fc99b9483117e98d618fa709c9bff4944f52c445c452ee8fea3e92ca3e720e60

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice-PRMREGVK-0003.exe
Size 21.8MB
Sample260424-phy1yahw3x
SHA256 fc99b9483117e98d618fa709c9bff4944f52c445c452ee8fea3e92ca3e720e60
MD5 d77bf25b85a45f68d7601a9b7d74c9d9
SHA1 8654d930b771f744c37d5afb2df51f4ae95801ed
SHA512 d0c763e0e0736ca6365f34e0c7eea606633ae2453e599a823c5165a7e68008a6dc04deb73ef5c847e03be42600be2dd8f418f57e3f33bf5a143e9cfd686bc514
SSDEEP 393216:+tolZoSUFNgCMOhVoBaAiUNaL70q1uzCJPeT8FJnehMOe5NI+Wb3Q:+tobo/qEVooAZNKYeJPeTe9B5JWc
TLSH
T159373338F6E55CBEDE3BAAFCD09E449B575AB5A603C4012327F1C6D28B213D4542EE09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 5 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4800	netsh.exe
3788	netsh.exe
2476	netsh.exe
5096	netsh.exe
2380	netsh.exe

Executes dropped EXE 26 IoCs

pid	Process
796	unpack200.exe
2120	unpack200.exe
2624	unpack200.exe
2680	unpack200.exe
2768	unpack200.exe
1524	unpack200.exe
1196	unpack200.exe
4940	unpack200.exe
4304	windowslauncher.exe
3484	unpack200.exe
4020	unpack200.exe
2320	unpack200.exe
3384	unpack200.exe
2868	Remote AccessLauncher.exe
4516	Remote Access.exe
1288	SimpleService.exe
1584	SimpleService.exe
3960	SimpleService.exe
1064	Remote Access Service.exe
4816	Remote Access.exe
4152	session_win.exe
4020	elev_win.exe
3336	session_win.exe
1076	elev_win.exe
3504	session_win.exe
1808	elev_win.exe

Loads dropped DLL 55 IoCs

pid	Process
796	unpack200.exe
2120	unpack200.exe
2624	unpack200.exe
2680	unpack200.exe
2768	unpack200.exe
1524	unpack200.exe
1196	unpack200.exe
4940	unpack200.exe
3484	unpack200.exe
4020	unpack200.exe
2320	unpack200.exe
3384	unpack200.exe
2648	Invoice-PRMREGVK-0003.exe
2648	Invoice-PRMREGVK-0003.exe
2648	Invoice-PRMREGVK-0003.exe
2648	Invoice-PRMREGVK-0003.exe
2648	Invoice-PRMREGVK-0003.exe
2648	Invoice-PRMREGVK-0003.exe
2648	Invoice-PRMREGVK-0003.exe
2648	Invoice-PRMREGVK-0003.exe
2868	Remote AccessLauncher.exe
2868	Remote AccessLauncher.exe
2868	Remote AccessLauncher.exe
2868	Remote AccessLauncher.exe
2868	Remote AccessLauncher.exe
2868	Remote AccessLauncher.exe
2868	Remote AccessLauncher.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe
4816	Remote Access.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3989159129\1332087234.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3766950118\2752497067.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3559780703\3291815548.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2879188468\3239694998.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1388509667\118643663.pri	netsh.exe
File created	C:\Windows\rescache\_merged\98783150\3776390755.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4062111013\3166504379.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4052159476\3518038446.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2878548818\3744140183.pri	netsh.exe
File created	C:\Windows\rescache\_merged\566188972\1695221745.pri	netsh.exe
File created	C:\Windows\rescache\_merged\718100698\939335444.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2343073371\3672393116.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1831202810\1514789172.pri	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Access Service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d75a03dcbf1be	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d75a03dcbf1be\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-53500 = "Recommended Troubleshooting"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2\a01460c8\@{Microsoft.AccountsControl_10.0.22000.1_neutral__cw5n1h2txyewy?ms-resource://Micr = "Email and accounts"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68\a01460c8\@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resour = "Desktop App Web Viewer"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6\a01460c8\@{Microsoft.Windows.CloudExperienceHost_10.0.22000.1_neutral_neutral_c = "Your account"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3\a01460c8\@{Microsoft.Windows.NarratorQuickStart_10.0.22000.1_neutral_neutral_8wek = "Narrator"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be\a01460c8\@{Microsoft.XboxGameCallableUI_1000.22000.1.0_neutral_neutral_cw5n1h2txyewy?ms-r = "Xbox Game UI"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9000 = "BranchCache - Content Retrieval (Uses HTTP)"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-60501 = "Cloud Identity"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d75a031035819f\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d75a031035819f	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7d187d47a1c02\a01460c8\@{Microsoft.Windows.Search_1.16.0.22000_neutral_neutral_cw5n1h2txyewy?ms-resource:/ = "Windows Search"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri\1d75a02fec917bd	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8\@{Microsoft.Windows.ParentalControls_1000.22000.1.0_neutral_neutral_cw5n1h2txyewy?ms-resourc = "Microsoft family features"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7d187d47a1c02	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri\1d75a02fec917bd\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870\a01460c8\@{Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy?ms-re = "Work or school account"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9001 = "BranchCache - Peer Discovery (Uses WSD)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri\1d75a02fec917bd\a01460c8\@{Microsoft.Windows.ContentDeliveryManager_10.0.22000.1_neutral_neu = "Microsoft Content"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@wlansvc.dll,-36865 = "WLAN Service - WFD Services Kernel Mode Driver Rules"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4152	session_win.exe
4152	session_win.exe
3336	session_win.exe
3336	session_win.exe
3504	session_win.exe
3504	session_win.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4816	Remote Access.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 796	2648	Invoice-PRMREGVK-0003.exe	80
PID 2648 wrote to memory of 2120	2648	Invoice-PRMREGVK-0003.exe	81
PID 2648 wrote to memory of 2624	2648	Invoice-PRMREGVK-0003.exe	82
PID 2648 wrote to memory of 2680	2648	Invoice-PRMREGVK-0003.exe	83
PID 2648 wrote to memory of 2768	2648	Invoice-PRMREGVK-0003.exe	84
PID 2648 wrote to memory of 1524	2648	Invoice-PRMREGVK-0003.exe	85
PID 2648 wrote to memory of 1196	2648	Invoice-PRMREGVK-0003.exe	86
PID 2648 wrote to memory of 4940	2648	Invoice-PRMREGVK-0003.exe	87
PID 2648 wrote to memory of 4304	2648	Invoice-PRMREGVK-0003.exe	88
PID 2648 wrote to memory of 3484	2648	Invoice-PRMREGVK-0003.exe	89
PID 2648 wrote to memory of 4020	2648	Invoice-PRMREGVK-0003.exe	90
PID 2648 wrote to memory of 2320	2648	Invoice-PRMREGVK-0003.exe	91
PID 2648 wrote to memory of 3384	2648	Invoice-PRMREGVK-0003.exe	92
PID 2648 wrote to memory of 3336	2648	Invoice-PRMREGVK-0003.exe	93
PID 2648 wrote to memory of 1628	2648	Invoice-PRMREGVK-0003.exe	95
PID 2648 wrote to memory of 4744	2648	Invoice-PRMREGVK-0003.exe	97
PID 2648 wrote to memory of 1968	2648	Invoice-PRMREGVK-0003.exe	98
PID 2648 wrote to memory of 2612	2648	Invoice-PRMREGVK-0003.exe	101
PID 2648 wrote to memory of 4852	2648	Invoice-PRMREGVK-0003.exe	103
PID 2648 wrote to memory of 5048	2648	Invoice-PRMREGVK-0003.exe	104
PID 2648 wrote to memory of 2868	2648	Invoice-PRMREGVK-0003.exe	107
PID 2868 wrote to memory of 3084	2868	Remote AccessLauncher.exe	108
PID 2648 wrote to memory of 4452	2648	Invoice-PRMREGVK-0003.exe	110
PID 2648 wrote to memory of 2264	2648	Invoice-PRMREGVK-0003.exe	112
PID 2648 wrote to memory of 3996	2648	Invoice-PRMREGVK-0003.exe	113
PID 2648 wrote to memory of 2448	2648	Invoice-PRMREGVK-0003.exe	115
PID 2648 wrote to memory of 2428	2648	Invoice-PRMREGVK-0003.exe	117
PID 2648 wrote to memory of 4516	2648	Invoice-PRMREGVK-0003.exe	120
PID 4516 wrote to memory of 4956	4516	Remote Access.exe	121
PID 4516 wrote to memory of 3828	4516	Remote Access.exe	123
PID 4516 wrote to memory of 2444	4516	Remote Access.exe	125
PID 4516 wrote to memory of 2432	4516	Remote Access.exe	127
PID 4516 wrote to memory of 5112	4516	Remote Access.exe	129
PID 4516 wrote to memory of 5064	4516	Remote Access.exe	130
PID 4516 wrote to memory of 404	4516	Remote Access.exe	133
PID 4516 wrote to memory of 1288	4516	Remote Access.exe	135
PID 4516 wrote to memory of 1584	4516	Remote Access.exe	136
PID 3960 wrote to memory of 1064	3960	SimpleService.exe	138
PID 1064 wrote to memory of 4816	1064	Remote Access Service.exe	139
PID 4816 wrote to memory of 1752	4816	Remote Access.exe	140
PID 4816 wrote to memory of 3168	4816	Remote Access.exe	142
PID 4816 wrote to memory of 1244	4816	Remote Access.exe	144
PID 4816 wrote to memory of 2660	4816	Remote Access.exe	145
PID 4816 wrote to memory of 4616	4816	Remote Access.exe	146
PID 4816 wrote to memory of 3024	4816	Remote Access.exe	150
PID 4816 wrote to memory of 4800	4816	Remote Access.exe	152
PID 4816 wrote to memory of 540	4816	Remote Access.exe	154
PID 4816 wrote to memory of 3788	4816	Remote Access.exe	156
PID 4816 wrote to memory of 2476	4816	Remote Access.exe	158
PID 4816 wrote to memory of 5096	4816	Remote Access.exe	160
PID 4816 wrote to memory of 2380	4816	Remote Access.exe	163
PID 4816 wrote to memory of 1248	4816	Remote Access.exe	165
PID 4816 wrote to memory of 2632	4816	Remote Access.exe	167
PID 4816 wrote to memory of 4152	4816	Remote Access.exe	169
PID 4152 wrote to memory of 4020	4152	session_win.exe	170
PID 4816 wrote to memory of 3336	4816	Remote Access.exe	171
PID 3336 wrote to memory of 1076	3336	session_win.exe	172
PID 4816 wrote to memory of 3504	4816	Remote Access.exe	173
PID 3504 wrote to memory of 1808	3504	session_win.exe	174

C:\Users\Admin\AppData\Local\Temp\Invoice-PRMREGVK-0003.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice-PRMREGVK-0003.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\charsets.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\charsets.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:796
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\access-bridge-64.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\access-bridge-64.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2120
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\cldrdata.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\cldrdata.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2624
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\jaccess.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2680
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\sunmscapi.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2768
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\sunpkcs11.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\sunpkcs11.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1524
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\jsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1196
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4940
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\windowslauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\windowslauncher.exe" "-Xshare:dump"
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\customer.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\customer.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3484
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\pdfbox-2.0.19.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\pdfbox-2.0.19.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4020
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\fontbox-2.0.19.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\fontbox-2.0.19.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2320
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\jwrapper_utils.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\jwrapper_utils.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3384
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
  2⤵
  PID:3336
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
  2⤵
  PID:1628
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
  2⤵
  PID:4744
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
  2⤵
  PID:1968
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
  2⤵
  PID:2612
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
  2⤵
  PID:4852
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted" /e /g "Users":F
  2⤵
  PID:5048
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\JWLaunchProperties-1777033271483-0"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
    3⤵
    PID:3084
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\ChosenLanguage" /e /g "Users":F
  2⤵
  PID:4452
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:2264
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:3996
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted" /e /g "Users":F
  2⤵
  PID:2448
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:2428
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\JWLaunchProperties-1777033272015-1"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
    3⤵
    PID:4956
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /e /p "Users":R
    3⤵
    PID:3828
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /e /g "Users":F
    3⤵
    PID:2444
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /e /p "Users":R
    3⤵
    PID:2432
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    PID:5112
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    PID:5064
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted" /t /e /p "Users":R
    3⤵
    PID:404
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1288
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    PID:1584

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe" "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\JWLaunchProperties-3211780548-20"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
      4⤵
      PID:1752
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
      4⤵
      PID:3168
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:1244
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:2660
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:4616
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
      4⤵
      PID:3024
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Drops file in Windows directory
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:4800
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.lock" /t /e /g "Users":f
      4⤵
      PID:540
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service" "description=Inbound rule for the Remote Access Service to facilitate access sessions" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3788
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Updater" "description=Inbound rule for the Remote Access Service updater" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessECompatibility.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2476
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Launcher" "description=Inbound rule for the launcher that can spawn the Remote Access Service" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5096
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:2380
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\SimpleHelp" /t /e /g "Users":f
      4⤵
      PID:1248
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\SimpleHelp\ElevateSH\*.*" /t /e /g "Users":f
      4⤵
      PID:2632
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4020
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:1076
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ProxyCredentials

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

SimpleService.exe

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
Size 94KB
SHA256 d3be3d6b69dd3ea3bc20d06eafc452b8810d7e58286bdbf21d194d0966f75f40
MD5 aa8bac20c523a9cd4ac3424655498d24
SHA1 e8ed0b823bc2484a80cb6d79423a204953dd0d55
SHA512 0d4dee182116e935e407eb3bef590490e718d54ccc9c12d6a94b823cbfdfec6101778f91ba7e229b7ffe9a828a90c1d13351058cf650ee189942df1e92aa85ae
SSDEEP 1536:CLbP7be/V/xaTIn5ei4dJe5xmtvgX93uSpp2ca9hXQetjiPWmV:RHj93uukbXQetjmh
TLSH
T11B93AE52B4D0C0B2C45641730985CB769B3EF8366F3A489377F81B9A9E622C55B3F28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secmsg-udpGVV18U139U243U159G9999.secmsg.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\secmsg\secmsg-udpGVV18U139U243U159G9999.secmsg.afos_complete
Size 144B
SHA256 0ccb69470945ba7678047d3515cbf82ebcd285222d92aefb872a11aafe3d087a
MD5 a3d5953d3cf8b1033f08b20c984769d6
SHA1 a9aff5b7b5094b986f5e11771787a07f9cef761a
SHA512 a75cd4f86f858e7533a75ba6341b1424923ef591190d22b1037dc089077efd618da1de87db3f63a9537f0946ec5232506b9fb2efc5ee85e431181e9880ed9223
TLSH
T18AC02B195450C374DA04102C680102C374C0570057C3C56BD70F0C095C83769311FE3A
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 363B
SHA256 08b433805e324a81719b58b0add7cea909140c4514f4792b1fb22398301605fc
MD5 9a88182402d9c0e3f392335b11b87d50
SHA1 46fa893e221b08166d0aafa8b31fff98ddc28afa
SHA512 bf6319d5d72b5658865a0cc621101e98441d4b0a57f3345dd5711539b5e1ff7826fbd4bdba97e2f8a7f27d490fee807500cad8a5bd381637e8b5737e958bd970
TLSH
T179E02096F0A2F1BB92CD5347C831406C0B704A0857349889FDD94150FECE1743F1F8A0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 361B
SHA256 9190822c741525c28cc78437550eaf65486f5151fd107c690b9dfbe156489437
MD5 9a9bfd7afc94f34035a1177c2d73db7d
SHA1 b7fc386c7c4c73ef4e60daa992bef1cf55c53d66
SHA512 073a3b87b7ed0cca3d958e7e2efc9fd017666953ec3ef66f32d9dc367948b40b972f8fa07fe47a8aef68c9ed0937a71d00d6b9abd09b254f02dff757c781c640
TLSH
T1B6E0D896E0A2A2BB92DD5347C82241AC0B704A0856349C59FDD94550BECA1743F1F9A0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 499B
SHA256 98ef2d08c5806c4477be78f5641edbc005bf93966a0ee9ecb9ba9f5c92769429
MD5 2d09e22f23ec80a9210ec3052c1014f3
SHA1 5a51aafca23bc7911279493d5ca3ca1633cf2ffe
SHA512 f3f0a3d9220840b80b8068e276225a538f1030a4534e79cd0f1b3e775e402a7d6459505c1b00ddac613f9b4b7d517abc8b8dcf7b47bcc030e363992a7d7c1a85
TLSH
T10DF09E96E162B1B762DF020BD82240AC0F74490856389C59FD8A4250BE8A1B53F1B9A1
MD5 SHA1 SHA512 TLSH

Submit Download

serviceid.dat.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.dat.afos_complete
Size 16KB
SHA256 0f56008ad74c7192b0b4b2644336486ea78e7d88bb4b18d5e07cf6146f9225e4
MD5 b2b06187b6cfdcc23f6ff540bbf33c16
SHA1 feea55b39be44d661117df22f15ca38669b12a49
SHA512 c384ebee07c2c280c798da8f872fcf07eb2dd52ee23781b8a69fb4a3d6ef944bfc2c4ea1e56e36bdcfff6d107cc1ddeb236a785cf8b672ce2c17a7c3aa0670f1
SSDEEP 3:h5xrDzUI250yfBL8PY7kVVArk7W57pEAiYUzeqq/:F4R50MByY7cqrk78tQYUP6
TLSH
T15A7212064C6810ECC1F3E0F243517C2510ED0765644C44C1381119D20485DC364F6513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JreNameOverride.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JreNameOverride.afos_complete
Size 13B
SHA256 e4c596fe101978f244b8f74be616d62bbaae083f881928da51255b0dba50d440
MD5 8199887131477d02232d372bc808cfd5
SHA1 c172ffd15c0fb02432429632272a066b8516e077
SHA512 8623a7e6bb4673572c47035280cecbf09d02a71de54f86a2a3376de080df33af8dbe0d2e5c460779a899ca3d51e5b4c7b1a264ed4089af40b05c187524606026
MD5 SHA1 SHA512

Submit Download

nativesplash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\nativesplash.png
Size 8KB
SHA256 5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7
MD5 08051133e368d61036576d3ed5b9cc14
SHA1 817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5
SHA512 93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce
SSDEEP 192:XFcpG2JMh/HwqndQb0qZzAuc6SyLK8hC5W+Cyd9kipsR5iyjR:ik48YadQbxO6PLpCWHGVSIyjR
TLSH
T16112BFCC406E7CA471E2012A8A44C75117B625B11D55BE2A3A41DCEB618CEDF2CFBAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun
Size 13B
SHA256 7f6faa90c2250919e6037e18aba87be836dfeaf0b67ba1071a71b4f5e2fd87ce
MD5 4c9037e68e39982c106819110ca16a03
SHA1 da1b21fc1bca16a61803d5da3a245b4b85221116
SHA512 c1980a840e2a7ab48e739977fdaca6ed48a618e2ccc7db563c7eda63d7cd758f47ecfd122c246332929e6722235e390d5f3e3cf2feb697acfc7d9dffc677c8e0
MD5 SHA1 SHA512

Submit Download

JWAppSpec-AutoTest

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-AutoTest
Size 35KB
SHA256 21bbb364194a9abc069fab1b4edfc6e0445f1004a127bfcb19b5e91083fbe3ef
MD5 180151b8d958e699cd22ce28f96faaae
SHA1 fc19531d8554a434b20051e3aca4c1bbd3521772
SHA512 c7c383a2fc31af55dcfd03b2ac6380169fc786a998d472f7ba919c55201cac925c58a809c395f771a1666e85e22aa5185ef18ca3a5a6a664180f94025afa8328
SSDEEP 384:b2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:bPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T104F2AD76BBF1BAD8CBB93676659D02850F3408621253FB3326746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-HeadlessTest

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-HeadlessTest
Size 35KB
SHA256 7acb3dc12e5f1ae773a5f076bb96a205f0e8a0a3b954452e69b318194c230793
MD5 d2b119431f84e94dd4f168b233063d31
SHA1 2cfde51dee9534ac1df8bfa39ea5efb990e5348c
SHA512 0f971ab3c75cfaedddcda44cdfc3c4a7b2b719f0277e7e6400e64cd2203e2e313162b31d603ae4b288f4d8730a047c7a677a92a508ca3e83f3b1716c16b5cef5
SSDEEP 384:y2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:yPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T1BDF2AD767BF1BAD8CBB93676659902850F7408621253FB3226746A7A7DD30C38A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapperJreCompatibilityApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-JWrapperJreCompatibilityApp
Size 35KB
SHA256 cdd4b60322387cfcb15b2761ad0af41212988e65586853f530008af850d70e26
MD5 1ff442165c8416a49bd42ccb129b7a09
SHA1 c0846c7ccbcb4023276646b429da3b9480b24d0e
SHA512 97361b47b5c5f5d59ec1c55ea475b349bb1655d39e07101ca06cfcda0331cfc99c98e611232fa4afdbc3cc2a701e28401d3754215b505c2fab1b9e7fe8b415ef
SSDEEP 384:dryaFx2yl9a8f0MQ8uK5UywnHr8nvC3M2q3eoIzPULDNXTOst5ZWg3eJEzWv382/:jFx2ylwMhfw48v5oa8vNnt5Zn3W0A
TLSH
T1D2F2BF52A743DBC4DC044C31A1281EAAB739ED9B769E523303A075094DEF4D38A7B67B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapperPostInstallApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-JWrapperPostInstallApp
Size 35KB
SHA256 fce347b5beaa1614b4ffd78f1d746609e58e8fab7a3ccfd89edcda956ea52073
MD5 7f6247db5928292d46fd2a142b327b00
SHA1 fddc577afae2222cf805db32b52ca046816454c1
SHA512 e96b4974a14a1abac5bc4cdac5db44d3a5b29dfbe77d3226aa0735cb07921448876062f5f6c820ab63c91d6584165eb896de65e31dc72811031c85d514720740
SSDEEP 384:E2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:EPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T12DF2AD76BBF1BAD8CBB93676659902850F3408621253FB3326746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapperPostUninstallApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-JWrapperPostUninstallApp
Size 35KB
SHA256 89682e1c52dbd417cd8a9dea51f5e96d9e17032a480477b7c5b0accb1a08c072
MD5 45d28ac79e0e256380f5aece6c15a1e9
SHA1 0bb6a88f57fc984aa3e8baaa6afc15c96968f4ba
SHA512 0e20934c2229406e10c39b66a80ceadfa67d507abea0d22beadd2227e870523da5204868a2abc1d3f7904c09b972563ec79e56c0ef3806e177b90562d708a293
SSDEEP 384:lO2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPy:wPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T199F2AD76BBF1BAD8CBB93676659D02850F3408621253FB3326746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapper_Service_Management_App

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-JWrapper_Service_Management_App
Size 98B
SHA256 d6d85963b3f1b78c47864d86bea785982f6d766da712dbf5331acea680231df5
MD5 0b1f8897cf02e7788537e2c2a1707c7d
SHA1 760fafb7fb7a463accdd43781d3f11f96e7fff3a
SHA512 a17226d6b969ab63c35e7af04153aaa4251180c34010ae68a3b41e6b5b4fcde12dd197a55e4f17dce9af656c288672dafe9f4eb410e3c935bb9291afd7452925
TLSH
T1E6B01128AAAEB0A0C08800BF2C0300000AA000BAC0ACB28C8AF0802E02E2C8C0308000
MD5 SHA1 SHA512 TLSH

Submit Download

JWAppSpec-Manage_Remote_Access_Service

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-Manage_Remote_Access_Service
Size 35KB
SHA256 72f3aadcd69843f51f9d492332fd5ad40a7bb329ccbcbb4f5ff6b8cce33bc590
MD5 2fb748d2198cecb34ee6afc16ae2e232
SHA1 ba6d2ce27f729b03f52deae52126faa8e66a2b87
SHA512 03824f3861dbc6836a395d978ad42b802563e4018de8e7d42c716d931d520f084b8a9f7babc7e4705182938f8a97428df2ce185e557a181e1796e5328e91f341
SSDEEP 384:S2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:SPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T14CF2AD767BF1BAD8CBB93676699902850F3408621253FB3326746A7A7DD30C34A529F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Configure

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-Remote_Access_Configure
Size 35KB
SHA256 eb088051e55be6d6577bd18c529a4331f5e279f78a770c647bb11639a272d1a8
MD5 0686e00a121e61a25e099ec91825fec4
SHA1 87a4355c1cbd69ca331b4a0be561d26a294f23c8
SHA512 2f067b472f295f6fce7415b99211ead5e6f87295b36e3a76fff61ed8890c397b2f3dda5769e439fcea4595d0c9d46f06ae9e8bcc4ecd769eca588d5ff441637e
SSDEEP 384:P2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:PPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T1E7F2AD76BBF1BAD8CBB9367665D902850F3408621253FB3326746A3A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Monitoring

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-Remote_Access_Monitoring
Size 35KB
SHA256 1def1b46e04da4f0af455c8a0c631450e5382acbfef2b0ae70d6299297042995
MD5 103ccad977c28885befa8a291650995a
SHA1 7db8aadf37de5d81c717db3a370bb5b246a1fa80
SHA512 14ecadf7bee0319cf8270a63c9a1b292d2b1f8060f25a586b3d5ef1876d9c49f3a849a007072020083a3532533cc34ba5913adc1316c7b5c5cb76d57fe5d9488
SSDEEP 384:v2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:vPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T12BF2AD76BBF1BAD8CBB9367665D902850F3408621253FB3226746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Restart

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-Remote_Access_Restart
Size 35KB
SHA256 486be79f05b5b37b5ec9fef78eeb552e18fb836cad069fead1ec54834864fc8f
MD5 ebf87930ff1d4339e4a50d45b1961c14
SHA1 6aae3a5451a9aa15febd36466737f4cbeb8a74f4
SHA512 f73326a681a1ac9b37fc514148b58f5747a57489eb9ae07b83570b1fc6e28ffe904b104feacd2ea05a924c4cb33f0611f6f2d81857c4b799eb17e7a3e5a8313b
SSDEEP 384:i2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:iPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T171F2AD76BBF1BAD8CBB93676659902850F3408621253FB3326746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Service

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-Remote_Access_Service
Size 35KB
SHA256 5a7a8412c3477f58c49b976325a2cbd4adeecdff72bc805d887c49c23119e5e3
MD5 cf2bf00f1cb0d433ba957004d9018bc6
SHA1 27026e5062cfbeff36b31f97f859665df2b6fcb1
SHA512 76b8b7761f1bd726fad572b59d55d6229befa3b68c0fcc11c9e7e4eb55bb5b07ba0f559f15ce529c66d9a2f2060e06e0cc51b1a1e86e41378de4717a5b592ea3
SSDEEP 384:M2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:MPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T12CF2AD76BBF1BAD8CBB9367665D902850F3408621253FB3326746A7A7DD30C34A529F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Session

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-Remote_Access_Session
Size 35KB
SHA256 d54427f655341f7df976c9b0183d6a50f1ec2a7639a3a1f1aa4d402a69263003
MD5 aea6a34adbb657db75e681daea01a024
SHA1 5e12f4beb0689b6fa60d06e197034a7d88a67b93
SHA512 5dc42f0df03e7536a08c36dcda04d064b93d03b7c1cf6d4efbe7e4a21e17db9345a0d47627a3f4caae9d75d1148052c3150e575a51d591d9c4bf8a0a313f4912
SSDEEP 384:M2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:MPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T140F2AD76BBF1BAD8CBB93676659D02850F3408621253FB3326746A7A7DD30C34A529F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Work_Setup

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-Remote_Work_Setup
Size 35KB
SHA256 7147372eb9dc3fd3e70302736c461edcac09e94e1d3f870fdc599b932d30ea39
MD5 ecdaa4ae565f6eb2dda4bfc059d5ba8a
SHA1 ae43e3242fce8154439c59187323b4d9a1db0316
SHA512 56f73a15775c045734fbdf435c81c40efa5c450c65b5e1b81625f1c6a4a42cd3eebcdfc3c7a3ff090c8c1d03321053c077ae909d29e3d323828143dc14cab300
SSDEEP 384:5vryaFx2yl9a8f0MQ8uK5UywnHr8nvC3M2q3eoIzPULDNXTOst5ZWg3eJEzWv38A:vFx2ylwMhfw48v5oa8vNnt5Zn3W0A
TLSH
T193F2AF52A743DBD4DC044C31A1281EA6B739ED9B769E4233039075094DEF4D38A7B67B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Stop_Remote_Access_Service

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWAppSpec-Stop_Remote_Access_Service
Size 35KB
SHA256 2ff964c09d93fcab72daa52107d2d151417af0d31a2bc6544c8aad867b9d96b7
MD5 55e472b07fc6ebd594973beb27923f2b
SHA1 f7d0bb873bf5de8b05fc966dcf257f6bd87c6a66
SHA512 f84f950bc2f52df877dba19ce0311437dc82de60ba93eb0f43c1b8f9a482054db1f8b2999cd525b2004b0341f70dfed31356cdbab37081274d63cd2b830f1e86
SSDEEP 384:12sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:1Pe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T16CF29D76BBF1BAD8CBB9367665D902850F3408621253FB3326746A7A7DD30C34A529F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWrapper-JWrapper-version.txt

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWrapper-JWrapper-version.txt
Size 11B
SHA256 a9f4ebb48449d128dc92bae80b5cff0014caec60e566f3f8ce0c368bb71fadfe
MD5 9c08295bfce420684bb4adf6619b3066
SHA1 50a51da9a6a1e3d854de5fc6baf2fb39535b52dc
SHA512 0515e82477089c77db9fe7b1715d1f053fba406d4dad8ed8e11286ed783d839ea85218b575ea564a43db1c818ebfbcb4e0e07a53f2b4d4d539d26a8737ea65fe
MD5 SHA1 SHA512

Submit Download

JWrapperLaunch

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\JWrapperLaunch
Size 418B
SHA256 9d3ced8849a6dd7ed571353b7feec75cd40c17289a6c6102c4d369fe0db2d5e5
MD5 3eeb1135954c48693ce2630a451fcde9
SHA1 beb4906b89778b3352ee35dba9a38a9f00b9f896
SHA512 6d3b81efbf37f05607299409a68368c7f4f840be621efb2d3f2de6ea4e3f7f2288ea2b609b8f9075e0736b886f4e1d7faacc31accfbdcdb67b50c27ceda1e01a
TLSH
T1B0E0A3E859603E568140C93D47E9399DBB3941FC5240C3E8302572CF67E30596359145
MD5 SHA1 SHA512 TLSH

Submit Download

jwAuthorPublicKey

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwAuthorPublicKey
Size 1KB
SHA256 b72d40a45a55df2c60142d734630e5be9464b52a09cf71a2951bd4553f785a12
MD5 1128dcb368df4e55c20a4657d6b9b6a5
SHA1 a5288d935233702de687aa089dc864e7b9db3f84
SHA512 45741d62559ab3bb476835cc99f0ce76dde0135de6dcadcf52ebb489125aa822de2efaf9146fba144fc3d5d9a5d76b8e64bd976f1fc0c8b9048f82e2b8369814
TLSH
T19C11D870106F3A955E791180DA0B23DB1F17A1C9BC6052892B69723167AF2CF47C8771
MD5 SHA1 SHA512 TLSH

Submit Download

jwstandalone.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapperlib\jwstandalone.jar
Size 3.1MB
SHA256 46900e3cd614521fa6750396ae599602fb869fd6074cfffab35217b76a22db31
MD5 fe777267e6b488c1f01418813991112c
SHA1 6c4e9b5735bfeedc930b5f5e5eb64d188fb2f318
SHA512 2121bbab2d0b58d9250065106f9d5d2ad7641bcb27b93840187044f88123d45e6392ce0d0c5d049f8757d04bf37aa6caeddc70a5e8db64a246d574623e18a502
SSDEEP 24576:4vcxtR0Ib2oaqfLBQNaLV4WRIETbxgOFR0BPnvYu+8ZTzz+hTSUSvejD:wcxkEa4LBTlsvdZTzz+hTi2jD
TLSH
T1DDE55C1BF1100E1BF291E73C59A483587774D0708353E7A26FA9A86FAEE72D4DA423D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwstandalonelaunch.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapperlib\jwstandalonelaunch.jar
Size 18KB
SHA256 901919e3e42b44565a2f57a077ba65e7308d9651223b97b4966360f18f63246a
MD5 404f278cbaaf0187271295c80623556f
SHA1 8752d35655e261d140e3e4e8b2b77674fba3c82f
SHA512 66552c5f4dd4a1bc933bd61f51b32ff778826b01bbf63e3830c3603054063ce2293fa5a35f856f6f996c6f3bc9e2acece9634425543dd3aadb87f19890173f71
SSDEEP 384:091dtaOFbh2dkPY2T0ryVtjMu+4MZH+bGP3zbIqAjjT/c:09lF8dqY2orGtjMJ4MZHoG/zbI5jjTk
TLSH
T1C982B62BF028B457F0A6F73D165813181974A032D52BF6B06FAA485F8FE22D08B557CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_linux32.so

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\libjwutils_linux32.so
Size 10KB
SHA256 226299d0171700cfa0ed668d3e5ee1036dc860d23ad9eb238bd0037bd9ea732f
MD5 edcd4c74dbf4e558ccc5023ff4fbfe28
SHA1 a60995d8909bcb239a846b68d79163f04fb429a0
SHA512 cf3cac1636a7a80e3c62edde2f5331431e06d57f3d267d758bd3a3d560218402543091d16d0ad4aebe1c862928a182a64a5d97c2481ae6c8ba02507317df9290
SSDEEP 96:cvEsYRXi3WHsTyX3Qa/c2k6fBiQiBh66zvpELGatA7AmVMJftEPTz5AJY9XBMk:cJhmHsuX3Qgc2k6phsvpEqwZa6ED
TLSH
T169329522AAD1CD31D08E177C01BB435DF336483382538327424C65AC6BF75EAA772B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_linux32arm.so

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\libjwutils_linux32arm.so
Size 10KB
SHA256 bbec792801a81f7521f27fd872c9e1a2ca19456525a4e201e81a0f19776d0e0e
MD5 8a7574c4f327d70b144c92c126870c34
SHA1 738a5c3f21a61c7db0542e8d0715500b5ac1790e
SHA512 a63c649565b0a8e5e0f12d5036a20b0479ff0fd42563297c1078017942212a4808a49f59b531030060521912132fa05e230c7997d480aae66c8780fefeb11402
SSDEEP 96:ux62NwksYRXi3oaKoe30R5qFxBxTOD44ieMOImuiYGGoXBTE6A9ighVKdPO:H/hbKos7xBo4DOImvEdAGeO
TLSH
T18822686BE696EC21C4DE127C817B83CDB36988734A812337421CAD64BB96D7D6B319C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_linux64.so

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\libjwutils_linux64.so
Size 14KB
SHA256 d08b475f3e40077e40bf949db73de4836c0318a7d4cfbe310135f445ae7403fb
MD5 d28409795fb3212dc5621a680388aa8e
SHA1 de217e7ddad46347a21c1e0684a9a044c87256f0
SHA512 d9e886aa9f32e1d1343cd09ee43cee4acb7c1e62aca1dcc27a46bcb7d2adc5942b812b31cf8fb1107b4054bbfcf9ad78c78625b038ebc8f183eaa146c1fc0ddc
SSDEEP 192:RQlhmShdvgpN8FPVuQLjZQyonXaoFs26LK09a:y3tBoQ2qt2j
TLSH
T17A62866B7AF1CD38D08D0B3C1457C3A4FA71A82587425307228CE1ED3FD769A5BAA6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_macos32.jnilib

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\libjwutils_macos32.jnilib
Size 31KB
SHA256 e0b30a7b14060ad9164bddbfba6eb650104dd41abfcc5d94e4b81b6bc9bd989e
MD5 0c0efba980bcba436f5dea05970a6ac6
SHA1 745e0bcafa9672708759d50bf287ea1a6b432169
SHA512 5bdeac7be80f43821129678a1e1a8f35e6fb870f73123c0c3d4debd3d7419824067de99682d94ea402021adedeafb8bacf9a044d3ee01d8ae24e7f608570dc35
SSDEEP 384:VZ52uB8jo2d6S1iTv1+su4Crw08raXFDnz:VZ8d6p+suI0Qa1Dnz
TLSH
T1FFE2B6312A5EFB7AC05B587980DFC29F5734A22DD0114B93CFDC9DA897AB694FD0810A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_macos64.jnilib

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\libjwutils_macos64.jnilib
Size 27KB
SHA256 aa76b12c98229260d0856eeadf412dc35cf44e440593d539756bf34a1d198d59
MD5 592a6d59c2dc1e78c1e535f573a10a0d
SHA1 57309e0ea14a3e317aa1a8d92b49cf940191b3d4
SHA512 a2fdd1400322149384fa163856fb6698bae9d1465c41c7e9f2b0b0089817738a4a493f65a38d2a1ec6a6b396aa1de7dbd3573c413142e13ad49eab81f26bd5e8
SSDEEP 384:awzaIchrvGL75D0MfrnuHpmhBgms61oSRWhozcpaDpKraXFDnYx:awzcvGJD0MfrnM4tsnShcpalqa1DnYx
TLSH
T13AC2E72BAFD4C45AD04D987CEC2B8262DC55F9D80651629B02D5FF2C2FB19701ACDA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service_launch.sh

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\service_launch.sh
Size 2KB
SHA256 25b3b23be870e76db0d23947b112d786f90645a90b2f590f5111538d44d45f0a
MD5 65151db7dba0f95271c6e4abd7e7ebc3
SHA1 0bf3338e62be66d8e515e5d7ea6f8717891fc062
SHA512 215e088bd06c854f1d9815d437ecb1bde308050b03176aaaf552dda3b5ec306d70b9cd5f8badc35212e373d1165c9e5351eda22a65209fccad7f64e1a8b782c2
TLSH
T156414516D44D8EF03F96A0FC6B4E62D1A73BD02A0D5B17986DDC6CA361E354EA278040
MD5 SHA1 SHA512 TLSH

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun
Size 13B
SHA256 c88d146b3032f11eeed2a1b62a2116b5db8e68899f3d2dcb34242c124474c53c
MD5 4ba9ab4c2e03fd20d32e853c2bc0087a
SHA1 51dbf0e5dce211be99c7e35f1084c53c0096d303
SHA512 99d85b97f413a6b133b1a51155886bd891aa5dba89e1de36362d8831b42816d5e0769f2baea3952c5a71fd6be0d03b90f597448c8c63d3ccd42f8b187fbe7a5c
MD5 SHA1 SHA512

Submit Download

java.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\java.dll
Size 157KB
SHA256 5f77d3d190d3cb4ebb9b4f47aefe826bf6e15f383d6822e1a25a5729227ebf26
MD5 2b3f3da6a443e6be107e61628d220692
SHA1 c90416d47e8689e1338e71bb46946f7e67607fb3
SHA512 c6dcde0e83932506b5d18aa802e2747a4dd6fa9848a424a1d2db1a527b98b7676af67673d40e1a0e9b7f9bc9eecd88380273eb3d29169d681a4fd02324f6b6db
SSDEEP 3072:GwLr0BaOH91zgqMVasnXkI/M5WMsInVSVgcJj0mUgq:eTdGDVbUmYH97
TLSH
T1E9F3280B625640A7F89775B8B0166003E3B67468023D836F47E18B8E9FBF761BD97781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\net.dll
Size 95KB
SHA256 7181c21fa655d389d85c5cdb06c6b4359cde93e47c13269e09bfc5e87fb3cb39
MD5 dd7bf43cab35a227017af46a182c3b9f
SHA1 20cdb203f339d5ef8e80504276a9bf2051fe4342
SHA512 7f34126f121a3057b9d78120a5b8e82dc4a7f285662c0dc526fcc06a547176b66720179c4f41384f5073680d34f99d46020a23a77c2622abc0445ad08cd20d31
SSDEEP 1536:xxhrMqB0lDHzB047E3PkQKJxEFASBeU84qTRGSGkyepGi8Ljo+svghO:LhrSDF0v3PkQKXEFAhUqLrpTgls9
TLSH
T1D9932A08636860D5F877E1FCC2868607D7B3B0706620579F13A2C99B6FDBB617E19B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\server\jvm.dll
Size 8.4MB
SHA256 13b6c6c5c3d0f90588c6d16a2c00436dcf08044b0150a3cd71a15ee69472a6ff
MD5 be7b903d854715572c1c180344f913be
SHA1 7b2ebe4bfa6e3f2ee62e91cabd41636a56f9b77a
SHA512 af2d38a7ffc0f10e0b12cd108ae3a7054334cd4a84cd76095f00c4b28de431b94feec6e3c44e95c514f114855c209f42d58fb683f1eb246b2e2ec14538d6ce5a
SSDEEP 98304:9s4/l53KnlrNX3sEeylN951rtdsotEef3PpecH7ZL1Uk:9Z/l53Knlrt3sEeylP51rt+otEs3PzF
TLSH
T11F965A5762F000AAE9BEC278CE57E617D7F3785843319BCB66A017950B13FE52A7B210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\verify.dll
Size 48KB
SHA256 7e239d228728ffacdd098196b61e954d3af7da83b9359920934330be5866ba5f
MD5 68643834b2e8b5dd58d505c0c470bb56
SHA1 2bb2db6f7ad5029e7b978c52417ea4e3053b4c23
SHA512 7674228fb64d34ea563776c5d3a5e5a052da8a1089325e981421b8ea5e5eaaf96a38f837557885e859f4c79cb1d26e82e5620c3c98505654d49f09ee2158d2d3
SSDEEP 768:OYkpGTievAR+x/Olkj1ZyiQLdYn+KP1aU19pEiOTD6EB+w4vZij+ess3hDN:KELxRn3HfpEX63rvZZe/3hDN
TLSH
T173236B6362A86875E8C39074C697EFC7DAB1F8ED0354D18F14E4960EAF4BB512BD820D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\zip.dll
Size 77KB
SHA256 49be17444b2612bde91d0f59aeaba2ef2deb14a12baa9b90a36d1ad87f9fef4b
MD5 bcc302e0d9f6bdb71cd5cf2f846a5e76
SHA1 b9c5f74430541d08f2a99d82633c7c81530f101a
SHA512 fed292db9cc2aa4c9a9528aac676a96ed48b30dc4ae9df4113670b8b1cec59b52a28f033bbce53787aa6d168c72e2826d2e7b9df670884b96629fa6def0b681b
SSDEEP 1536:ZRUGiGvAKb3shmHisnmjx++8o9IOQIO+VnToIfYt74s3h0Ou:ZRUcvTsc3JPo3G+9TBfYt747Ou
TLSH
T1A8738C994AE091A1FAF651B4C4E68B2FC772716052D4939F529C93922F433A23F483FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAuxiliaryArchive-Remote Access_macutils32

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\JWAuxiliaryArchive-Remote Access_macutils32
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

JWrapper-Remote Access-ICNS.icns

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\JWrapper-Remote Access-ICNS.icns
Size 18KB
SHA256 60bcaaef7d51f73a7461fb83d27eff75353ee0273d0d4a9cd2dfe92d2d50d599
MD5 38d961a37088b5b60431ef4b81bc8902
SHA1 08a518023a65c78c4d044db125524c4f56197f07
SHA512 6171ebbf8fd5bacf89888dfc2de6264a088abf9623e3d937fb8e40774d737fb657642ffb466d26bb48f8854344758fee12dc2c3f970806c25cb14e411bc7551e
SSDEEP 384:+ZBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUZ/9:+nRKssIx5/3E+jnwJ+sLH
TLSH
T18482F1F97B225578D4ACB97E5AC90CD90BFC5CFA61D2CD28B94521FBF46608105135B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWrapper-Remote Access-splash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\JWrapper-Remote Access-splash.png
Size 4KB
SHA256 2f7d3bc8ffbe9b3152ec9c332363247a4e89591fc1349bc0eb2e3a3d93055043
MD5 a3be1246247cfc9a93352d288e81f358
SHA1 b091ac5e9a4c638dc4d499c52fda4469d99f91c2
SHA512 f4b4b868796f5239adc7fc9d75f3c66c99a0a02fcec2b8094dc24cfe80328ca8920ced932688932d1c4328b4ab37bf74193800f27fa2017e983bb031eb9c4250
SSDEEP 96:tRbMDt1APL6F9Z7DMQC14nGVoYnunsDHvTOrnsUzlJG7bsFoBFS:UDLHXMQm4nGOg8sDH7OrnsulJGXYoW
TLSH
T1F3916EAA1B6C2CC04878C596B4C719BC391DE1748156D3D27C6EC507EA2FFDD52E2350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWrapper-Remote Access-version.txt

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\JWrapper-Remote Access-version.txt
Size 11B
SHA256 6afd7786f03601285735b5053a5131887128fd9a214ecf1909290ccf49f01c07
MD5 daa3c36025e2f86bd0a8d8bf3be8353b
SHA1 e8a75213e06f643802ea1d7c821644b7327f442e
SHA512 4e9395c0895978b577ed58fcf05c5d0d2001f70930bda667e54971c6a1dc9c242f919a31831962dece5faf725437721466904fb668847208f7422f83245e281e
MD5 SHA1 SHA512

Submit Download

customer.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\customer.jar
Size 16.4MB
SHA256 72c882d00a238df1b4b2f3a5026f780ab88129686ebbeb08ab718b15e690822a
MD5 12989e215d42d53a8d47206643a661dc
SHA1 01f53436ed70554811cec4b90f04c8234fc2ec0a
SHA512 06c265cc8ba38f747070cffd118c8d89ef953773bbd6cf3900a5b603b2c4a3ded3317d255bfe0ddc2eb19d81ff73836f36a5fa9631772db8573c0a979e0efe4d
SSDEEP 49152:fYvMdnX8N8ZBMhc9bz3RB/2CVWlgHS9if/vqmFt0Eu6OiGl3R1LrDtE2tVmxy/z4:fYdvhclPh5vKti2tVmxCBhhM2zsUE
TLSH
T1A0072A2BF3106E6FFB99D3BDB56183713AB068309283D161BFE958275ED61D88B442C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\customer.jar.p2
Size 4.4MB
SHA256 b6bbeb3525ce23a79d001552f0bce93eb362f3ae6616bb589e189ab4a89caacc
MD5 49d4c8dd4112338163ae5413407e0e02
SHA1 8c135ca6998be32ca2cd02f2b2048024d0e14f2e
SHA512 f4e7a4e2553d20649fd8ade72df037f911b4c87fc2bab0b2f49c3358a5e212125018fc692b2708f2fb2c0445fcde50a475e28742b024d50a1b09bd0ab75c1b6d
SSDEEP 49152:b9ICuLxvMsl4HFEmrRORZOXWVFh43CUslIQxv0fMME5ueFcbP+cV3oaODZfSl7Vc:b9JrcEXgFib4IiXueFcbPqVfSl
TLSH
T1F3267C0BF70E629DE6911A3240B5A3496360D0493F322B937F1C5D68DD866C66E3BFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontbox-2.0.19.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\fontbox-2.0.19.jar
Size 1.5MB
SHA256 e879372ee9a043774a0248e9fa61976ade727803136350633830f3d757cdb6fc
MD5 da7e494a9eb3f2f49475700ba42d98d6
SHA1 0b7d2eeff13c04c50163b1c118510acd1345dd02
SHA512 04d0d9539caa74b63e0b12d4f64bef72469ad4f8a771598e95a02e79f0ed4cd3586ef43e27ca1d766d43c8504fdb3aff3a5ff5d482ec1f46e51259eaef611cca
SSDEEP 24576:0qcKx6QH6wGDuOYCzxqTq0G5Olv2VyFj8fbkEF/Ok4uWymXkVp0vyAXK6Gbxw:0qtfawGDuXCzx62OZhN8DJGDuPmIp0Yu
TLSH
T19975221AFF41D199F41B807A23978673BC7E868CF097969B097C12FA9460C154F8BBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontbox-2.0.19.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\fontbox-2.0.19.jar.p2
Size 3.5MB
SHA256 a112312f601965a60c7de425685a9b3ee1445dbb043c3cd88c2ca133c2be7c15
MD5 7f2bb19d616360f7bc5e2a2e4fdbec9c
SHA1 e4e3419e519e04d96b27db2e2cbb3a72948eba59
SHA512 4478c82e609ae243c09363cb83f6f8925c21f5a12ab3e4285728b458e01315c59191b90f218e8cff5de420c5f495b261be05fa9ffd94d293de8db72c26f0a373
SSDEEP 98304:graBPvylKGpcM0vB36FgOqWfW40K0kdTCtVZY/dElZufDSXSXjvYP5BMJkl1K4GP:uknylKGp6vR6FgOzfWNKPCtVZ62lZ2WY
TLSH
T1730687F748586C40C687D16B91300DE3C22FE538664BC36973A8FA73EF8B165799BA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\jwrapper_utils.jar
Size 3.3MB
SHA256 d789a9f939f7a926fa3b08137da7466c829706a95af17d659e64fe735c410140
MD5 5fdcea0e66dade69779669d028ea4e5e
SHA1 62fe5847bb42e387f116d838c2c5872b25275505
SHA512 1c671edb102fd24504a2c92138534b42e8f35eb44b309e00dab2c6060b10b8fb29f12b176758f1220dc5553c3628d76865408a2c0e2944dd3af09976b4921c58
SSDEEP 24576:jMZiPqKIUaIZv+3S94r9vCFqZqxujw/M+dncQhMeiSujg00WfMgK:QIP0ZI1qZqxujw/lqGt7QMgK
TLSH
T150F55C17F1105E1BF281E77D19A08368777060708613F7B26FA8A82B9EE62E4EF453D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\jwrapper_utils.jar.p2
Size 1.1MB
SHA256 9a93a0625a78f36940d2df13a6da68126e93e663b4139a8f7de0f43809e1c0eb
MD5 4d63ad9c4e49c81199d0f271f503085e
SHA1 09e3ed532ce106933273be8370e880ab7caf47f2
SHA512 921d8d98b77dcaaf293a8ba3d7608abb5c80f9a0d59e621984b90d7d0d65fae588a7aca638b5764b1c2921ed32a22bda3175604bd417cebf9d1469c45883141f
SSDEEP 24576:eOQNb1Q3WM58lVVw5Ai8zBwk6eUeq10JQ:nQNb1QGMOi5S1J6zeyAQ
TLSH
T17F354A07F64D7BA9D1910B3508E1878A5376C0086B3227D33F1C6964DEC37EB5D2AEA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwutils_win32.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\jwutils_win32.dll
Size 157KB
SHA256 4d56d75b9e20d0ad8118e2c96f8304034bfeff9f1dceca6f0dd09bb7ffcc9be3
MD5 9f266d3d16aa06f96bd4bf055c025ae6
SHA1 da756182df7e8e217064f6bb6c99441e1279df0d
SHA512 e39cc1f4c96115df612878f079b6d86344571d971bd2eb0d1dabe4195ee6319c7b4328878dc2ca529f3a8b2b24b945dad59c0382b4766690567e203f90dc209c
SSDEEP 3072:S/4HZU2EF3j+r092//rV1Amnv+D22C5Qmw8eZ:m4H5Oj+rcKrTg5V
TLSH
T1C0F3BE1138A3C433D04E063E426197B5AFBF6C1377B55ACBFBA41E891EA43D153B62A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwutils_win64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\jwutils_win64.dll
Size 184KB
SHA256 49c49b94e2a50b865f8a39eb8497bd97a9f3f4c585cd671f8c8fd2b05a24639a
MD5 e7a1e6e40b24adfea986efbcba166bcf
SHA1 f65b974bfaddf8df2e2f812cec31f0a793982ac7
SHA512 2d15c6e9cb3251d2823642319cc7e280c81b0a11cdd8bfea89f0506a3d8526c992e76ebd96cf6f8e33c5062f4f2e62dad3a900e3469938f5f7396caf94e6c1f9
SSDEEP 3072:aDPALDiICFHxb9Prh6Wm2Tv/dchUsZOqSc52ZK26yjdsBqpQ/YSPbR8za:4OGIy7Ru2sZO9cVcjGBJzPbRka
TLSH
T116045A96B29650F5D1BBD23CCAD24756FA7234144324A3CB16A48B792B73BE4B73D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfbox-2.0.19.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\pdfbox-2.0.19.jar
Size 2.6MB
SHA256 de62ce4a1513649b3b571f35f93c8b74b8ef65ea098423fa434b726c3abb4ea0
MD5 5d716baee12737ab8d96a8c41b2178fd
SHA1 ff3fdf5d0b3072bef45281e2696100ccf80c6baf
SHA512 06eabdcd14076c3938ce518a947dac27dd8cf0109fd7516248aea822da97c7d0b8ea4a7710aca3c029836cc05e6ff5c92118aaf313d3168715f0b6b2c9f5e764
SSDEEP 49152:DQwQdQveK9jNyo7G+AWZvs3q+0drCGCdIhxJr:kQvb9MMu6XRWIXp
TLSH
T12CC502A5B999C831FC1F513459E2C4727C3585CAC986708ED69C039F9EEA8681F03B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfbox-2.0.19.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033255-3-app\pdfbox-2.0.19.jar.p2
Size 2.9MB
SHA256 7ae50f66e2e47552721b9a04d4ec76fad05ceb7c033987ccde1407f82768e338
MD5 8d2c514d341bed4db12aa51cdae10744
SHA1 962bba27490a77a473b4811f49d1bddc67887817
SHA512 56496f4d6ae34eee2884060b9e146418a9309efe7790a782712147a468c9fef858064b6df60b3726e6992ff99c3da3e17549897a5ce1f0023f1056df4f3ea7ff
SSDEEP 24576:h5rsdELbNSD/Mu8LEsaw7VGo8T0QS/+1hrxK6nZTMgjm0RzBA5voV3:7rsgiMusEsaw58S/4HK6nagjmW+oV3
TLSH
T1D1E53998728AD505C503483680E3D79351D9F60B9AE3360FB8FC7BCBCAD6B11D25A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\MSVCR100.dll
Size 808KB
SHA256 b4bfa27f677295b00a1df9a7e14db4b75cac2dd41b898d4e9a378eccce3699f0
MD5 aed6d63cfa5a3ef7021af9c457fee994
SHA1 f6ad746ef520b03df6cf0f5a2512d0df964c4688
SHA512 5573b17eb19d13cc96df5d66ef60cc8ff98e1ac9d8582a870ed2befa28ee271fb41741a92aa703234150fceadf4a436d10b8a6518c1816d0c804eb1261650d2d
SSDEEP 24576:C5e4L1vwTowTWqwVeeK7R/myyKgn9IrzOI:C5e4LfUWqAacn9Y
TLSH
T1EC059D9536A907F6D177D53DC996D206F2B2741513315BEB01A08AAE2F23FE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\unpack200.exe
Size 195KB
SHA256 63f6352610d455ad5978e0d37f42a9d2f75bc092b4431d1f3cc0d5931d08152d
MD5 7e1051e9f1ed7a745c8f898e5e613cc6
SHA1 59cc4c4e86e57fc985f2f6d21a8cbc27370027db
SHA512 936e26cdd75ee13c3e9bc43b471a83126ce1737907b33cdd855d6a1818d686baa6c52dc55a208cda896cc753ff3e56447a3cef7382b64e5b13771c54ce30e37f
SSDEEP 3072:xAFlu97I7b6Cw94t0yoqIyqdYoNPyM/TBfxAqQNTwd+6Y7m9yd:xH97W6C64tthIks6GTBZAqQNTwd+nd
TLSH
T190147CA22BA011A2D9F68179D9C3C72BDBB63565037493CB50D883A21F036D46BB53FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\bin\windowslauncher.exe
Size 350KB
SHA256 c4c3a7458bd6e320a09e880954aeab965191954c028fbc5accadec4c5f4c01f6
MD5 4ce82fc3554d7325cfcb73d60bd9862c
SHA1 ef9e23450ce2b9615ddf203f4ed49c7abdeacce9
SHA512 2aaad32f7626a8b25896238879fc1980a4b6fe3731c7c7c401df8be7a6323df29e754821a5a37b0d28b5187924459e75dd32770d98a6d7bed3030598223efb54
SSDEEP 3072:Fxi+TpxEKLUwkjJvnWsv9rJuQgnTiAkLRccllDm9tZeYGlf:mESjMsVVuQgiPluWlf
TLSH
T1DC7437B672F230F5C7B6B23989920642A761B425032273CB167085354AF77EB6E397F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\charsets.jar
Size 2.9MB
SHA256 293da0fddf18e7ae4e1a30ce5703716a0005e9ff5dae3784d4ec7a80df8ae798
MD5 3a7e352203320cac070079f17bfc7880
SHA1 804bb8386d681024cc813aefaaaaabfd67fe126b
SHA512 48f416034addcbe4d6a6647e7eb083272c98c364808505eb527be2e88e5d1de3aa5f8daec7b83bb6211a51b18f9c29eecb719954abb33b1b1eb83c49d3d7e131
SSDEEP 49152:OJriCuz1nXhO7dAVZd1LRIAEpT4nvvnVlbI8ew:gridzNmiN6qn3VlbI4
TLSH
T131E5AFD344491E6FD20B52BF1B60EE0B770E78AA0907B240F9B95C19E95D72F68D2F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\charsets.jar.p2
Size 1022KB
SHA256 02f4bec339cf53d57a78912791fde50daef053954f7b5b933ff3050ad732ca19
MD5 a40d0e4736d9016b531cdc24d57f5905
SHA1 d3ee48936e12dbcbc206b18e0fe9acf219dde6dd
SHA512 4aa87a70a6f7bf5a56b5bba3885def6f4c620aa412b1abeafe8b129040d56ef53f4b3641788850e33c2bff430d9ce030815371e866a809a55ae8763449625039
SSDEEP 12288:h+BXim0XyhTMeRoqkobZ36qoRFsQn3cE1JrEU3s4F:hiym0eRog56Pn3HvF
TLSH
T1F42583037D6C3A64D61E6F714AB98F56933350183B970AEBDA186A18CEF31F35611BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\access-bridge-64.jar
Size 191KB
SHA256 4fc33f9a5e88bf83bf6d9484cef092c0ee81576728ecebc1445af78e065f2f3d
MD5 71a8be3a6f8deb227ef6afb1e8e28cc7
SHA1 308cd9127ac4ab2e4affc9a030afde5472f51e16
SHA512 bbb35fc2ca545a81f91b265a74cf784fb0664e5d105e6744e65eaeb64df35f64511df15a108f47924867212cbd1fbc185eaba3f72615e0f91300f359b282e345
SSDEEP 3072:kXJV63Upvho5UoBJR6PPm+q0He0KIzhLALYlT7q9JvllY:QJX8ain6Xm+g0KUdSCT7q9Jc
TLSH
T1CD145B03FE598467F90782B350A1EE527B486D7CD0A6937F4DD91A883652C0A0736FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\access-bridge-64.jar.p2
Size 67KB
SHA256 d8f89da65ce9b468422ac63572f5223feaab23fd31994062aea32ff51d72e32f
MD5 a52839b91db27e6904148affbf00c910
SHA1 eea0e11bb22933a3c3821ac502db59523401baea
SHA512 96df8aead702bec74f5a2bd63b792aca4ab61e1ae8c41f0e390d752d52ced3bab9779514dd424d36ae7d47ae73d92b157ddc3861345bb0c3d8d79b0b253dcb83
SSDEEP 1536:ZUsyQQIr6KznR0M/IEzKO9als9SgqBo6OjjYIKKuSWdddddKfaW3ttapIII3gA3Q:Hm4InulFNw
TLSH
T13763A456BF8B3112E69BA7721DF07640172CC354672F27B67F68962AC4D22D3422FC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\cldrdata.jar
Size 3.7MB
SHA256 19694ff19a6f89cf5fed5353457898e287ff2ea19bf314dd781fa812a665b0e5
MD5 8cb5ddb698558b042fc2711c69bd76da
SHA1 a4ec75a2b38c80508753e2e0d61785fdd64e3d4f
SHA512 9ef553cf38216cead747bceae4a62885418290e5ed529ae0aed1707794f7629ca14e7fde32592ddf565ed2a539d5aa64e16fc3d40a377bf7f371ca4613c4a3e5
SSDEEP 98304:TKiFxbGv91qcqsFydXLCAPI5+0/whCbjB0pHna5j98bkpp:1FxbGS5N/0/jSp65Jz
TLSH
T1960602D2BDB94432C27398F60420C513B509C19DF056949BDAF84A8A2AF5FD6E343EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\cldrdata.jar.p2
Size 3.9MB
SHA256 dd4745f9b2e9bb0be9dd7456f0409e7cbb2ebf32799c5c582d5f1d151eca9fe2
MD5 94d9c1d8b6039010549463091e3f0da1
SHA1 d9bebd56141e61567d32ca1c044d2a88f8e8febf
SHA512 b9b0cbd0353c8f1f9eae682cbdfc8116289b35f7b7108d977779b81b91f2373f758e89694ded895d6d6901de585f8627916d07f13a74292002f67ae79b27fee3
SSDEEP 49152:zwSOi8bdfSAY3YQMhHBUmrMSHQnKH1WsE:+fbd6AY+Bzr3HeR
TLSH
T15D161E9365CBBA4BA3D01F285B724268153FE65801A77F18F161B3FCEB72163EE91424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\jaccess.jar
Size 42KB
SHA256 f974270dae89a778068545aeac1d08e4f365491f71e51786aad201360aa5bb19
MD5 3d3d4fbe856f6f24eb4a05043629100b
SHA1 83db2742d1b33527287dbe3abb86804f73ab3f31
SHA512 782ea6c705d2095b259eaa81c3e0ac1e0d13a58d4ed1d30fe31a8b5df92a1800d452bf37a64e75e2a31691a4a9df7605fcf3748d41614a53e4142228f41ee7ac
SSDEEP 768:B+hKlewenw5eLrCj5mcLAr/vJ9zCBxAIjlJsH1jmQmSM:NQweenLAjJ9WBxA4VxV
TLSH
T19613BF576F14903BE712F2F3C226EB45B604AAB4C17640AE1D980D8937A1C4B4766EFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\jaccess.jar.p2
Size 35KB
SHA256 14cfd2b22dec236d5f4414b0516dd237539e3740d284413adf4a68273d776dee
MD5 e86163108a0a136ee2247c8c3eedf038
SHA1 699c17815adc3f5599b0367365615a9013677728
SHA512 f8aa141ea4a806aade3f37740304ee753e1aa876bf756773a1293af774f7c7f40c9eca03aa95d82a66890442d586fb54572b774150f915a0d1d76723e4ee07e7
SSDEEP 384:3+eNocIxRNMNo8CDYhYUZ1d3Vh6yDZvi7dmXypppppppppppppppppYppppppppR:pN3IxRGND1hZ1d3Oamdm9hKa5
TLSH
T163F272062747F226C3D8FE3EABFD4249427096C8B71F28966F905058EE978C7290DD8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\sunmscapi.jar
Size 31KB
SHA256 741ecd111ccfda89abe6950185720b8c6e0cbd9c48a4aa813eaace9eedb98739
MD5 8cfda80f6092a348434153bf8c861078
SHA1 d6fb67e571917cb3247c70bfacef54143c958b91
SHA512 b611215b0c43c4bb1ba143e0088353635bf669d920f1fd6d627c600501f336202d8f67fceebc7ab1347fd5f96885f42caa6ec70f2021c53ff20edce2524e130c
SSDEEP 768:C+LghJaxLlqgX8bQ/MbUtIkgHSzgTn2Bkxh/qIDCBLhUdyzdN77lNb1Zrn1pF+63:z0hJaRo1bQ/eUtIkgHSzgaBih/qU+Lhr
TLSH
T1D7E2AF97FD9EC0E8F007CAF78114B14A275C05788D92632A87E58A0EFE11D2717167EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\sunmscapi.jar.p2
Size 23KB
SHA256 2144c97f87a59a82b456ad5dbf643a919ac2ecbf3bad65b6951885e00868f049
MD5 172c7486ec0fe80c8b79cb46c67b775f
SHA1 21282fb0d88e7c3ffef59150b47eee662804f252
SHA512 d04fd010875289efcd03421e3c0b6addd650b785f693bdff02e4394897c5e9a7769217ef506a352c754f02e23ec56b8c43ab7814cb9d113f2b1428a075809d28
SSDEEP 384:vvI22iHBnpHW6wjF8xdvx1ZH6R1OVgX6gljVaHaHmHMcH4HDHQH7HgrHKHzHgHIl:vvI22iHBnpMjF8jnZHOOaKgljIHaHmHJ
TLSH
T176B22A53F61E40E0F1C515FA60FA2146573CAAD2EE130B3A5E88426CF981BB787751F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\sunpkcs11.jar
Size 238KB
SHA256 931ef9cd86cb8dad75b5c5b897a28cc50ab2c8594aa688e2a3f7fdc5e792e141
MD5 f0e38530f8daf9a35318042ffc734bf8
SHA1 0cb05e2bbe37ef9eba163bbeec512132adb56cc4
SHA512 cb5649aa16da09a7a9cf4243cbc1877efd636239dbb6cdff444453a85dc144bc009424b27c5389453c3f9f37b4caf80f400d9c68f84d86e60ad28a3fa11f4753
SSDEEP 6144:qVtYGKQoqtk8x7fe3Z62eBGvgrLQexkSXtBRCxRFhB:P8f28x7fuZ6LBmgrTCSDUxhB
TLSH
T19934F186BCAC987DE52361BFCD209246A61C0A2EC207E17F0565850DB17987A07F7FF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\ext\sunpkcs11.jar.p2
Size 165KB
SHA256 faae5c01233308fc9b1dc81fc21d1f00abd3f9e64000272220ff51524495e43d
MD5 f63fe532d16529ff2a9c29895811f722
SHA1 fd0355837f4f35fff61ac8e868ba4cd5af8cb548
SHA512 c2447dd74396560476412d3c904dafac725adae832937ce8e82af753f2e1973230fb007fc8835d13db96d2d873351bd995fcfc9085e7181d9f7f85401222e225
SSDEEP 1536:/t1+/OCxJoKJHVFfuWtnewck+ECkpleybjWehUXykhvFokdAtjd8Eli0OGJgZfTp:/vGVvFfj49HSeybaSUXykxFlCtjdZ5qz
TLSH
T16AF35C03B20E34A1D9D227BB9DA44259123CE48D8F770B5A6DCC45ACF6461B38A73FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\jsse.jar
Size 657KB
SHA256 f0e62b5e2e7cce1142d2d92796e4f72ebeef5b48619d38b3119a07215fa65157
MD5 d755e0c6cb12459514483b46ed2f8450
SHA1 9a11c48ea3ed6c6aae204189bf1ae3a7008f02da
SHA512 edbaf4833acbeee0ca8c8b9e1e76c7478097cf0bb611885e64659ef5837b61e87250c3cf21566271e7b9098ee9db9b3023d2eb445890a24eea8f75cada9b8700
SSDEEP 6144:866t8vo2BJJHgi0HnPD9L9xH2xJaWYwWHmllrvNvYJAlvO6H+dWefJ4+F:EYAnV20woyDvThg
TLSH
T1B7E4C517E20D55BFF284EAFF9871432C23346C325963E3794E49492AF9C65F14AB0AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\jsse.jar.p2
Size 187KB
SHA256 34ea8e6503dca372934b0f919d605c166f9a2927b2f9e7a4ec1bc1cbaaff1aec
MD5 7063c170a35de18153b4a3cc051896fe
SHA1 704454a9b40a71ff2e7095c274208a19853088a4
SHA512 8993409a67ab94438e520cba43481882cb20b59a668a4adf90ff618816186a3c418badc0d6d3decc0b61bdfb81d44d360c97d3bfc52c85397920c11653a61367
SSDEEP 3072:Y/p7a7115iTgupo2Ap5queewfAaFGCCCCbIP/6wEkOottm1:Y/Za71jiTguO2Axeew4CPrLPm1
TLSH
T1E3147C077F0A2446E3E53A73A0F57AAA9338D108363707676F4A15A8CD875E38B1EDD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777033260-5-app\lib\rt.jar.p2
Size 15.6MB
SHA256 6017f2034ca6a1b30d995181f0ea836eb51eebe9bdaddfd27d95f5122978c3ed
MD5 7237793709def0be4fbdf87c8d5e669b
SHA1 23c443e48fee5f1d2387689439b154eca1e012e3
SHA512 65b3402416658ab310f439d1bca8a66fe222f7b6dfee7e7d721e98e237c1111154c85b1498a54ee1c8845352fd1f2c1ed38b5c2d35a0827dc9b3819e6505b891
SSDEEP 196608:KLUfAMux5WAA4DAVQ83sgMT2RUv+piP8jE7AU:CX5WAA4DAVQ83sgMT22RPqU
TLSH
T1A2F66D07B54F758AE2901F3140B2265E123AE2082B372B577E1C67B8DD43297BE17F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 538KB
SHA256 6da0691e19faa283d291bbe99af654fec4f7db3f05f68e308bc33637b2091a41
MD5 133bbd5f859abad6d15b77fd188aca40
SHA1 151eea6d83e2bfafdeb4226d229f5bb86f29d372
SHA512 6d2cd3aeacae1262bfcc6c2e9fa5da7adf5a15281d5f78338e46c51e3288459ec3c33d0c5b3cc722ec139b4ce13abed9bd4c161d937abf1232fd56221dec44d5
SSDEEP 6144:3PWh3m0k3YfHbPr+t/LRMGxrICk+zwYOLdcHGJTgUA:fR0BqpRMGur8wt5Tgb
TLSH
T1C3C4D924B6E19DB9DF276AFCE04E88EB5A5FC9E303C5002327F186E5CA602D5841ED5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-786-0x0000000000B90000-0x0000000000C0B000-memory.dmp

Download

memory/1076-1073-0x00000000008A0000-0x000000000091B000-memory.dmp

Download

memory/1288-772-0x0000000000980000-0x00000000009FB000-memory.dmp

Download

memory/1584-775-0x00000000009A0000-0x0000000000A1B000-memory.dmp

Download

memory/1808-1104-0x0000000000860000-0x00000000008DB000-memory.dmp

Download

memory/2380-977-0x000001A1A4790000-0x000001A1A483F000-memory.dmp

Download

memory/2648-664-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/2648-563-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/2648-713-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/2648-590-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/2648-373-0x0000000002170000-0x000000000221F000-memory.dmp

Download

memory/2648-576-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/2648-570-0x0000000003080000-0x00000000030B2000-memory.dmp

Download

memory/2648-721-0x0000000002170000-0x000000000221F000-memory.dmp

Download

memory/2868-660-0x0000000014450000-0x0000000014482000-memory.dmp

Download

memory/2868-655-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3960-1012-0x0000000000980000-0x00000000009FB000-memory.dmp

Download

memory/4020-1037-0x0000000000860000-0x00000000008DB000-memory.dmp

Download

memory/4516-736-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4516-782-0x00000000145B0000-0x00000000145BC000-memory.dmp

Download

memory/4516-783-0x00000000154A0000-0x000000001554F000-memory.dmp

Download

memory/4516-725-0x0000000014560000-0x0000000014592000-memory.dmp

Download

memory/4516-753-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4516-777-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4516-719-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4516-767-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4800-948-0x000001ED4B820000-0x000001ED4B8CF000-memory.dmp

Download

memory/4816-807-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-993-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-864-0x00000000132C0000-0x00000000132F2000-memory.dmp

Download

memory/4816-862-0x0000000013250000-0x000000001326A000-memory.dmp

Download

memory/4816-878-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-854-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-846-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-907-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-928-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-946-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-842-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-840-0x0000000013180000-0x00000000131B2000-memory.dmp

Download

memory/4816-836-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-972-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-976-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-978-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-830-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-987-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-990-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-865-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1007-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1010-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-817-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1013-0x0000000013660000-0x000000001366C000-memory.dmp

Download

memory/4816-1014-0x0000000016520000-0x00000000165CF000-memory.dmp

Download

memory/4816-1022-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-811-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1039-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1038-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1044-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-802-0x0000000013100000-0x0000000013132000-memory.dmp

Download

memory/4816-1074-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1075-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-796-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1105-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1106-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/4816-1108-0x0000000000850000-0x0000000000851000-memory.dmp

Download