hxxp://statsonlineviewin[.]com[:]4444/access

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://statsonlineviewin.com:4444/access
Sample260415-tp552sdt9r

Score

8^/10

backdoor defense_evasion discovery persistence privilege_escalation rat

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
62	5048	msedge.exe

Modifies Windows Firewall 2 TTPs 11 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6656	netsh.exe
3812	netsh.exe
2364	netsh.exe
5412	netsh.exe
6812	netsh.exe
6736	netsh.exe
6136	netsh.exe
3428	netsh.exe
6552	netsh.exe
7156	netsh.exe
1492	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	elev_win.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	elev_win.exe

Detects SimpleHelp remote administration tool 1 IoCs

SimpleHelp is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral1/files/0x0006000000021b13-194.dat	rat_simplehelp

Executes dropped EXE 30 IoCs

pid	Process
3240	Remote Access-windows64-online.exe
396	unpack200.exe
4196	unpack200.exe
3340	unpack200.exe
4340	unpack200.exe
372	unpack200.exe
2432	unpack200.exe
4260	unpack200.exe
3156	windowslauncher.exe
1184	Remote Access-windows64-online.exe
2836	Remote AccessECompatibility.exe
3148	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
1736	Remote AccessECompatibility.exe
5672	Remote AccessLauncher.exe
888	Remote AccessLauncher.exe
3340	Remote AccessLauncher.exe
5600	Remote Access.exe
6872	Remote Access.exe
6416	elev_win.exe
5580	Manage Remote Access Service.exe
5596	elev_win.exe
4668	Manage Remote Access Service.exe
1984	SimpleService.exe
3608	SimpleService.exe
1876	SimpleService.exe
4588	SimpleGatewayService.exe
1148	Remote Access.exe
3056	session_win.exe
3540	elev_win.exe

Loads dropped DLL 64 IoCs

pid	Process
396	unpack200.exe
4196	unpack200.exe
3340	unpack200.exe
4340	unpack200.exe
372	unpack200.exe
2432	unpack200.exe
4260	unpack200.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
2836	Remote AccessECompatibility.exe
2836	Remote AccessECompatibility.exe
2836	Remote AccessECompatibility.exe
2836	Remote AccessECompatibility.exe
2836	Remote AccessECompatibility.exe
2836	Remote AccessECompatibility.exe
2836	Remote AccessECompatibility.exe
2836	Remote AccessECompatibility.exe
1184	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
1736	Remote AccessECompatibility.exe
1736	Remote AccessECompatibility.exe
1736	Remote AccessECompatibility.exe
1736	Remote AccessECompatibility.exe
1736	Remote AccessECompatibility.exe
2856	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
1736	Remote AccessECompatibility.exe
1736	Remote AccessECompatibility.exe
3148	Remote Access-windows64-online.exe
1736	Remote AccessECompatibility.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1401646417\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_332796191\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1127151481\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_332796191\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_332796191\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1127151481\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4672_1732948932\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1401646417\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1127151481\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1064385051\_locales\ru\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 33 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleGatewayService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5048	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207433238882933"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{AE030440-A53E-45AA-B9A1-AAB15998FB6D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
3056	session_win.exe
3056	session_win.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
3240	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
1184	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
2856	Remote Access-windows64-online.exe
3148	Remote Access-windows64-online.exe
5600	Remote Access.exe
6872	Remote Access.exe
5600	Remote Access.exe
6872	Remote Access.exe
6416	elev_win.exe
5596	elev_win.exe
1984	SimpleService.exe
3608	SimpleService.exe
1148	Remote Access.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4980	4672	msedge.exe	84
PID 4672 wrote to memory of 5048	4672	msedge.exe	85
PID 4672 wrote to memory of 2152	4672	msedge.exe	86
PID 4672 wrote to memory of 2152	4672	msedge.exe	86
PID 4672 wrote to memory of 2152	4672	msedge.exe	86
PID 4672 wrote to memory of 1464	4672	msedge.exe	88
PID 4672 wrote to memory of 1464	4672	msedge.exe	88
PID 4672 wrote to memory of 2188	4672	msedge.exe	89
PID 4672 wrote to memory of 2188	4672	msedge.exe	89
PID 4672 wrote to memory of 2188	4672	msedge.exe	89
PID 4672 wrote to memory of 5392	4672	msedge.exe	90
PID 4672 wrote to memory of 5392	4672	msedge.exe	90
PID 4672 wrote to memory of 5392	4672	msedge.exe	90
PID 4672 wrote to memory of 4496	4672	msedge.exe	93
PID 4672 wrote to memory of 4496	4672	msedge.exe	93
PID 4672 wrote to memory of 3564	4672	msedge.exe	94
PID 4672 wrote to memory of 3564	4672	msedge.exe	94
PID 4672 wrote to memory of 2692	4672	msedge.exe	96
PID 4672 wrote to memory of 5676	4672	msedge.exe	101
PID 4672 wrote to memory of 4464	4672	msedge.exe	102
PID 4672 wrote to memory of 5676	4672	msedge.exe	101
PID 4672 wrote to memory of 4464	4672	msedge.exe	102
PID 4672 wrote to memory of 4464	4672	msedge.exe	102
PID 4672 wrote to memory of 5456	4672	msedge.exe	103
PID 4672 wrote to memory of 3240	4672	msedge.exe	106
PID 3240 wrote to memory of 396	3240	Remote Access-windows64-online.exe	109
PID 3240 wrote to memory of 4196	3240	Remote Access-windows64-online.exe	110
PID 3240 wrote to memory of 3340	3240	Remote Access-windows64-online.exe	111
PID 3240 wrote to memory of 4340	3240	Remote Access-windows64-online.exe	112
PID 3240 wrote to memory of 372	3240	Remote Access-windows64-online.exe	113
PID 3240 wrote to memory of 2432	3240	Remote Access-windows64-online.exe	114
PID 3240 wrote to memory of 4260	3240	Remote Access-windows64-online.exe	117
PID 3240 wrote to memory of 3156	3240	Remote Access-windows64-online.exe	118
PID 3240 wrote to memory of 4648	3240	Remote Access-windows64-online.exe	119
PID 3240 wrote to memory of 2380	3240	Remote Access-windows64-online.exe	121
PID 3240 wrote to memory of 2212	3240	Remote Access-windows64-online.exe	122
PID 3240 wrote to memory of 5792	3240	Remote Access-windows64-online.exe	125
PID 4672 wrote to memory of 1184	4672	msedge.exe	127
PID 1184 wrote to memory of 1372	1184	Remote Access-windows64-online.exe	128
PID 1184 wrote to memory of 3424	1184	Remote Access-windows64-online.exe	129
PID 1184 wrote to memory of 5964	1184	Remote Access-windows64-online.exe	130
PID 1184 wrote to memory of 1492	1184	Remote Access-windows64-online.exe	134
PID 1184 wrote to memory of 1612	1184	Remote Access-windows64-online.exe	135
PID 3240 wrote to memory of 2080	3240	Remote Access-windows64-online.exe	138
PID 3240 wrote to memory of 1960	3240	Remote Access-windows64-online.exe	139
PID 1184 wrote to memory of 1196	1184	Remote Access-windows64-online.exe	142
PID 3240 wrote to memory of 2836	3240	Remote Access-windows64-online.exe	144
PID 2836 wrote to memory of 5324	2836	Remote AccessECompatibility.exe	145
PID 4672 wrote to memory of 3148	4672	msedge.exe	147
PID 4672 wrote to memory of 2856	4672	msedge.exe	148
PID 1184 wrote to memory of 4080	1184	Remote Access-windows64-online.exe	149
PID 1184 wrote to memory of 2860	1184	Remote Access-windows64-online.exe	150
PID 3148 wrote to memory of 1984	3148	Remote Access-windows64-online.exe	153
PID 1184 wrote to memory of 1736	1184	Remote Access-windows64-online.exe	154
PID 3148 wrote to memory of 5576	3148	Remote Access-windows64-online.exe	155
PID 3148 wrote to memory of 1552	3148	Remote Access-windows64-online.exe	156
PID 3148 wrote to memory of 5492	3148	Remote Access-windows64-online.exe	160
PID 3148 wrote to memory of 3652	3148	Remote Access-windows64-online.exe	161
PID 1736 wrote to memory of 5836	1736	Remote AccessECompatibility.exe	248
PID 2856 wrote to memory of 2120	2856	Remote Access-windows64-online.exe	166
PID 2856 wrote to memory of 5716	2856	Remote Access-windows64-online.exe	167
PID 3148 wrote to memory of 5508	3148	Remote Access-windows64-online.exe	170
PID 3148 wrote to memory of 4564	3148	Remote Access-windows64-online.exe	171
PID 3148 wrote to memory of 4472	3148	Remote Access-windows64-online.exe	172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://statsonlineviewin.com:4444/access
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff96dbc188,0x7fff96dbc194,0x7fff96dbc1a0
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,17474079029735214873,2109670196238447870,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,2736853001123758897,17763323158324095061,262144 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,13514604888933123118,15069748919994327297,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,464576858843875515,18024230200340487703,2097152 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,10536395989818648807,18146402151266519027,2097152 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,12583460712928059940,11215813423616692805,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,12608277194671819718,9365977668391758187,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14442412477326638599,18186142768650779559,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14442412477326638599,18186142768650779559,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1983500548353974338,2054257859430564301,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6292,i,2341392694177394957,14032552555107360609,2097152 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,17180129613058897121,14143223687085411086,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:5456
- C:\Users\Admin\Downloads\Remote Access-windows64-online.exe
  "C:\Users\Admin\Downloads\Remote Access-windows64-online.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\alt-rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\alt-rt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:396
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\access-bridge-64.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\access-bridge-64.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4196
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\jaccess.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3340
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\sunec.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\sunec.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4340
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\sunmscapi.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:372
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\jsse.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2432
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\rt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4260
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\windowslauncher.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\windowslauncher.exe" "-Xshare:dump"
    3⤵
    - Executes dropped EXE
    PID:3156
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
    3⤵
    PID:4648
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
    3⤵
    PID:2380
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
    3⤵
    PID:2212
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWrapper-Remote Access-splash.png" /e /g "Users":F
    3⤵
    PID:5792
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269737857-5" /t /e /p "Users":R
    3⤵
    PID:2080
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269737857-5" /e /g "Users":F
    3⤵
    PID:1960
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessECompatibility.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessECompatibility.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269737857-5\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269737857-5\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269737857-5\JWLaunchProperties-1776269739570-30"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:5324
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
    3⤵
    PID:5108
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
    3⤵
    PID:2380
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
    3⤵
    PID:6072
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
    3⤵
    PID:4504
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269742247-35"
    3⤵
    - Executes dropped EXE
    PID:888
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:5204
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:3540
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:1868
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:2068
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access" /e /g "Users":F
    3⤵
    PID:5236
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
    3⤵
    PID:1276
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig" /e /g "Users":F
    3⤵
    PID:3320
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete" /e /g "Users":F
    3⤵
    PID:5836
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete" /e /g "Users":F
    3⤵
    PID:4264
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
    3⤵
    PID:2300
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269739461-6" /e /g "Users":F
    3⤵
    PID:1160
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\logs" /e /g "Users":F
    3⤵
    PID:5940
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" /e /g "Users":F
    3⤵
    PID:1268
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269744647-39"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5600
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:5632
- C:\Users\Admin\Downloads\Remote Access-windows64-online.exe
  "C:\Users\Admin\Downloads\Remote Access-windows64-online.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
    3⤵
    PID:1372
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
    3⤵
    PID:3424
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
    3⤵
    PID:5964
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
    3⤵
    PID:1492
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
    3⤵
    PID:1612
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWrapper-Remote Access-splash.png" /e /g "Users":F
    3⤵
    PID:1196
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269739461-6" /t /e /p "Users":R
    3⤵
    PID:4080
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269739461-6" /e /g "Users":F
    3⤵
    PID:2860
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessECompatibility.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessECompatibility.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269739461-6\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269739461-6\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269739461-6\JWLaunchProperties-1776269741212-30"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:5836
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
    3⤵
    PID:2032
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
    3⤵
    PID:5348
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
    3⤵
    PID:4696
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
    3⤵
    PID:5804
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269744280-38"
    3⤵
    - Executes dropped EXE
    PID:3340
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:6336
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:6612
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:6632
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:6656
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access" /e /g "Users":F
    3⤵
    PID:6720
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
    3⤵
    PID:6736
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig" /e /g "Users":F
    3⤵
    PID:6752
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete" /e /g "Users":F
    3⤵
    PID:6772
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete" /e /g "Users":F
    3⤵
    PID:6788
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
    3⤵
    PID:6804
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269739461-6" /e /g "Users":F
    3⤵
    PID:6820
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\logs" /e /g "Users":F
    3⤵
    PID:6836
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" /e /g "Users":F
    3⤵
    PID:6852
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269745519-38"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6872
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:696
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Temp\managera1804340322456772258server" /t /e /g "Users":f
      4⤵
      PID:5888
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Temp\managera575583497554404196client" /t /e /g "Users":f
      4⤵
      PID:816
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Manage Remote Access Service.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269777899-38"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:6416
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Manage Remote Access Service.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Manage Remote Access Service.exe" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "jwrapper.JWrapper" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269777899-38"
        5⤵
        Executes dropped EXE
        
        PID:5580
      - C:\Windows\SYSTEM32\cacls.exe
        
        cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
        6⤵
        
        PID:6320
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService" /t /e /g "Users":F
      4⤵
      PID:3568
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /g "Users":F
      4⤵
      PID:3732
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /p "Users":R
      4⤵
      PID:4580
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
      4⤵
      PID:5080
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
      4⤵
      PID:6720
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Temp\managera3204495342176705840server" /t /e /g "Users":f
      4⤵
      PID:6752
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Temp\managera1702860350604636437client" /t /e /g "Users":f
      4⤵
      PID:1388
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Manage Remote Access Service.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269816710-38"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5596
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Manage Remote Access Service.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Manage Remote Access Service.exe" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "jwrapper.JWrapper" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269816710-38"
        5⤵
        Executes dropped EXE
        
        PID:4668
      - C:\Windows\SYSTEM32\cacls.exe
        
        cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
        6⤵
        
        PID:5944
      - C:\Windows\SYSTEM32\cacls.exe
        
        cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" /e /p "Users":R
        6⤵
        
        PID:632
      - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1984
      - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3608
- C:\Users\Admin\Downloads\Remote Access-windows64-online.exe
  "C:\Users\Admin\Downloads\Remote Access-windows64-online.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
    3⤵
    PID:1984
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
    3⤵
    PID:5576
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
    3⤵
    PID:1552
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
    3⤵
    PID:5492
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
    3⤵
    PID:3652
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWrapper-Remote Access-splash.png" /e /g "Users":F
    3⤵
    PID:5508
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
    3⤵
    PID:4472
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269742118-32"
    3⤵
    - Executes dropped EXE
    PID:5672
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:4612
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:6068
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:4808
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:920
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access" /e /g "Users":F
    3⤵
    PID:5484
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
    3⤵
    PID:2824
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig" /e /g "Users":F
    3⤵
    PID:1292
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete" /e /g "Users":F
    3⤵
    PID:2148
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete" /e /g "Users":F
    3⤵
    PID:4328
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
    3⤵
    PID:612
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269739461-6" /e /g "Users":F
    3⤵
    PID:2416
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\logs" /e /g "Users":F
    3⤵
    PID:1248
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" /e /g "Users":F
    3⤵
    PID:5344
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
    3⤵
    PID:1108
- C:\Users\Admin\Downloads\Remote Access-windows64-online.exe
  "C:\Users\Admin\Downloads\Remote Access-windows64-online.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
    3⤵
    PID:2120
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
    3⤵
    PID:5716
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWrapper-Remote Access-splash.png" /e /g "Users":F
    3⤵
    PID:4336
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\ChosenLanguage" /e /g "Users":F
    3⤵
    PID:1876
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:4776
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:4700
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:2096
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
    3⤵
    PID:5984
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /e /p "Users":R
    3⤵
    PID:4612
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /e /p "Users":R
    3⤵
    PID:6476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=776,i,9266268484373459658,2408167931932370620,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,17076327791157825700,10051203110055733874,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1901234461012011263,14057959907241352044,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,9062457773230555220,14788645275443646889,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,797458297371052273,9957285583300378330,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=124 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,13994330447022512591,13886611468000831238,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,9390632856392342878,12977022730975379221,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:7120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,8026013502657600016,8958571460669295820,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=124 /prefetch:8
  2⤵
  PID:6936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4996,i,12900132781886896008,5066714838564017775,262144 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10468079249662033202,12874655748343199520,524288 --field-trial-handle=2344,i,292543768783951195,10418271135011373644,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4308

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1876
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4588
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-2448325007-22"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
      4⤵
      PID:6128
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
      4⤵
      PID:6428
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:1704
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:6280
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:6988
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:7132
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" "SHRemoteAccessServiceSH_3_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6656
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" "SHRemoteAccessServiceSH_3_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3812
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" "SHRemoteAccessServiceMA_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6552
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java-rmi.exe" "SHRemoteAccessServiceJE_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2364
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java.exe" "SHRemoteAccessServiceJE_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5412
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\javaw.exe" "SHRemoteAccessServiceJE_3" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:7156
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Manage Remote Access Service.exe" "SHRemoteAccessServiceJE_4" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6812
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "SHRemoteAccessServiceJE_5" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6736
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessECompatibility.exe" "SHRemoteAccessServiceJE_6" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6136
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe" "SHRemoteAccessServiceJE_7" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3428
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\windowslauncher.exe" "SHRemoteAccessServiceJE_8" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1492
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.lock" /t /e /g "Users":f
      4⤵
      PID:4756
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3056
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1127151481\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1401646417\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_1401646417\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4672_332796191\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

DetectedProxies

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 502B
SHA256 9ed84c4d60bd850f9c99c84528e877cb68662bf02fabecae1c9e0966d4cdbe9b
MD5 b3ef090d35d48c8fbc318a66a74e7c39
SHA1 8a5ad836bb280238fc7db418d07778f0d918736f
SHA512 5801bed77ea8d94bd0e7e742bf3e8c1e1973e608c3dad62e44d62e7504dc533b6fd291cec0e88dc03813876d89beb2550700f7dadc9130a9663fc8829bfea9e1
TLSH
T115F095D5EDB162B7A1DD5347C422102C0BB4960416389845FC959650FD8E1667F5B460
MD5 SHA1 SHA512 TLSH

Submit Download

JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete
Size 259B
SHA256 8db2cfa7d7b23ca46b326f47f7e611a66716ab70a6e96fc823f8077b2f843628
MD5 0484ad346166af79ab266351c3c0b1cd
SHA1 e0662499f35833be245bc8d971aec79cd8f9e0a8
SHA512 06ee5c20bb9c251ad4db9594a82179a9412f78e3fe4100f2b894edbc045c281fb3efe0e8963d23044589a4b7c712b50ec603a122f3d1759ef8bd099b12e7c022
TLSH
T114D02BE45855265AC700DD72014E39CEB76952A40780C3D87120898AA5634A955A6188
MD5 SHA1 SHA512 TLSH

Submit Download

JreNameOverride

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JreNameOverride
Size 13B
SHA256 e4c596fe101978f244b8f74be616d62bbaae083f881928da51255b0dba50d440
MD5 8199887131477d02232d372bc808cfd5
SHA1 c172ffd15c0fb02432429632272a066b8516e077
SHA512 8623a7e6bb4673572c47035280cecbf09d02a71de54f86a2a3376de080df33af8dbe0d2e5c460779a899ca3d51e5b4c7b1a264ed4089af40b05c187524606026
MD5 SHA1 SHA512

Submit Download

JWLaunchProperties-2448245197-21

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-2448245197-21
Size 13KB
SHA256 ce6843d47e9e1d2bf6f19a7539bf28a8428b9381ed0ce7e75f2818b91b5031f6
MD5 e8ade5a90c88125ec29642b4dfdbd238
SHA1 9a36d52da938f77073f59bd33637ce22257c0fda
SHA512 165f1a9ae23017cee584b85f52cbb327bf39248246e7ce98f2ad755f279343387942985288ea57e0b545ac2aa91128fdbe9e10e8ae14971219918bc7f15cd555
SSDEEP 192:OL78uhb3nHGtQv3nNm/jpDS9jP2jNUCDnbZMdyQRuWlb8cMLO3rlCi6BkmpKt0p:AYuhbXHWQvXNQFD3BxIhMLOokmpKSp
TLSH
T18D52C0B92D34B9B04D61B565361A3BBEE73222E44095EFCCD697B110C7DA107724C45D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWrapperLaunch

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWrapperLaunch
Size 221B
SHA256 7186271120bdc76a60ab6aaee280e9ef1ed6c14fa3515126555afec8073dfe9e
MD5 d622decbd7498058c4f7664f088c0543
SHA1 c273f7d4c867a5a16f15d1c0a0766f0fe96ebbb2
SHA512 8fd57c032127f9389f35d6ab18a74bcd9edbae3642d659b3d4e4cee72079490c7a00f19da9cf4fb604a4dc8ea5453ee8d75471de85f8f9fb9c788d6d95a8ecd4
TLSH
T152D0A9F84034B23A185ECA7D209D2127863A282FA442834900F0A28C8F3202C0788A0D
MD5 SHA1 SHA512 TLSH

Submit Download

jwutils_win64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwutils_win64.dll
Size 178KB
SHA256 837fefd495e9325fcbf173b6c129794ee468df2d33b6c020c5624a27738a59e9
MD5 44d8cde0d01f105b1dc3d67f096ca8e6
SHA1 ca9e3fd2971934f7afd183cb9f42786ccb9bc7ad
SHA512 9b27fb6f5fb3d17fc28b0d14cae70e59ecdbd0d16c6d04f003d3ae07281c5ff9f846d61c12a7d2e6c0c9bd8864a490d94e1ca21b21a11d01706427ec179a5caf
SSDEEP 3072:ZuQFNbxwmckLpSMyLv3vi0VloZi91wSnP7ZOq1za12bDouxpMB/gt5:D/Drq/UEESP7ZOiBHwNM5
TLSH
T1FB045C96B29640F5D5BBC23CCA924356FA7234144325A3CB17A08B792B77BE4B73D360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nativesplash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\nativesplash.png
Size 8KB
SHA256 5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7
MD5 08051133e368d61036576d3ed5b9cc14
SHA1 817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5
SHA512 93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce
SSDEEP 192:XFcpG2JMh/HwqndQb0qZzAuc6SyLK8hC5W+Cyd9kipsR5iyjR:ik48YadQbxO6PLpCWHGVSIyjR
TLSH
T16112BFCC406E7CA471E2012A8A44C75117B625B11D55BE2A3A41DCEB618CEDF2CFBAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWLaunchProperties-1776269743166-38

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269743166-38
Size 15KB
SHA256 d20e10b9be70606cdff8bd6c793ee8eac680ee50934656187bf41921471fd35b
MD5 e900fc7d89a81ba0efa1c168c9ee7c7a
SHA1 914b6b0c981df3079d2072c53053a2f68cc245e3
SHA512 f8d232c4d956eaba349f18dbbe4db4652ae976159bfe4738495c6f0f3d9048c2b87e07c7ebc4d0f328bb9c09966656d909bfc677f453a2ddb74df22e3c286fe2
SSDEEP 384:ZqzYuhbXHWQvXNQFD3BxIhMLOo6mXK6+duKA:ZqzYuhbHWQvyzMhMLtnJ+duKA
TLSH
T1E462AFED1C3876734D82A8F5794E36AEBB3263D49291EFCC5697B624C3EA007614E048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWLaunchProperties-1776269744647-39

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1776269744647-39
Size 14KB
SHA256 cb1723bd0b7c22126e5dea012ffbdbd4888f2c1c6ba9c7e19e456f69f106c5b8
MD5 f4aeaf726078b0077ccfd9358784509f
SHA1 45fcc80e3b04c8692b4c7741fc50cf3a6538a0ed
SHA512 e22c6f587b3b92f639ba97af2edd865f51093b84f55565152810a56364a8429c65253c2f32ee842b6f2c514732056fc1b60af3a763530658e6c60ee0c76a9948
SSDEEP 384:FYuhbXHWQvXNQFD3BxIhMLOotmXK6+du9:FYuhbHWQvyzMhMLtUJ+du9
TLSH
T15C62CFE91D387A734D91B4EA350A36BEBB3213D48195EFCC96A7B214C7EA0077249049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun
Size 13B
SHA256 b5a4e19d8b56c96fb44d055431ebfd2676407b9b214731be6650a1f878a23466
MD5 7abe8e2a32665c446d6bc8ffe9659b20
SHA1 ceb77b9f6d57775b85b573b9eff6fb55cf77890e
SHA512 ac3b2cfca87d99fe29c4b1b7406c54a54376295b6c66a07b2d2e810a02cb93704f60d33ff2795f913499553917164efd06972c55429baf2b1a25e66af9b0be2b
MD5 SHA1 SHA512

Submit Download

utils_wnative64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\utils_wnative64.dll
Size 319KB
SHA256 a0432aa9260be92fc8d515052c7deeb083ed66a19e11cfe75e05a15bb5f73ece
MD5 1353f439f35e77912c404d8f457c7e34
SHA1 80eeff71bc43a0a125b9718a04648fe27a477294
SHA512 7f237029cb50a0b7c856fc9d8127c6799426f1cd73f8d7bdcf516fd5cd4a35aaa6aae3b5599545749d2af2c9cbcc5ffe7d94bf7b90d6cd4f2c9b0360e79898c7
SSDEEP 6144:N6pU/YkcUpofayGv44GMtRAAue5y86lcOrk+ZOtcbCVsfOlgNErdi:N6pUdcHfaL44GM4hDFk+osDN
TLSH
T1B4646B66F35159B1D5ABD17DC9930686E7B134148335A7CB43A0CA2A3F337E86A3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\awt.dll
Size 1.4MB
SHA256 41777cae596b7591b14ed3fcd18ea2cdbe339dbea4605a71d46935c7b3d070e3
MD5 409eb62a5ea879b702e86823e30a7c9e
SHA1 b9d04999d10ec57337c888156a4d6a1b0877ad3a
SHA512 86e93adb8c815bd23385cd2517111750dfb04062272eaaa0c10748963b98c1042c00d554150e6957122cbb8fb2e85030c59c2465d5762e3fe3150090099aa316
SSDEEP 24576:H2eC+kH2VTXyR3XtdK8LvristkjRYZZjiizczaRnrTFUTSc9R6:WeCl2VLYXtdK8LTist8SZ8C3FTD
TLSH
T1C0658D0AE39445A1E4778178C66B8B0BE6B27459039083FB35E9D72E2F73BF5553A302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontmanager.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\fontmanager.dll
Size 266KB
SHA256 ef058c19a2f49122d8751601d8296f8b1a587aff2d9fd6bf8e0ea61d73a0ab9c
MD5 867ddc65f4ba11fd45f0d692ad437219
SHA1 185bf91a57be5f8b7d451676a1113a69e4bcfb8d
SHA512 a5923cc6fd5de24bc0113cb5ec0a823ed1b1a98ed8dae73652146cd51bbd0f5db0d79265a5c288a19d0cc5e4f0a51c4ad452c220fd056eecc4947ad5c1a9b4f4
SSDEEP 6144:98Ll606kIielFjMNEGVFGMReiDAtTOldcj:+l606kkjSbGS8
TLSH
T1E34439C2B65B4EB1FD6F813A457B8A2E96313C498702C7DB53605BC42E2BBE559F9300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java.dll
Size 147KB
SHA256 98dda25cc003d49232108012375fbd15e8c721030d27b0150bc8d7fdf11b99eb
MD5 5ce65a4198ec258940cae0e66b951f0f
SHA1 194e6e9be561f1e38b97d6a2c2516e8bb0c592c2
SHA512 d1337362eee45ba0fb107f0696be1f60c41e30143a3b226cf5c57a3cc6585eebb04ee5af92c1c147bb9bc02a8c3387e7dda356251e0dd8bac9adbd73edaf455f
SSDEEP 3072:C3PUO1vb0afLDRqu67YmITk+Jy/77VKdwTkZ4eE/:S1FnRxZZy/QK82
TLSH
T198E33A4AA34640A2F49772B8B0149107E3B6B598023C93BB47E48B0F6FBF761BD57B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java.exe
Size 184KB
SHA256 76b7a60fee703675be457321bcef30afef733a771e0b979d914cf644e88f9b33
MD5 332c581d5aafc3ad4d4c4419ec9f22d4
SHA1 8dbecb5a6944100dd130136b7ded8171fb0ea309
SHA512 819912355d03df863e4f7bf0449e21af1d385443c47d99362e489f1d61d7fde4b63d52cfb04c85b9abbf086f77cebb29f80eb877fc288d7cc53dfc42186d0ca8
SSDEEP 3072:2NqYHhTu47aBy/JisF0J8Tib4eWrV6NBEOE939CTBfPbqbFvjZqMNoe4DH:2lFn7aByooI8TiFWrCBXE939CTBkvmH
TLSH
T193049E96B39020F5D9A79175C9A58D12E3F27C6A0B70830F17A876361F733A1381E76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\javaw.exe
Size 184KB
SHA256 7394ccd1a33a41716c1fa02ed7d3595180d36f85ab5188d66e272ebb00041569
MD5 d6bdea53983000de73e86cd3ba05ca80
SHA1 04e4b30c215afb554d5e4d89563c3139c5709d4c
SHA512 9eeea73f218e88ef1de2f723a8926542cebdbd81cb762cdad8220f317915b9a11912a493a343dc72598ed9c4c569b12695ff54355f78b7c11a8fae420b364a77
SSDEEP 3072:n21w3nkDO/9ggnwch3L6TMzWyDI3DZMPzVvraCTBfP6fViFpjZqMNofveX:2unkY9gwt76TiP0GrVvuCTBpv5X
TLSH
T1B3048D97B39020F5D9A79175C9958D12E3B27C6E17B0830F13A876361FB33A1381E76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\net.dll
Size 90KB
SHA256 dd493878350d5ca8812e85c2cbf46aad22f9665c36d559d290c850d053a13f8a
MD5 c61a2ce2df9b8670e92450a48729b4ac
SHA1 ae1ad89df8a6527a132a49bb8feb0703e70ba0b8
SHA512 16743cfecbb64cd197f7c420c5cf7da53e80f14899455bb851c8d86518b46063bbbd7b3d84a8ab803f94b9f4300d6fe0fa9439d14da918777f580b86e885f8bd
SSDEEP 1536:957o97I5ZyBDczJBnxnRRcwn4U744+gMExMRhdolsyIcYVSbvw:9kDBKBn9Awn4U7440EHsyIcYVSbvw
TLSH
T1E8934904636820E5F877D2FCC6568207E7B274705660939F12B2CA9AAFDFB717E09B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\nio.dll
Size 57KB
SHA256 ed08fc11b05c728083485a550118afb9c85959d654c3580967d1fe8f9ae7170e
MD5 f1b9456b9d1e4689f70476226a375ddb
SHA1 d189e91eda8d52d20dc0bc1f2f7e2ad293a2882c
SHA512 8540a493aad2dd19f000baa158a8f5f9e0b7d58789c829195b79e354f46b882bd28664b61b81a38169d794625d1d2829393f31ccdd8756a720527c41fde37241
SSDEEP 768:ivTI+hiL5dma7Q8m8KiiKEiql6tjfNObdb45GNrSapXVqlsmB5KP8eCMiIy31Sd8:WERXEv0jqEkrS5548ekv3Y9ciYD
TLSH
T11D432AB7436484D7E46A7138829B4787E463F8108524672F4238C7959FAF7B23E2EB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\server\jvm.dll
Size 7.7MB
SHA256 f534c181ff411fed4f82e2e4417fed7e4f0c644bdfef1bfc27b72d53facdd6e0
MD5 4905b7ce66d1d106693539433b47ad36
SHA1 24ed2d4f11688f3592749803c87f7b4aa4a81160
SHA512 8464d8bf45683f7dcda3921a27022cb23ad84e6c4a5d9fc290cbe8664699878cd06f50d8111cdbee2f8f4b68dd95cad01a01b042a406b3bc0dbef1de426676d4
SSDEEP 196608:3buJXYXfcLDCugihw407humD0qFO9g6mpv:3buJif1ih1mD0qFO9g6mpv
TLSH
T198863A1EA3B580E9F82AC0788E6A970BD6F274A5133097CB9FB047451B93EE5157F213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\verify.dll
Size 47KB
SHA256 d2b5ce56fbaa43f470ecd23f3e37b179d57cf181cbc4f6066f857603c97e3aff
MD5 68f9115344ddcbb428d0af8ebb1eab18
SHA1 3ca54b9530d77f9109489f492973dcc608d8494f
SHA512 574bdd87c0bef081745b1f75cee7a3ea90c4d4261bcaf493a6edc09c88069c6e3e004a988a11aef9811323d998f4b9ab2ebcfa2086d0abf693de8b8d5e4a12ef
SSDEEP 768:1E1NR6iCgj+m/wpbj9pyIstEGF5ecO/JDwAsjD9jQE716IvL2v46jHJ5/:CPYnstvocyXq9ME002v46jHb
TLSH
T192234957AEE516B6E1C3C331C89DA31FC9B1F881137486EF45E04AD59B93B5026BC70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\zip.dll
Size 73KB
SHA256 eed8ab307be46321799bdcaee6e2a01dcf9bad202f5f2ea62aa9edd71c14410f
MD5 8880ca93a2690707b5b6fc8e7ad60406
SHA1 886b5719004d1fd32040a11d98c9fb9bd4f12cf8
SHA512 3adf917293728a526ea56d41a451b2f7df49ebd0ee93c04f44afc20d810b81cea1844460c6d91a1d79f379b522e5022bb92847839dc1c6c35efd7d9651d11feb
SSDEEP 1536:wIt0O1bmgGRWuWW9jZ8CMniIOLIOyVnToIfdK+Pj7Q:wItZZbSBWCOnA9y9TBfdK+PjU
TLSH
T1BA739F165AF46261FAF655B4C4E7CA2FC372341412E4A79F429C97821F077A23B983EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UTC

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\lib\zi\Etc\UTC
Size 27B
SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
MD5 7da9aa0de33b521b3399a4ffd4078bdb
SHA1 f188a712f77103d544d4acf91d13dbc664c67034
SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
MD5 SHA1 SHA512

Submit Download

MSVCR100.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\MSVCR100.dll
Size 809KB
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
TLSH
T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\unpack200.exe
Size 176KB
SHA256 fc928901712fa8b6c977eaa909b2727f6b3bff577319d1a0195804bf1826cc72
MD5 e5adb17ec52853e05edb2cc715b59cc1
SHA1 0abb4d6f6eeaf18aef4474cfd27662591468643d
SHA512 ef04c83b7fccf74d7cb48535f798ff30b171627cc9f21387273feed3a8eaf575694ff4ad9f7c6e7d10de8a4bddee379579f2962c1c2cfab7adcbaffe0355043e
SSDEEP 3072:U3sMlZbgLgHFusSEc1G8YKXFk9H6PTBfBsBMER9iKE5:LMlZbgLwq7PkkPTB5sBf+
TLSH
T17B046D6227A41267D4F68179EAC3871BE6B27959037893CF80D843B21F136D12AB53ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\bin\windowslauncher.exe
Size 354KB
SHA256 6b8fa0274a99950b0d4fc89ab531092dd36038cd18b33ce570f33295536916f0
MD5 9eed0e6f480263f696cb5faae57b6238
SHA1 49aad5618fdc9fb3a29d334777915ef2d33973d9
SHA512 d5caac25ac3bef33565e9b8586122733a27d83dc4956c6b421a819ac60c470557a1ccc8c27dd0da303b682cc2a2e9d047a1c1bdd0de5cd2fd5787c7913387a0b
SSDEEP 3072:uu9l+2xLMaRyXQcp9rIzpLzOyW9VRULQwrr96imiuznUlJ2Anjv6:u4tV/w/MzpmC96tiMUlo
TLSH
T123748C92B28140F5D1E3D23A8AD60B56E7B6B015073563CF1B60846A4F7B7E86F3E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alt-rt.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\alt-rt.jar
Size 164KB
SHA256 12b54648e9d26b494c76c9e3756dab60add8f854688fc12e2c36c05891989ade
MD5 b485c439bfba1362f43a9aa241f0ff2f
SHA1 5d3fdfc49a44d0e4f1bbc1c98a4f4a22b8379479
SHA512 8ac5110301bb4f2d626a344c236fa1bd45d4d2ca0d07bdf5423706195a2259db6e30d65df135ac8f3680f3152e5223e2fb1430475f4270cae14d6d6de41964e0
SSDEEP 3072:pHgtsfIAy6ErvenLKmlit8q5cgwqE7W4QwaW7Nnkr0cfUdcPXr5:pHgigPrpjbEi4FRnkr03Ir5
TLSH
T18BF30116A200A931DB0EEE3579915213FF3EC976C203E16090B9555AAAB3C33779CF74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alt-rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\alt-rt.jar.p2
Size 132KB
SHA256 c0fd6bbba914e8c46e36cb41135dae5d6d2ff4a81b249b1f7ec7602a71743c2b
MD5 5e5864d5d3fb27ffd4cbed9c1230330a
SHA1 82a9ad2b542b21e817cb53a6da22cc2790e85216
SHA512 6c3e2b086e549a0a2f58ecc79627c20066bb03e130fd3bba2160e38148887908191c2b4ce9a316e03ae0a5f9b46019d004066a6eb0729c4e536d5d84c1f2a512
SSDEEP 1536:k9s3KRSOrqvVHFjKDu8k1gVmKa+1wBqB+YxohPr7huSrJ3ACYbkG:TmSOrqvtDiwBqBZePr8u1G
TLSH
T1D4D36B267E672749F7847D3346F42AE603E5E208383729E77E081ED4C9C379B6A10D96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\access-bridge-64.jar
Size 215KB
SHA256 0e9cf10e8be711a7fb1ac1d75924a3038421c8a6d4454dccae52588a3808687d
MD5 71003f590365d865b19f40a3ccd2cdd5
SHA1 a69d6096a773448269cf46ce0f2c8a60f24a6532
SHA512 a4082fc5ef9e85d0f8620ae564ac18d822c28189d5942ebc5e89bacef23d9c3bd94efd3c6534350e676e983cc9fe667dbd9e122816c40fc384527c954c0e3f81
SSDEEP 6144:4WD5hjfqxCifx9lpUpGhf5adUH+dcFjVSys+aU:4u5RfqxCif7bYI0d8+dGjsysnU
TLSH
T17D245C53D21DC4A7FB0E83B270A1AE527B246BBD92A342794CE92B053656C1B1734F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\access-bridge-64.jar.p2
Size 93KB
SHA256 af00fb47a4ae321b14fe5fd4438b06232e804693bc8ef8aecf7768f7bfa4dbce
MD5 8d99561938fa23598f868a72a3fd9cc6
SHA1 3e5f879f3c58011e2e0ad3e7fca6a245e952a5b1
SHA512 bc682ce0d9e097a4c9413b5bb3e1a28722a181820c319a2b9a251f26927540261f432d574e002d9af0af82be9b3a3d41817e70320b09f1c083555954ed91d6a0
SSDEEP 1536:QQaGqQIPSKzn2y3Ky4lEkE/ePNAFK3nl+G6OjjYIKKRSWdddddKfZW3ttZWIII34:vZVDla0TTTTTJTTTTTTTTTTTTTTTTTTm
TLSH
T18293F7177F07B162E2576A3652E5AB445328C388772327E76F285229CEC66C31E1FC8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\jaccess.jar
Size 40KB
SHA256 bf6d1d818d7be1a78796a1fbdd55e7b4d1b319a3aa0f29559c86a709aefe33ab
MD5 8f9b5f170f7d2b3aa31cc06da221f006
SHA1 d9af43c9fe21bc28fcc34b2b69103e54bf87a27d
SHA512 21cc4557caccafe4e48fc9ec03e283391b4ffdc8f0488fe63b9311f4f9d63eaac4ef1238dd2bbe9360fc74c1a4fe46e49cc451dec260154a946ab649df59b8bf
SSDEEP 768:Gda9mppiCkVk/34YCaXcbyOCK3QQZKNBMU+mDwl9uVngBL3YOt:GdaAzGkAoSydKgQZKNimDwbuaBzJt
TLSH
T12113B01B830CC23BE31EB2FA9651568277345DB9E45310FA0CA45B193E92C4F4BB4B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\jaccess.jar.p2
Size 34KB
SHA256 4c73ac4c8d3c02865564ab67fc5ebf0cca604463e79f0d5d34b50aac24f0495e
MD5 420b1dbe9d88f0b845af70b2b85a7174
SHA1 d6efec20f7660293780857cd77717c66677a8ec2
SHA512 5672731e257a162532fbd164d31eb724ac38d136e5e484d0c6b982e73d700aaa5d2a372e9cbef0dc19c12a6f3770dcb06ed6d5097b6ad5773db7752cc8ffae35
SSDEEP 768:hraGpFampC1dt8TTTTTJTTTTTTTTTTTTTTTTTTlMhPac:IGpwmp3TTTTTJTTTTTTTTTTTTTTTTTT0
TLSH
T194F274073353E222D3DDDE356AD5428E412092C8B75B3AAB5F889044DF96EDB2A1CD4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\sunec.jar
Size 14KB
SHA256 a7daa91c20e87c99ac165c3236ddc0b0dfab98158e927947b58e40a67e205980
MD5 12c6b2c194256c242fa90ce1d13ba327
SHA1 cdfa0c07c8563a7a5b0415d5dbc39881ca8f79c0
SHA512 41d3125f1304b1b40878b7265f645544e119c7d0856d795d2b2f537408b5d5a9055479874cf4cefe6e027558bc2e62d12652c6e28227fb37af75c86a63aada2b
SSDEEP 384:Mv2K9V+4ArJ5odMrwnjoro7EGklDkeccBm1APHsQW9/32bV9HSTt9AtSyV:Mv2K9VwJ5AMrwjoro7EGklDkeccIAvpp
TLSH
T18F628D01A935045EE64E09BFE821014BB7E906895B9393344CF0472CFD2C5BB3FBA69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\sunec.jar.p2
Size 13KB
SHA256 6b95b35c9423805cac95f85e068da8e05ea78059798b2547791a06f0913c365f
MD5 17a80f10122fbd1152586f1a629b4ca2
SHA1 4a2d56799ee970512abce9bd55413c9f5524e965
SHA512 5db24cf73fff921897684e8a06d0227d1bb1be2f4660771021d5310390dc27bc757758d9d3c5fd721eb0f67b27fab8a4d3b99dc611c7f8d78dca43efde8365e4
SSDEEP 384:yNWjdw2q03HkDAoSPUXwBIOEpHvHYHPHUHVyhHGHqH1HvHwH89Sqrs9HdHTHTH3M:y4EDxSPU2EpHvHYHPHUHVGHGHqH1HvHp
TLSH
T12B52196AB60813B1D0D41AF360F9181E293435C397463BB85EE8437CFC65AF853A92B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\sunmscapi.jar
Size 29KB
SHA256 12caaa6b270707e23c9c5f3e28c5befc17fb7620d1561854df45f606d7320d28
MD5 9887ebb27924ccfc2cf8a08d2e4edd64
SHA1 93e32c0947cb60f0d70f36f2b7c2faf91d6b1494
SHA512 9573760f5c6ba226432c3eacd1d26c0cbec0e013c00908b9f9e465e07189b6e0b791fddc7d99ed543382d962fd31d90f024aa9a5d4e8f1488b492dd227f90ec6
SSDEEP 768:uoldp+RT5fOKmRQKVnh5tjNJOs8TTHMSLRFkanDyUZClQwasRbhN362Rkm991XHA:fdKpbmR5nh5FNJZ8T7FR2aDyEwasBhNY
TLSH
T1AFD2BF17C52CC1F8FA1544F642286046BB5D4AB2CEE3632C08B7898DB52DE1F6B54A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\ext\sunmscapi.jar.p2
Size 21KB
SHA256 41e33600589250ce9af3060d071b07c6439dff055d095f473ee6f339ad9dbc4e
MD5 99c37613224c3bea31b6f4f7f6cb5edf
SHA1 b10d4bf0812c99c8dbad698b47f911b4fda2354f
SHA512 eea1c66abc9fcc13f8a49415cafede8826fcc07a1a30033fec570b74d5b7cb20241b5fd5dae47cbf3f167289298d1cc7c9677eaed62bc331dc05d7a79c2a7c74
SSDEEP 384:B/4HBDNWKTwibG12ohM1UjrYeIGjHYHvHpHIdHQHfHeHaHqHjHfHTZHXHuhH7HFW:B/4HBDTTwib8fhOUjr2OHYHvHpHKHQH4
TLSH
T141A20717F22E80E0F1C401F660FA504A173CA6D6EE135F396E9C426CFA41B7A87785B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\jsse.jar
Size 517KB
SHA256 fbe2591fcc4099b28ad1557a66daf186c52a3d9533775c742da4b1ebae7d07b0
MD5 ffb80952a3fbd720aa0e90076d4f12e2
SHA1 f1fa6555862790b26028c632334b2ba9440f8a43
SHA512 77cd6a51753e28a586e7293678027077579562a292f3dc272351ac63f11229f1df8096d47068b69d8614bf38f85f814f991286ecd204349493020408a4935cad
SSDEEP 6144:KF+e7mFaeB/+xLNgOWsrqCoRAF/zY35Mpr8VIeB:KFlAc96AhqmXeB
TLSH
T1D2B4A317F20D95BFF240EAFF9831032C23346C3259A3A3794E49492AF5DA5F54A71AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\jsse.jar.p2
Size 140KB
SHA256 8ceb17083d8934ad7d1a21dc60fa9816ca3eb18c07b04e753d82230cec1c2a5a
MD5 d661f861824fbed70a45895b1fec148d
SHA1 fb44974295a9e12c717f28f0139bdec1cb01a43f
SHA512 8d8aa3ad2b38419a215da5c3beb254e94130bc78a8fd75f77fe828526fcf90de4f64fd50071b58bf55658e7358575675b0c761ee699bd0f20602c3e0103f355f
SSDEEP 3072:gXRJdrAlQMcNuiJ82M+lz1GA7TgGCCCCDqhZIvz3p:ghrrAlQMcN3LMYt73lz5
TLSH
T1A5E37B177F0F5102D2EA2E7660F46392933AD210367A27536F451698DDCAAE2CF1EED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\rt.jar
Size 49.4MB
SHA256 f0ec1174458bbb7c5ff7aeea74a879b30cdfeb3476e9feee1eef97a287f3ce3d
MD5 181e9977a9486e9f17d050b75b856275
SHA1 6156941373d2344820a1b0e144ba6d81e1b05177
SHA512 cf7820060aa213ed54606f66b3b3e848f2bd9336985174e9e1804bc6cf0bab078cc553a85e5cc6e75a8e92fde264333d9a2aae2beeecde1e469e06696ea29d4f
SSDEEP 393216:e8BSlT0OpXHmdByAk3r8/kQi20w/eFSJd:e8BSlT09SAIr8/kQi20w/eFSH
TLSH
T14BB74C27F202DA5BEA45E2FE146103651330F4B14A83E3A95FA88D63DDE75D28F643D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269729-5-app\lib\rt.jar.p2
Size 12.9MB
SHA256 4d831bd637883bc58ec3d73aa8408be0ce600e205e6667d4f29097a4114dccb0
MD5 b06fd9da46b89972d0afbc7810d1cbca
SHA1 744052107972e3fdb4e4552beb97825f6a87c139
SHA512 f387e2432023488613dd96bf788eb0f1dbd80eca1e633aea8e01911e904aabc4becaae2aa2522ff757d2a7dc060097eb1ee72f351e2eedc6e41948a13b78a5f3
SSDEEP 196608:eos0S7V4zmgggLYJ4nouGR4eWC2cSw6rJn9rr:hKaagggLYJ4ouRZbln9rr
TLSH
T150D64A037A8F790AE3C11F3442B16392027AD20416773B57BE186BBCDED61E2EE15DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacerts

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269737857-5\cacerts
Size 110KB
SHA256 d020172012854bb4a9d461885c6816eb855498c63ff78bc60944f4fba1e9091a
MD5 2ecfd7e5a8789c3f0e68ae85a26dea23
SHA1 8bccdebcd485eba9a0ac324efe458a087dd55c2a
SHA512 9c350aa5bf3d975d64988f9f33ac3dd0533322f57b9a7a07db479d0082693b5f74c4a90be853dd1af8f2749f003bd8633632732c7ad6bb1abbb894b343ae10db
SSDEEP 1536:n1kP9UXlkT1ze0WuQHoeCHtVjnIhEObD4lyCpcJa7eUS:nKLI0WuybotVnINbclyCpE
TLSH
T190B36CCB4F383921BFCA9E546288E6373E75B3D6A69A24171575C0E16DD27F43A8C00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269737857-5\customer.p2
Size 3.8MB
SHA256 7cd88296a137fccab944509ddfc2cd3017025e24e1cf40e3a2e28de2b5b5300d
MD5 05179a73279d59dff1cad55af324a171
SHA1 285913f11c83376a1a51a472386240d465ae2563
SHA512 ed7f6f059e498851cd511e47a3ed82e55ac50429c8e65e95ef31470e550018966997dfe5486394c1c74a599f3b0baacfd98548baa497f8c90b5164c28b623ce6
SSDEEP 49152:aoI/AaqsUJILBO1HFOdCd4AFIuIPxsqibQB+/2VAcaIh8tJ0clv87mKNGh:afOJIdO9r9FIuIPefhtic
TLSH
T16C068E0BF74D609EE251127184A5930A2329D05A3F321FD37F1C5EA8DF867D26A3B789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269737857-5\jwrapper_utils.p2
Size 923KB
SHA256 bd13d69cb69faf7882a00f934a825c08669879f831c99df273eda2db1846c5e8
MD5 992336253c3205dd9b8cfac12dc307ce
SHA1 9d9e21e4aa4271276bcdccf577b02d960bbbedfa
SHA512 d81340c5f0c4477de689054c6a6a35688438390a4f36dcecc0466d6fecdabd37990359ae073ded0839fc7e768fd4cdc9bdd529a4dadacdc1846da7c2d80de661
SSDEEP 12288:BD8FXQT9muKMUQqM4nQfKPFEaabAScvtvlwStYUT10wsdQ:OXQT9muKYonQQBa0dlBj10JQ
TLSH
T14B157D0BF74D76BDE5910B3248A1870B5739D0086B3217D3372C69A4DE8339B5E2F2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwBuildVersion

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776269739461-6\jwBuildVersion
Size 11B
SHA256 b763b26017745c203140ff015559c136a3b313dce87242c620012b03f9a3eff9
MD5 dd1e3ca806ad272ce608751c7de09566
SHA1 262eb244dc73e1ee107924987b6f787085a195f1
SHA512 1af497071d7c15c4798e0d4c0848c21909910eb822c9f6d3aad57aba4ea54f79fc384e0554154c9c55d0e54b0b86c3225d26838f3de783bdb0206b0b08e2600c
MD5 SHA1 SHA512

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 536KB
SHA256 421ff0e0b157e0b934ce2c8ba43fc81ca54c37e939c705b8bed8d0b5368b06b9
MD5 03de551ac40db5536b9ad0b24bb4376a
SHA1 63f449aaa99cb5668e62b46e1cf1a55d0642127b
SHA512 f8e68abd922033f7519026ea6bbe04b2c7a3329724cb162dbee57e08b91f52dd5a26fb7ad5dff356864e6c0c697bd7218549daf6021a95285fe708cd1ff7645e
SSDEEP 6144:kxS6C032eXnov1ePr+t/L8FefSjZZwh6GYOxdcG1ocX96tiMUltte3ECQ:kxS6cejKp8FefSFK4Gt+cX9Ogl7gECQ
TLSH
T115C4CF0271C1E1B1D6928532B31E8BB3DF7EE1A11725C1C357F059A99E392D29B3B389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 52616597f8b71700ef5a4c129b77f32e787654c620bba73a03884325708ef9a9
MD5 523ad0be18d473580859cf1e338e519d
SHA1 5d26df52b4a2979a7b66e03a07596910929bc044
SHA512 e425d0a17a9e4833d711b7c64f491556b5865eb7391d4ce1f648ecbf8a7513db27f0610e63d1de57f698a74c88363e2f1951a320b0a4ec6cca91d445a89f55b7
TLSH
T128E02BE5C862EC2B09FD1B5860508682EB5413472781484F3E3C93088FB1ABB45C6C9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1879d44f5aa4bbe866be81aa6ab3d6dabf3330386a5a32d62d0149c20df486a0
MD5 4931d633cfda118cae4b32ea0550d0de
SHA1 a3e70a8a9b0f0ad38032a228ec892322b7bd5948
SHA512 c414d501b5d3253e54c37cddf7fe7ee510a0fd39d8c194c92d94cb97c44b2c2826547775e184b2c8b4a3364177a41fafc8479d8f46fa5602dd96ae8b5b2b5065
TLSH
T1D0615F5C91928524E7E0ADB0D7EE277E76704B0C424F0F9835F54E3C8A2DB22D1A882C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587c20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587c20.TMP
Size 3KB
SHA256 b0a7f37d94861cd9a655959696f203ee0e3fe4a11aa96caa3956d603370190e8
MD5 7bc10c583307bd9f72f49c22626f7b08
SHA1 e09f8ee369e84832f2d5a395472c0ab824e5d7af
SHA512 04826e4836479dc54ed8907fe2e7ef2aea9cf39bd1ec7f7e7418f68339fa1bcf2c8cf40f16fcc0923c361c7d9b9b1bf85bdd724cc5c2f6ec79095130969866be
TLSH
T11D616E5C91968564E7E09DB0D7EE277E76704B0C414F0F9836F44E3C8A2EB12D1AD82C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 02fac96540ceecfc1e20e23fc1795138f5a478ffaececc0db59a68fd30f45660
MD5 c36d2319be8d018e0e9fc5446f50f28c
SHA1 6567634afa2929539d8e98b45b777fbd4abe6046
SHA512 41d95ed3e85f29118517631273f07c32a4ae95feeca3e02490c3fc1711331148ef7bc0098bb2b5b2e6180da1e917f055b6fe7fbd77564e745a5c086cf91587d4
TLSH
T1CA41AFF3C3E8856D890196F0BB187E2FCE2D0954432C3E9A85E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4e6c4f03840e3b48ff158485ece93c82feefbc8980da67f60c3f5ac72927a046
MD5 5b386144a5d2e512f3904559ab88edb1
SHA1 bc027a60655c2fffeaaf70c11c0a1fe73303ada5
SHA512 9a9bf729d1e9ecdcdc969a9deb2a6c33fa07f480d9c8e25cfa6bc917dcf990d206bc3286249134fb07c480647b1fcad694e77dd898f0d9599ffd221d43792f33
SSDEEP 192:sxZERgyMqZ/K1Ml8UQe9Q/fXRsRefrsWwqrjZSzodpLDHW6+WNzSO/YKIAPmVRIn:sxZEdq4Q/fhsRejAibPHb//3mPL6
TLSH
T1A872E915AA38597BCCCBD619F6957B93D7F8156391900E48AAFCCB0C04E6BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 683be286060b7bfb0d02a32f71bb2d3c6e41558cb90c306bd25d52e3b202bf13
MD5 2792bced25de96f6ea491c10d90cb63c
SHA1 b8ebe74af0294d2e9a3274142c4ac5953589e874
SHA512 9308705ff3c9761c5f08b7b76e20411abc268b4d84a4522a1970fb651d74c7035ee0f950d73bbb42c89e672a126b0f6f6e82e2b3a2b4e910fcf57cac096cece8
SSDEEP 192:sxZERgyMqZ/K1Ml8M9Q/fXRscbfrsWwqrjZSzodpLDHW6+WNzSO/YK06xmVRIgj9:sxZEd1Q/fhscbjAibPHb//vmPj9
TLSH
T1DF72E815AA38597BCCCAD609FA45BB93D7F9156391904E48A9FCCA0C04E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 14e9c9662b8963fee4eaa8b46c864cc6fb94f6c9bada69e534db4d4139f6a6f9
MD5 95e546d941fa7ff578f23be48871c58c
SHA1 edaad200a1dd58026614f7ebb93946f14e38f8fc
SHA512 3992a5134ffe2003ff2b1896032b65b0a6fa37ebffde6f9e132b7cce3dc8a00f85b897a9b8774fff62a60482636693676d12f6309b0eef1bce695c3a3ebcbad1
SSDEEP 768:DcgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6MKJLlhzCpUroN:DcgLiAUE/aeWvaShqu1javMKJLDOp/N
TLSH
T18AF20C3B2C0CCB7E4F844E9CDC2ABE8E6DE802CB9698895447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0ba22830dc938f6d644ba24b4ca08fb3e4f7aac2ebcf33565775ddcf0001a4da
MD5 26b02cdc8b25fd4d1582535128c11021
SHA1 50a321818f4e3afaf17933dd101b1afd02c57121
SHA512 88e0d70a9690db14f0b5b74cf99b3df53849e992234b7c6313c85215d430b4da84c44835492eb91bedc6b7a21403e3f4449120be9ead1547f38dab85475fe484
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BNjnz:krN/INhx+kcxKBzxNDz
TLSH
T1AAB23A11717A42903A7E398E8595B42F66C230633098F93B7BB914A60F6BE20DDFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 634b54eb343d594b36bb32765e70533d34ba4eb8ea9bf2b0a7ca29600b24bba1
MD5 5a078124cca3e487ed8f7c4c6f31e3f7
SHA1 62bfd753f5fd54fa10ec993cd70d25a4befcd025
SHA512 bbddcdfdd54b82d8f815eecaeaa597fc1dcd9ecd685f884e56cdc7d3d36f2c9a42be28c647ff0bc6cac25d3e36c316008bd7be69797836fcb25629ce18f19697
SSDEEP 384:nGiFavqMg3sN/8TUNTUlIm2ZTPENw6Owf3YQA+I+60H3Ra43GrN1k+5vI+6J:tFayv3qwgHzyY/+d6c3RaDS
TLSH
T1BDC24A75ECA8DEABEDE69FD9A7097603EFE01167D48C0AD4DAD81E0D009719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c44e9182ac088a4f7a6ac79f053b500f33b16e1ee2d4f8b4f7a236fe92b8f6e2
MD5 38c46aea61333594102f91097f2d94c5
SHA1 599b905484b6c35e1dc25d3febc148ae4fc7d1aa
SHA512 f6e26f2b3ab57c47d0cf6ad2e548e94dce0b6a690645713158fb43f0da4bfca18166d40ffa7139900cb5ec997229feccab1edb0cd900ca34f30a066e3acb296c
SSDEEP 384:njiFJjccCs+Bt0S3v3sNq8TUNTUlI4dZTP07QOwf3YQA+I+xIM0Dwv/RvEMyFfXs:OFJccQP3jwggQoY/+dWMXRslFfzPp6
TLSH
T1BAC25B32E8A8DDABEEE78FD9B34A7647AFF00163918819D4D9C85E1C00871DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 891503dd4065fe524e3dbfaaa75c5ebc0311b42e36133a44593ededc2b5ba3e0
MD5 47cd65cf0e3553dcbcd38aa49e686193
SHA1 753e31857e90fdc30ab37a503e009ae068e39a8d
SHA512 c6a7ef5a645e9a4f501b1e3d1b24ee80b7657c4c4fe99e82d8d1fa688ffd2673fed312e0b011d110950492af1d53fcaeea6327750385a179f7292506aa8509c3
SSDEEP 384:ntiFavqMg3sNe8TUNTUlIm2ZTP6A9Owf3YQA+I+xQM3Ra43GrN1k+5vI+6J:kFayv3zwgHxTY/+dSM3RaDS
TLSH
T16EC24A75E8A8DDABEDE68FD9A74A7603DFE04267D58C0AD4DAD81D0D00872DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a4a77fa72e8a0a25c8a45c3b35f35efe9a5f02752c0f0166747f75bdac40b981
MD5 2b0a9780c441899c5f84542f26e751a7
SHA1 77d4015e78f41bde66929ec9b260adcabcd8a444
SHA512 e179557f57d6d7fc8323d56ca5492543030719876d90828a4030383194bf6d26cd0973ac4b6af1b14520aa135a3a4f837c17d8671620cf04682b237697d88b7e
SSDEEP 384:nCiFqjccCs+Bt0S3c3sNq8TUNTUlI4ZZTPL7QOwf3YQA+I+xIM0Dwv/RvEMyFfXs:JFkccQ83jwgUjoY/+dWMXRslFfzPp6
TLSH
T1B7D25B32E8A8DD6BEEE78FD9B31A7647AFF00163958819D4D9C85E1C00871DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 09be7caf7952c89e3f6c218a4f57397fed9e6ac2d2216037c2f9708f14e3186d
MD5 386fc9d56e63db8e4e04121ac9460d5a
SHA1 45282fe0ac62cb69cbffe28a75339c7d33a1bc48
SHA512 d27f2396edbe81ee5546464ce7a700cf082e72c435f5098cf64aa6326e0396cb8f9a1c873f7668941c7319e12e14c7f7d30ecdde9d7ca1fd5998389806fc724c
SSDEEP 384:nYiFqjccCs+Bt0S3Hg3sNq8TUNTUlI4ZZTPLDQOwf3YQA+I+xhM0Dwv/RvEMyFfc:jFkccQg3jwgU7oY/+dTMXRslFfzPp6
TLSH
T1ACE2A2F198E78976E9AE4B97A33D6E429EFCC153B1480994B7C84D1CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 52e2400bfb2511b8930f579bf0efb9865b897c824207ed7469bbe26f8ae6f0ff
MD5 10d4524f45b50c3c236fe2484146d74a
SHA1 d22215d53380effb5180f038b88bc00b90b9d260
SHA512 1cea5529c2a4437211677567184fe58a6e2a8fdebb26329409418ac40663379ebe4526d428480eb195a9fd5eaa1afdd7a9589783177fd3c37940be16142c5d45
TLSH
T1B2414FD1987E1AD1D0BD0A6F609B38FC95C8D72AF168307D6864EA98473A50D244043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 812402ef62b15c64548668246ba7050b6ff8dc42fc1899403923b3b57245b536
MD5 10ed21a875470f2771bc0408067222ea
SHA1 6acf8027d718ce035f23a53c5650d0951940681d
SHA512 258efd036cec94e6f3cecb706376337b376331ea24f7fe40344e8ca46e68d683f3cede224248729c191c75219722e7191667ff565ac9a27b1a0d71fac1770cbf
TLSH
T120412FE05C3D2AD1E0BD0A6F709B38FC95C8D726F568347D2864E998473A50D254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 27ddff9fb8c12c0240889ee3eba7a66655b43394951d9e92440d59a4ac2edfee
MD5 aeb40974e96fc0e1fe0b18c15c123761
SHA1 3412047ceaf23f17b6abe3de295ac4b7090a6795
SHA512 95b0c79c58f98f9a2231c32e299bbc67cf8fbbd62ded063cc2c232a3610bd74c92b766fb96d4cd8102b42de5ad8fe861b5dc699f919adfd37285545636824325
TLSH
T1774153D19C3D2AD1D4FD0E6E709B38FC94C8D22AF078747D6868E998473A90E644143F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 063384aabde65a06d75f133492fc5a0abac180bf5e0c58eddf794a51f72fbd8a
MD5 32a948ad9cfeb5e6edbfe7d23c8a8346
SHA1 850b63e1504a36a6df1bc87f9e73e40cf465ee39
SHA512 7adf108a3e4e220d0e1c439c49bedbd010bd41d9936aa75918455c9eae55ec433fbe606d457f2abc2cdb40cbb319acd1adabc39e8deb0b46ccf70982e74d8128
TLSH
T16941F858A6FA1148B7B76F5A9BF2686E487B7D772A06C05D00110D4F0A73B44CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

JWrapper-Windows64JRE-version[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4F4YHEFO\JWrapper-Windows64JRE-version[1].txt
Size 11B
SHA256 fe0f662b079749cac1371c2926e5d674c4805b41cb9172f6ba135db922ecd910
MD5 bfbd92b7aea07d08273d20427c5f87da
SHA1 da319d852aa50d149c21e4868d1004d241149478
SHA512 d634996822967d6ae1512bcafb4ef82fcce3b0b75b94bf706223c20af42697762309510db18b4ef7bbb7c75a87d2cf0e9b848a3251ddab18aea4782e9e5175ba
MD5 SHA1 SHA512

Submit Download

SGConfig1216323286452081568temp

Path C:\Users\Admin\AppData\Local\Temp\SGConfig1216323286452081568temp
Size 364B
SHA256 00c4310102e2996e8b791178d085fe5df57963421b96b1d6e2835c28f61bf7c7
MD5 9d1045e014082b08650999c854e1c58b
SHA1 a0cb6b4a8d35eacf8949bab007afd4fc514ed5a6
SHA512 5effe250b4363eb03856bfef19be1d94c808ed39579948025409c1b209a6c4c7ebf4526958fce6f50fb04a7bd97d611a87ef7d395e3a1ca21f52e2103b93be8c
TLSH
T149E0D896F5A2E2BBA2CD2347C831406C0B70864856385C5AFDD94250BE891653F1B8B0
MD5 SHA1 SHA512 TLSH

Submit Download

imageio1138346669995591013.tmp

Path C:\Users\Admin\AppData\Local\Temp\imageio1138346669995591013.tmp
Size 442B
SHA256 61d10a9d780a09d2de63536f88f9e14a86296ed804cd986978de39edf10299f2
MD5 dd76e9d25a791cfee83719ef9668d589
SHA1 5c923ebb8ed658f7546d66dfcba2841432316771
SHA512 d09e12efd5373c43ebdb2b700a2efdded044a5909492ff8b804233d4d3fd9f3604dcfc60141677355bd838a11be040506afae4be9e48f4ef5f1598113ead4fdf
TLSH
T149F023FEC4915928DA4B5E137E0BE2176E2B0BC12055F89C4413657977EB1CA35F61C1
MD5 SHA1 SHA512 TLSH

Submit Download

imageio6536634886721651146.tmp

Path C:\Users\Admin\AppData\Local\Temp\imageio6536634886721651146.tmp
Size 20KB
SHA256 fe868d5f0b10caf1c3fd8a75ac2b89f8f44062b488aa726123a3b38efcf2361c
MD5 28e3dc24bf8ac804e8b808e9b2343862
SHA1 77360954f21d23131d8618fdafde8aace88c1ed1
SHA512 95df2656c8d1ca1e7bcec94852e25f3f9285bc121c26ec071946e9c07e5b9d734fa18030ccb60aad5a637e0d4cea1f11155a4087f88b43d8b86f55183ee23d92
SSDEEP 384:j5vdczFAamiBDTuyFhIHlHZABkIHDunLDdVYrfcPReZATzC5feSVpG+fM:1viFxBDnh2l54HiPdSrkZ7HkFVpGwM
TLSH
T14992D015DAE5F6CD6B0B40932F1A7B27606F440B5A327E4C5C8EE2BB5A661008E4A097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imageio684298672860662524.tmp

Path C:\Users\Admin\AppData\Local\Temp\imageio684298672860662524.tmp
Size 167B
SHA256 83af5f63866c20b1b2d2d436236b2fc4a45501b5d1cbaa66d7fafb6603b6b7b6
MD5 b9d86873742c7080b430a5d4255253ac
SHA1 6e47fdd87c05b44f4ae5b20677f29ded22a2328c
SHA512 59c8f07122875160b044368f215ba5acacc1860d5fbf9ba38d6e26d26c9651d5679fbb72952940166737405d385f40d2b2289cf9c914aa6bf59ba26bc1b2d4b8
TLSH
T17CC08C17151A289B85B3B823832D8906B8EDDE80247482D01AA20B43242817E11C2783
MD5 SHA1 SHA512 TLSH

Submit Download

imageio8326187325687129812.tmp

Path C:\Users\Admin\AppData\Local\Temp\imageio8326187325687129812.tmp
Size 98B
SHA256 8cc0a4a79e1b2d67f78e0e85efd1a39265fced4cf5a840c995ceae7cb6f26f12
MD5 c8f15f669b039148667d14ba0592866a
SHA1 2b112eddb281a1dac53771f180d331db42c34b28
SHA512 01673c65907f18459854b6e642cccf85c2307485bd48829fbe66e3ced86a8be5e8b6a88a47e7210dbe61523f16e0af821aed2a3c204283a1eafe7c4b375a661d
TLSH
T1F0B012C3E22A7F3BC94B4573D10D0416C840C75C804520090145518F1D1025C43C4302
MD5 SHA1 SHA512 TLSH

Submit Download

Remote Access-windows64-online.exe.crdownload

Path C:\Users\Admin\Downloads\Remote Access-windows64-online.exe.crdownload
Size 1.6MB
SHA256 97b918b8d6c349555e8f0cca669a4a12b1d3eee365aa3361b8455454d3a09310
MD5 cd73352424b93e168f69a6e6d05ed2a9
SHA1 8baba0323705726d3f6fe21284d58163cfeab4d6
SHA512 cc6fb6f1f522300aab665ede36be32512f7da1ed8bbe800415a145ac9f314ac8dc9a32f2df9a0b230e5b17dbfd8484800ae10ab19474ff3db0664ead59253531
SSDEEP 49152:0aHqbMGOOMRjiornbPOBrwIt2OwihPJSfkKIxVs:lTdZiJrRDwIBSMKIxVs
TLSH
T14D85016AF7A658F1D9A7D838C6928363FFB17168031462D707A08D666F733E06A3D305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/888-1387-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/888-1447-0x0000000007AC0000-0x0000000007E15000-memory.dmp

Download

memory/1184-1362-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/1184-1586-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/1184-1163-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/1184-1101-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/1184-968-0x0000000002960000-0x0000000002992000-memory.dmp

Download

memory/1184-1522-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/1736-1221-0x0000000000540000-0x0000000000541000-memory.dmp

Download

memory/1736-1225-0x0000000007AF0000-0x0000000007E45000-memory.dmp

Download

memory/2692-800-0x000001BA5D200000-0x000001BA5D555000-memory.dmp

Download

memory/2692-813-0x000001BA5D200000-0x000001BA5D555000-memory.dmp

Download

memory/2836-1094-0x0000000007BB0000-0x0000000007F05000-memory.dmp

Download

memory/2836-1091-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/2856-1809-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1715-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1340-0x000000000CB40000-0x000000000CB72000-memory.dmp

Download

memory/2856-1393-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1592-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1595-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1731-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1729-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1723-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1581-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1379-0x0000000009E30000-0x0000000009E88000-memory.dmp

Download

memory/2856-1615-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1687-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1617-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/2856-1686-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Download

memory/3148-1540-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1423-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1367-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1598-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1451-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1484-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1542-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1435-0x0000000008C70000-0x0000000008CA2000-memory.dmp

Download

memory/3148-1543-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1538-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1593-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1533-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1591-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1590-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1589-0x0000000002020000-0x0000000002021000-memory.dmp

Download

memory/3148-1443-0x0000000008CF0000-0x0000000008D48000-memory.dmp

Download

memory/3240-1449-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-1021-0x0000000002490000-0x00000000027E5000-memory.dmp

Download

memory/3240-1365-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-1709-0x0000000002490000-0x00000000027E5000-memory.dmp

Download

memory/3240-1141-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-1710-0x0000000002EA0000-0x0000000002EAC000-memory.dmp

Download

memory/3240-1390-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-1448-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-1058-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-1550-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-1391-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-1022-0x0000000002EA0000-0x0000000002EAC000-memory.dmp

Download

memory/3240-1392-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-962-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/3240-876-0x00000000009E0000-0x0000000000A12000-memory.dmp

Download

memory/3340-1585-0x0000000007AA0000-0x0000000007DF5000-memory.dmp

Download

memory/5600-1727-0x00000000004C0000-0x00000000004C1000-memory.dmp

Download

memory/5672-1372-0x0000000007AA0000-0x0000000007DF5000-memory.dmp

Download

memory/5672-1368-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download