a029b1046a7fb5e
SHA1 79e13947af1d603c964cce3b225306cadff4058b
SHA512 c36d455ac79a73758f6090977c204764a88e929e8eaa7ce27a9c9920451c014e84ae98beb447e8345a8fa186b8c668b076c0ed27047a0e23ad2eeaf2cbc3a8d8
SSDEEP 192:341WBhWmWYnO/VWQ4SWkHK/uuOiqnajBp:o1WBhWMUzillp
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-handle-l1-1-0.dll
Size 20KB
SHA256 7e45a1b997331f4d038f847f205904d6ec703df7a8c5c660435697e318ced8fc
MD5 f90e3b45c7942e3e30ecf1505253b289
SHA1 83beec2358de70268bc2e26ed0a1290aaef93f94
SHA512 676450eb70a5ceae1820a978412ef3df746f14790322122b2de3e18ef013802c27867ad315950fc9b711e66f36628b062e57a7ec44d1ddc06f443655383cdc14
SSDEEP 192:T9vBWBhWKWYnO/VWQ4SW9L91fzcA5E8qnajTwggW:TDWBhWgUE99x5E8lvwbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-heap-l1-1-0.dll
Size 20KB
SHA256 dd1e8c77002685629c5cd569ee17f9aa2bcb2e59d41b76ae5bc751cae26d75bf
MD5 f2c267153db0182cca23038fc1cbf16a
SHA1 10d701ab952cacbf802615b0b458bc4d1a629042
SHA512 84f3c587be5a91752eeffd4f8e5ded74877930515fd9f4d48021b0f22a32feb3a4ddb9a0f14748e817f8c648bd307942ec026fc67eea922247499b5f412b4914
SSDEEP 192:8xl1WBhWxWYnO/VWQ4eWmxXocTvcpQLCamylqnajP3TxKp:8xl1WBhWxUrXmQ3Jllz3VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-interlocked-l1-1-0.dll
Size 20KB
SHA256 ea60d03a35ef2c50306dbbd1ad408c714b1548035c615359af5a7ce8c0bd14a8
MD5 5f2e21c4f0be6a9e15c8ddc2ecdd7089
SHA1 1282b65a9b7276679366fe88c55fab442c0cc3a1
SHA512 a32c5ed72d4bfda60b2259e5982e42a79040225a4877246f3a645e05bfb8be395555fa22b2f0ed884f5fd82a8021bba85637727544c9adbb3a8c97b80e7a30f2
SSDEEP 192:lBwGRWBhWVWYnO/VWQ4eWcfWPfQLCamylqnajP3TxLyH:TwGRWBhWFUfmQ3Jllz3VL
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-libraryloader-l1-1-0.dll
Size 20KB
SHA256 929298566ba01d1c3e64356a1f8370c1e97f0599f56f823c508cde9ae17f130b
MD5 7b828554daa24f54275b81dfa54e0c62
SHA1 03fa109c21c0dc2e847117de133a68c6cd891555
SHA512 1f4f030d4a1cd3f98ba628dee873978b3797a4a7db66615fc484270a2b3fa68f231d9d12142840cfb52d7592c1ae7af6e35ae7a410878774a9fb199d7a647985
SSDEEP 192:6pTvuBL3BBLUsWBhW5WYnO/VWQ4eWiOGCJky1qnajgaGX:CTvuBL3BCsWBhW5UMvR1lsJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6
MD5 9d8e7a90dd0d54b7ccde435b977ee46d
SHA1 15cd12089c63f4147648856b16193cf014e6764f
SHA512 339fe195602355bce26a2526613a212271e7f8c7518d591b9e3c795c154d93b29b8c524b2c3678c799d0ea0101eabea918564e49def0b915af0619e975f1c34b
SSDEEP 384:snaOMw3zdp3bwjGzue9/0jCRrndbrWBhWZUnR1lsZ:dOMwBprwjGzue9/0jCRrndbi6y6
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-memory-l1-1-0.dll
Size 20KB
SHA256 8a4b66cea7b474506fbdbe4c45e78923645f5f0a13f7f4e43449649f50ea38b8
MD5 e56f2d05d147add31d6f89bcd1f008ca
SHA1 dde258c7b42b17363bca53b5554a5e13ea056f80
SHA512 9fd1afd32fda24a92af4bb24661f7cf791cc6686b65f13dae97c56a1e83b25f0f2710c77167e6a9a491001877a0712c9a011833bb6026e08ae536744f0b40905
SSDEEP 192:AcWBhWfWYnO/VWQ4SW35VXC/uuOiqnajBirNin:AcWBhWPUmilliYn
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-namedpipe-l1-1-0.dll
Size 20KB
SHA256 e8382a73730c2f7f873b40e2fcc5e1cd4847e7cb42fef3c76bea183af5891d65
MD5 f08cd348ac935ac60436ac4cb1836203
SHA1 fd0608e704677fd4733296c2577647057541f392
SHA512 595e08301a0cbfd4f943ea3555dbce27d37b16c340b6972b054097b889285bbf942cc0314797a714a2e393956075c5dd95a5d2c2d4bde143b5f5387793e7a8de
SSDEEP 192:swWBhWiWYnO/VWQ4eWjSlCJky1qnajgajMK2m:3WBhWYUwR1lscM5m
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-processenvironment-l1-1-0.dll
Size 20KB
SHA256 9c1afc7cd0b0e0d136d09b65dd082ace136fc306f8f116f3d13956211ec146c8
MD5 88916eed5164cb8884ebba842cd540cc
SHA1 f15674fbfef5b09cc02c924336554c17b715db00
SHA512 2929c3ab67b364a7caf6c8fe1a42309917a0620f36c5d7194ca8a41ab7703a564ded32a4f9291a4f8fdd7d3a35383715fd8bef10ff603554b95519d109469617
SSDEEP 192:8FpWBhWCQWYnO/VWQ4SW5u6f/uuOiqnajByW:8FpWBhWZUVxillyW
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 6e5bd110a2f4dc345b68e9a8fb081783586c8c25f46027c58443ade2d3e1bf01
MD5 42e99c89e241f21bf2fb20f3ff477eba
SHA1 e3b0012cd6d74f0ac2bf0c34997a87333c895834
SHA512 8eed3b21695cccae0dbf2db844efa11ad4957cd7bcd6c8ab7cfd4f0653bbacfd6bedd82ac27c3995f6418ae38ed0b8d46afa0bdfc627c16619aab775c5f8da16
SSDEEP 192:YMck1JzX9cKSIUWBhWHWYnO/VWQ4SWzgG/uuOiqnajBLP:dck1JzNcKSIUWBhW3Upillb
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-processthreads-l1-1-1.dll
Size 20KB
SHA256 19b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1
MD5 d399c926466f044f183faa723ba59120
SHA1 a9534b4910888d70eefba6fcc3376f2549cb4a05
SHA512 fc55f4cfe7c6c63e0720971d920c5c6ead4db74a671f7bb8dc830aa87cb54459a62e974456875bdfda449d82a0acb368e3b6c2cc20c32b1b407e8de7cc532057
SSDEEP 192:BG+DfIe2WBhWWWYnO/VWQ4eWJAkWQLCamylqnajP3TxWXFh:BLDfIe2WBhW8UuWQ3Jllz3VSz
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-profile-l1-1-0.dll
Size 20KB
SHA256 cc3c609193f2e99f80a6a21064d10c5c591101e386338879326775ccdd77dcb6
MD5 7b746cda44a5773455c455690ba26a4f
SHA1 d6ff8a5ac6c71e0b037236fad32f9bbecfc68aec
SHA512 25fd04facb3ddabbcb0265cd7a306d6c159ac6419a3e2ff4de7bb9fe41eb9a1e3afecea6558771b9e4b3f912227dda65021822fbe1ab52d7dcf6cd115bea84f3
SSDEEP 192:vXRWBhWfWYnO/VWQ4SW9FSuUgxfzfqnaj/fc8j:/RWBhWPUZIrlzcK
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 20KB
SHA256 bcb9a6dd2cc0caaa700d95fa3af5163a8246388c2efefbbc4cf6e1fe2687c72e
MD5 d6fc6c9da69334221c5438f5c7444336
SHA1 ac385fee49c6a4f7ff918fa93ef3324e71943505
SHA512 646d23590974acf8ea523018b97d994df4d760500c5bbddc9d6bcbb5c0fc5665b82b40b49b7636050b83269aea4fa802b3be016a02403fe189cbe72fc1de0ed5
SSDEEP 192:/GeVGWBhW0WYnO/VWQ4eWYAz2cA5E8qnajTwdo/:/GeVGWBhWiUTx5E8lvw+
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-string-l1-1-0.dll
Size 20KB
SHA256 9b071b842445a5dd90148445af148d024674085927d079864f7893807fd1b305
MD5 82fa7c54d034123805b57c96a5bced7f
SHA1 bbc6ebffbf21996f187345b7e28b9dfeca31829e
SHA512 715b2e794b2c2af5cdec22653d569ed33cf91bc092fae49449111cf7450385d1e5a1c713feac231bcedfa12fab7af57005c53f7721330400aef7c17dabddafff
SSDEEP 192:X0+yMvfWBhWiWYnO/VWQ4eWQIvQLCamylqnajP3Txv:3yMvfWBhWYUIvQ3Jllz3V
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 a981a24c9231e0230031bb1cba8f2509565ece1f53ebdb4d0a50efd722ab4330
MD5 6dbc816b9aef0f91b57bfc9a3ab18972
SHA1 e88cb7a5955630d29d24d2f05f540403ed9498e3
SHA512 bfb4cfc89eb8b1409a826e59699f2c3f4af765f114281bb30026dad02d2353ca95ec3b544f522833e657be4cf69b1070dc9bd3767b7a6014c2cbacba38c023e3
SSDEEP 384:1Xwidv3V0dfpkXc0vVatYWBhWMUdRillKI:dHdv3VqpkXc0vVaN7YVI
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-synch-l1-2-0.dll
Size 20KB
SHA256 69dd52caffe1ea6e0900fb9604a57a87618f8468dc68cbb2a9bcefd1265f3f49
MD5 da5d400ade0d2288b17dcc11ed339e25
SHA1 f4a340079477a2c91e091968fe2d252cb01eeae2
SHA512 3bfa3b4f93a0a68e1c0ac17c74c91c0a01b779961af4811756223fd1f47a86ce1f3ebd7ee4190a2edb84a50b1b444318965cad3a74d1ed4acfa014d0f5bbe34a
SSDEEP 192:ttZ37WBhWlcWYnO/VWQ4eWYRt3VjpC52qnajc5xI6:ttZ37WBhWlKUNNlg5
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-sysinfo-l1-1-0.dll
Size 20KB
SHA256 3513cffa44c88ec13d6a8c9b63e5d505a131b46746d13ee654144f08a96f20c3
MD5 6971c41c21eb35668520f0bb949b3742
SHA1 5de3a45c15afb7c2038dc7fc0d29275b7fb90a36
SHA512 dd9914f547d5c34efd0f2879ebffd2d3ec9daf7465dffb7644ae0f4bc05f9f75df8b49ca8d692a8de7a92854a1b44c81e6f1b15ee691bf1995a1da76d3c3b82a
SSDEEP 192:7+gdKIMFsmSTWBhW7WYnO/VWQ4uWrJCJky1qnajgaY+:/5NTWBhWbUlR1lsX+
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-timezone-l1-1-0.dll
Size 20KB
SHA256 24f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d
MD5 ea5f768b9a1664884ae4ae62cec90678
SHA1 ae08e80431da7f4e8f1e5457c255cc360ef1cac0
SHA512 411db31e994ebbc69971972e45d6e51186d8f8790e8c67660b6a846e48a5a5c53a113916a5a15d14c33d8c88037d7f252135e699cb526c4bb3b5abd2e2dfee7c
SSDEEP 192:CnWBhW+WYnO/VWQ4eWsrSgaLQLCamylqnajP3TxU:CnWBhWkUXSgaLQ3Jllz3VU
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-core-util-l1-1-0.dll
Size 20KB
SHA256 2e1cc12f93837a4e1fe95e0c640b147be29793705628f9c6cd91a0b5c0c50262
MD5 7fcf9a2588c1372d6104333a4cfc4603
SHA1 8c1ea131a30178c4f250d0cef254557fded0d132
SHA512 2fb84dcedfeddbf41109dbadb59ede86ceeb168db08955dbf9395fab7a18941cc7313bcb47cb31cfd2978540e9beed346044e6c5b5defa61f59b9b78535e784b
SSDEEP 192:MGWBhW4WYnO/VWQ4eWzqpQLCamylqnajP3Tx:MGWBhWmUjpQ3Jllz3V
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-crt-conio-l1-1-0.dll
Size 20KB
SHA256 1368b9af85f186a2b35e2a744eb2103555234b32fdfbfdb94c0f5e525c588e46
MD5 a5daf7d2dd7d447196f5aa65c3b48755
SHA1 847c75d74be334298a8cdb414905cad66bbf0b49
SHA512 32b1463dee8cbc4ccb5296b22281e014f432887eec07773e41477ecebbd1fb85087ff6adc6b7ac68d5fee818f3289daceb2817881bdbe2838cc104d2166a9607
SSDEEP 192:MWBhWRWYnO/VWQ4eWO+4CJky1qnajga3Y:MWBhWRUIR1lsU
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-crt-convert-l1-1-0.dll
Size 24KB
SHA256 2ccb01b62188ddc051a582c128bf880608111c602534e487ec09a7cf67c22d17
MD5 cf95a8f66313283f046ba9e6e5cdbba4
SHA1 b25c686fcc6729a88a8776cdb75ff21cbceb1c5d
SHA512 59f5901e513aceeeb819c73c5b9fe2504e80af28df54db19775d7c0e0481f14c21ce38e6db207672cc10facfdd217638829af2d3f0f85a0a413d10e3a81dae9c
SSDEEP 192:bjQ/w8u4cyZWBhWYWYnO/VWQ4SWcZOr/uuOiqnajBQ:TyZWBhWGUQgillQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-crt-environment-l1-1-0.dll
Size 20KB
SHA256 5a2ae5b270c1eaf467878e7f5dbdc689b71914bdf30293d7d46c01d9dd11bdd4
MD5 71407c52ff12b113cc0498fdd42db8dc
SHA1 f0c6a3c1308177b090b2a94fee90156e1df6bb9b
SHA512 b9bb29d76a144c10b234835b6006637c84103abeb8f5db19991f3ab2baaabe3ea3fc1a87132263d097addd01afcad08e77c9834dccd4c6723b3ca204f50aac1e
SSDEEP 192:cObWBhWoOWYnO/VWQ4eWUbcA5E8qnajTwv:nWBhWhU3x5E8lvw
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-crt-filesystem-l1-1-0.dll
Size 20KB
SHA256 42a99227775e85ca8c197811a86aad0e2af496bd21623e4c9a2dd747571c8990
MD5 bbbf361746440219a3f7933ced5234bb
SHA1 1e3ededaa28e41f51e903c2ca66e7bd048fbaee7
SHA512 f6681875bc02903676cd3ea3303920202c563a1a6e82dd687ed9bd0fafe92c9abba4a6df3e9c93f2bb0da9dccf0abb4543b6a5e5f0c92fa06e809b30b84085aa
SSDEEP 192:vSnWlC0i5ChWBhWyWYnO/VWQ4yWL8xT/FMg/uuOiqnajB0:vSnWm5ChWBhWoUqwT/Iill0
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapper-Windows64JRE-00115399100-complete\bin\api-ms-win-crt-heap-l1-1-0.dll
Size 20KB
SHA256 43c80120970be1efed3ea60bf7aa37b46fcce946b94fb11ca6e3ffff2f16bb29
MD5 bacc491eb1dee4786ade841e7b480cd8
SHA1 84cb8f770cdf873415403edf48e625514aecad02
SHA512 7832912f38cd6ba145af57548c2a1d4da3bed9392a0ab3a0faffe18fab40087e1d74676e2af004627a37f7e079b9146dccf7aaa04e360a88443196fede4ccadc
SSDEEP 192:DFY17aFBR8WBhWUWYnO/VWQ4SWrJkn/uuOiqnajBc:DQZWBhWCUVcillc
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapperTemp-1753446576-3-app\bin\windowslauncher.exe
Size 378KB
SHA256 77b8f597b7d20d4f7ae84caa5c22b94a8d9e09051f7cdaa17f41890ccf8c77a2
MD5 aa2774f7350c37577293f64fd6608822
SHA1 e523f83713ca67da07ded3c1f086194ace764cee
SHA512 593c0c8fc4e1bfcecd78ae86d76dba810efc9a10a0df3ba4c50e987717ab37e0c185e1cdefb0e29ce41703167eda72a4052fd1290b6b9143c7aaadd6daeb9b05
SSDEEP 3072:GOEYOaa0oJ5VbXsXtPhHS7AHn/o/tMAPiXn8yLDvAm9tWflVDDnmjxBTomTokK7:GOZaFJjgj/8q0rOVVK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapperTemp-1753446576-3-app\legal\java.management\ADDITIONAL_LICENSE_INFO
Size 48B
SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
MD5 512f151af02b6bd258428b784b457531
SHA1 84d2102ad171863db04e7ee22a259d1f6c5de4a5
SHA512 1a305bc333c7c2055a334dc67734db587fd6fda457b46c8df8f17ded0a8982e3830970bee75cc17274aa0a4082f32792b5dbff88410fa43cc61b55c1dce4c129
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapperTemp-1753446576-3-app\legal\java.management\ASSEMBLY_EXCEPTION
Size 43B
SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
MD5 bd468da51b15a9f09778545b00265f34
SHA1 c80e4bab46e34d02826eab226a4441d0970f2aba
SHA512 2c1d43c3e17bb2fca24a77bea3d2b3954a47da92e0cdd0738509bffcdbe2935c11764cd5af50439061638bba8b8d59da29e97ea7404ea605f7575fc13395ca93
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-00115411648\JWrapperTemp-1753446576-3-app\legal\java.management\LICENSE
Size 32B
SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
MD5 663f71c746cc2002aa53b066b06c88ab
SHA1 12976a6c2b227cbac58969c1455444596c894656
SHA512 507b7d09d3bcd9a24f0b4eeda67167595ac6ad37cd19fb31cd8f5ce8466826840c582cb5dc012a4bd51b55e01bb551e207e9da9e0d51948e89f962ba09606aab
MD5 SHA1 SHA512

Submit Download

jwutils_win64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1753446578-6-app\jwutils_win64.dll
Size 179KB
SHA256 7c35c375ff5a5756cb4907d8fd43a040cce19981e83269befccb254be06f7cb7
MD5 f7d634257c5fe0137db959f2f09ef3fe
SHA1 46cf16a3300601b3ad789cf0d295144c53fe08ee
SHA512 c5019e89bb15192db47d9aa6ecd8b9d1c1e5ad138d043acdc52cc96f1af0acb100539062bae6a394405b5ad2aa93c76f76381df90ce03e33c3e506a3738e84f7
SSDEEP 3072:ONV6z6OWR5PRiyaDAr+SAHHBNZNtvXiZOqnGgtzes2AAjfphd3boITFh7FSFr:O6DWDJdSb9/iZOQl8VroIzQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 633KB
SHA256 15414a2203833185adb390a9ad0ae3f7dd599512239424b24828c8fd9eb902ee
MD5 42a3187bf10047d1d62d207be60cbd71
SHA1 fd72b19b211073b4609d3b89743b865f13df7101
SHA512 f815ef8245e9348922aaf563e6dcf4ab8a748a6fca1a3b4a7cdb53b333f320bce605c040339d4f19d8c8f3d98da5394d1faf56c0846d3a6c39e31fb0bdd3c573
SSDEEP 6144:kxrmLfiUqSn2mHtPsPekdzZOuapaIYOEoZbsCpRkFNPrOsW:kNLU92UOpzDapJtJRoNTOsW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wrapper-2025-07-25-12-29-36-145.log

Path C:\ProgramData\JWrapper-Remote Access\logs\Wrapper-2025-07-25-12-29-36-145.log
Size 45KB
SHA256 87afc11ac584d7f707a2195b3cbeb2ca85debdaa87f337563eb4d92d721f5b8d
MD5 2efc53368e79818572efc4c007d3912d
SHA1 ec7285406c12212206043bb03cbaef2366be8550
SHA512 a2277fe765a973398cfa671cc4895ed629c0652b42b5d9e7c32a766fb8228e2c5dfb0a54dbbc22c446ddef410c47db17ab23e11d2e50d8bdddf3413ca21af75e
SSDEEP 384:GjrJHVWRmU8Kghr+As9Y2xbaJzQauaXHeknevNybcxjFL:YrJHVWR9gm9Y2xb0zQxm+Ki
MD5 SHA1 SHA512 SSDEEP

Submit Download

SimpleService.exe

Path C:\ProgramData\SimpleHelp\ElevateSH\SimpleService.exe
Size 114KB
SHA256 64efd9be05f18c384e56804a9bd935db9a303eadee3327ab939489170b0d781a
MD5 36eb05c776ab6e86e4290640548c128c
SHA1 0391d1003ee08a18a69b49977f0fea9493080f87
SHA512 762f524264aad591b6da3cce1936f81b5143fe663875dc76b2cd565753b8ed317e4ecab21f6cea60a6cdf841cba5d8959a42a6b8079d4b1ab36c758512f465a6
SSDEEP 1536:MpbP7TtLV/xaTIn5ei4dJe5xmtvgX93uSpp2cuty/tKhq37p37h:6Hj93uuw0/tKhq3V3t
MD5 SHA1 SHA512 SSDEEP

Submit Download

elev_win.exe

Path C:\ProgramData\SimpleHelp\ElevateSH\elev_win.exe
Size 102KB
SHA256 976af793a7d97976147cc2d7cd7f559a36e44524e9e9af3480b37cddd5c04898
MD5 39c7651cb150dd31a8507994b969abe9
SHA1 7702043605f1e6d77bbc62fb900bd67130a06ec1
SHA512 13d300b459851280d2fb866abdd59af31625097e802508b20aa1166d947173d52eb7f4dbf5295b87c0b736e87c6c82cb298c5379fd8e0e11413d3493e69d2bbc
SSDEEP 1536:AkU92//pFxiQE2kv3VU+oF7G0KtmHTo7HXrTo7o:Apg/5bDF7GntmHTorXrTo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_niqfghur.d5v.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_niqfghur.d5v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1500-1135-0x0000000005EB0000-0x0000000005ECE000-memory.dmp

Download

memory/1500-1140-0x00000000063E0000-0x00000000063FA000-memory.dmp

Download

memory/1500-1162-0x0000000008260000-0x00000000082FC000-memory.dmp

Download

memory/1500-1156-0x0000000007E90000-0x0000000007E9A000-memory.dmp

Download

memory/1500-1155-0x0000000007EF0000-0x0000000007F82000-memory.dmp

Download

memory/1500-1153-0x0000000002590000-0x00000000025A6000-memory.dmp

Download

memory/1500-1151-0x0000000007D70000-0x0000000007DBA000-memory.dmp

Download

memory/1500-1150-0x0000000007620000-0x0000000007632000-memory.dmp

Download

memory/1500-1143-0x00000000083A0000-0x0000000008A1A000-memory.dmp

Download

memory/1500-1142-0x0000000007770000-0x0000000007D16000-memory.dmp

Download

memory/1500-1141-0x0000000006470000-0x0000000006492000-memory.dmp

Download

memory/1500-1139-0x0000000007120000-0x00000000071B6000-memory.dmp

Download

memory/1500-1136-0x0000000005F50000-0x0000000005F9C000-memory.dmp

Download

memory/1500-1134-0x0000000005960000-0x0000000005CB7000-memory.dmp

Download

memory/1500-1125-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/1500-1124-0x0000000005740000-0x00000000057A6000-memory.dmp

Download

memory/1500-1123-0x0000000005010000-0x0000000005032000-memory.dmp

Download

memory/1500-1122-0x0000000005110000-0x000000000573A000-memory.dmp

Download

memory/1500-1121-0x00000000026A0000-0x00000000026D6000-memory.dmp

Download

memory/2092-667-0x0000000008860000-0x0000000008AD0000-memory.dmp

Download

memory/2092-523-0x0000000010320000-0x0000000010590000-memory.dmp

Download

memory/2092-517-0x0000000008860000-0x0000000008AD0000-memory.dmp

Download

memory/2092-506-0x000000000FD90000-0x0000000010000000-memory.dmp

Download

memory/2092-666-0x0000000010320000-0x0000000010590000-memory.dmp

Download

memory/2092-665-0x000000000FD90000-0x0000000010000000-memory.dmp

Download

memory/2092-534-0x0000000002F90000-0x0000000002FBD000-memory.dmp

Download

memory/2676-617-0x000000000E1A0000-0x000000000E410000-memory.dmp

Download

memory/2676-600-0x000000000E1A0000-0x000000000E410000-memory.dmp

Download

memory/2676-619-0x000000000E730000-0x000000000E9A0000-memory.dmp

Download

memory/2676-613-0x0000000002D20000-0x0000000002D4D000-memory.dmp

Download

memory/2676-611-0x000000000E730000-0x000000000E9A0000-memory.dmp

Download

memory/2676-618-0x0000000006C70000-0x0000000006EE0000-memory.dmp

Download

memory/2676-610-0x0000000006C70000-0x0000000006EE0000-memory.dmp

Download

memory/3172-1118-0x00000162B0660000-0x00000162B0682000-memory.dmp

Download

memory/3296-1226-0x000000001DCB0000-0x000000001DCF4000-memory.dmp

Download

memory/4872-1176-0x0000000000670000-0x00000000006B4000-memory.dmp

Download

memory/5644-761-0x0000000017FA0000-0x0000000017FCD000-memory.dmp

Download

memory/5644-733-0x00000000019E0000-0x0000000001A0D000-memory.dmp

Download

memory/5644-751-0x0000000017FB0000-0x0000000017FB1000-memory.dmp

Download

memory/5644-768-0x000000001C940000-0x000000001C984000-memory.dmp

Download