c544e0e555f6bffcc230adc2ba5b3f6b3e95700d85e532304d54d1acf8fc776e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GoogleMeet.exe
Size 1.6MB
Sample260505-g2dkcahs3t
SHA256 c544e0e555f6bffcc230adc2ba5b3f6b3e95700d85e532304d54d1acf8fc776e
MD5 c5d54cee07cc50888ba66019499731ca
SHA1 8d5d3e7a651773fdb23d8617feb1a0ed9e845d5d
SHA512 95d5a95afc5a541e06701ad037f9b6cce747eb304f5814ceaaed57673bb5f9abb2498411f22f95cacb0ac0e115963b1c5adc0c05867965f8b3e35bdce6ac887d
SSDEEP 49152:MOlCQ8msodjHF2bg2h0kSKX15dIpRkud5ou/btP:PXJrVRR75ou/Z
TLSH
T12285C034E6A15DBDCF37AAFCD08E44DB979BB9A203C5012717F086D68B613D0542EE29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 5 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2432	netsh.exe
2116	netsh.exe
6124	netsh.exe
1700	netsh.exe
704	netsh.exe

Executes dropped EXE 23 IoCs

pid	Process
788	unpack200.exe
2176	unpack200.exe
3124	unpack200.exe
4676	unpack200.exe
3892	unpack200.exe
2340	unpack200.exe
4784	unpack200.exe
2924	unpack200.exe
1856	windowslauncher.exe
3180	Remote AccessECompatibility.exe
6132	Remote AccessLauncher.exe
3880	Remote Access.exe
3992	SimpleService.exe
992	SimpleService.exe
2656	SimpleService.exe
3672	Remote Access Service.exe
3316	Remote Access.exe
4032	session_win.exe
4980	elev_win.exe
2480	session_win.exe
4572	elev_win.exe
5068	session_win.exe
3040	elev_win.exe

Loads dropped DLL 60 IoCs

pid	Process
788	unpack200.exe
2176	unpack200.exe
3124	unpack200.exe
4676	unpack200.exe
3892	unpack200.exe
2340	unpack200.exe
4784	unpack200.exe
2924	unpack200.exe
3660	GoogleMeet.exe
3660	GoogleMeet.exe
3660	GoogleMeet.exe
3660	GoogleMeet.exe
3660	GoogleMeet.exe
3660	GoogleMeet.exe
3660	GoogleMeet.exe
3660	GoogleMeet.exe
3660	GoogleMeet.exe
3660	GoogleMeet.exe
3180	Remote AccessECompatibility.exe
3180	Remote AccessECompatibility.exe
3180	Remote AccessECompatibility.exe
3180	Remote AccessECompatibility.exe
3180	Remote AccessECompatibility.exe
3180	Remote AccessECompatibility.exe
3180	Remote AccessECompatibility.exe
6132	Remote AccessLauncher.exe
6132	Remote AccessLauncher.exe
6132	Remote AccessLauncher.exe
6132	Remote AccessLauncher.exe
6132	Remote AccessLauncher.exe
6132	Remote AccessLauncher.exe
6132	Remote AccessLauncher.exe
3880	Remote Access.exe
3880	Remote Access.exe
3880	Remote Access.exe
3880	Remote Access.exe
3880	Remote Access.exe
3880	Remote Access.exe
3880	Remote Access.exe
3880	Remote Access.exe
3880	Remote Access.exe
3880	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe
3316	Remote Access.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\2343073371\1776990036.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1831202810\3454929439.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4062111013\3757326595.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3766950118\3050888393.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3559780703\11435939.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4052159476\3764564809.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2878548818\4134879029.pri	netsh.exe
File created	C:\Windows\rescache\_merged\718100698\435624895.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3989159129\4000623192.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2879188468\1156155534.pri	netsh.exe
File created	C:\Windows\rescache\_merged\566188972\1997062367.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1388509667\3137753712.pri	netsh.exe
File created	C:\Windows\rescache\_merged\98783150\3544888228.pri	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Access Service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39\a01460c8\@{MicrosoftWindows.Client.CBS_1000.22000.493.0_x64__cw5n1h2txyewy?ms-resource:// = "Windows Feature Experience Pack"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-37302 = "mDNS"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@sstpsvc.dll,-35001 = "Secure Socket Tunneling Protocol"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2\a01460c8\@{Microsoft.AccountsControl_10.0.22000.1_neutral__cw5n1h2txyewy?ms-resource://Micr = "Email and accounts"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d75a031035819f	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8\@{Microsoft.Windows.ParentalControls_1000.22000.1.0_neutral_neutral_cw5n1h2txyewy?ms-resourc = "Microsoft family features"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9000 = "BranchCache - Content Retrieval (Uses HTTP)"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@wlansvc.dll,-36864 = "WLAN Service - WFD Application Services Platform Coordination Protocol (Uses UDP)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77\a01460c8\@{Microsoft.Windows.PeopleExperienceHost_10.0.22000.1_neutral_neutral_ = "Windows Shell Experience"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870\a01460c8\@{Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy?ms-re = "Work or school account"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d75a03dcbf1be\a01460c8\@{Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutr = "Captive Portal Flow"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6\a01460c8\@{Microsoft.Windows.CloudExperienceHost_10.0.22000.1_neutral_neutral_c = "Your account"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri\1d75a02fec917bd\a01460c8\@{Microsoft.Windows.ContentDeliveryManager_10.0.22000.1_neutral_neu = "Microsoft Content"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9002 = "BranchCache - Hosted Cache Server (Uses HTTPS)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68\a01460c8\@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resour = "Desktop App Web Viewer"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-53500 = "Recommended Troubleshooting"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d75a031035819f\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a\a01460c8\@{Microsoft.Windows.SecureAssessmentBrowser_10.0.22000.1_neutral_n = "Take a Test"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri\1d75a02fec917bd	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9003 = "BranchCache - Hosted Cache Client (Uses HTTPS)"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@wifidisplay.dll,-100 = "Wireless Display"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4032	session_win.exe
4032	session_win.exe
2480	session_win.exe
2480	session_win.exe
5068	session_win.exe
5068	session_win.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3660	GoogleMeet.exe
3880	Remote Access.exe
3316	Remote Access.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 788	3660	GoogleMeet.exe	80
PID 3660 wrote to memory of 2176	3660	GoogleMeet.exe	81
PID 3660 wrote to memory of 3124	3660	GoogleMeet.exe	82
PID 3660 wrote to memory of 4676	3660	GoogleMeet.exe	83
PID 3660 wrote to memory of 3892	3660	GoogleMeet.exe	84
PID 3660 wrote to memory of 2340	3660	GoogleMeet.exe	85
PID 3660 wrote to memory of 4784	3660	GoogleMeet.exe	86
PID 3660 wrote to memory of 2924	3660	GoogleMeet.exe	87
PID 3660 wrote to memory of 1856	3660	GoogleMeet.exe	88
PID 3660 wrote to memory of 2984	3660	GoogleMeet.exe	89
PID 3660 wrote to memory of 5636	3660	GoogleMeet.exe	91
PID 3660 wrote to memory of 4364	3660	GoogleMeet.exe	93
PID 3660 wrote to memory of 4228	3660	GoogleMeet.exe	94
PID 3660 wrote to memory of 1664	3660	GoogleMeet.exe	97
PID 3660 wrote to memory of 5548	3660	GoogleMeet.exe	99
PID 3660 wrote to memory of 3180	3660	GoogleMeet.exe	101
PID 3180 wrote to memory of 2460	3180	Remote AccessECompatibility.exe	102
PID 3660 wrote to memory of 3092	3660	GoogleMeet.exe	104
PID 3660 wrote to memory of 4744	3660	GoogleMeet.exe	105
PID 3660 wrote to memory of 6132	3660	GoogleMeet.exe	107
PID 6132 wrote to memory of 4048	6132	Remote AccessLauncher.exe	109
PID 3660 wrote to memory of 5816	3660	GoogleMeet.exe	111
PID 3660 wrote to memory of 5920	3660	GoogleMeet.exe	112
PID 3660 wrote to memory of 5304	3660	GoogleMeet.exe	113
PID 3660 wrote to memory of 3312	3660	GoogleMeet.exe	115
PID 3660 wrote to memory of 1720	3660	GoogleMeet.exe	117
PID 3660 wrote to memory of 3880	3660	GoogleMeet.exe	121
PID 3880 wrote to memory of 2708	3880	Remote Access.exe	122
PID 3880 wrote to memory of 5736	3880	Remote Access.exe	124
PID 3880 wrote to memory of 1832	3880	Remote Access.exe	126
PID 3880 wrote to memory of 1860	3880	Remote Access.exe	128
PID 3880 wrote to memory of 1584	3880	Remote Access.exe	129
PID 3880 wrote to memory of 736	3880	Remote Access.exe	132
PID 3880 wrote to memory of 5964	3880	Remote Access.exe	133
PID 3880 wrote to memory of 3992	3880	Remote Access.exe	136
PID 3880 wrote to memory of 992	3880	Remote Access.exe	137
PID 2656 wrote to memory of 3672	2656	SimpleService.exe	139
PID 3672 wrote to memory of 3316	3672	Remote Access Service.exe	140
PID 3316 wrote to memory of 3484	3316	Remote Access.exe	141
PID 3316 wrote to memory of 2316	3316	Remote Access.exe	143
PID 3316 wrote to memory of 2392	3316	Remote Access.exe	145
PID 3316 wrote to memory of 656	3316	Remote Access.exe	146
PID 3316 wrote to memory of 6140	3316	Remote Access.exe	148
PID 3316 wrote to memory of 1128	3316	Remote Access.exe	151
PID 3316 wrote to memory of 6124	3316	Remote Access.exe	153
PID 3316 wrote to memory of 4624	3316	Remote Access.exe	155
PID 3316 wrote to memory of 1700	3316	Remote Access.exe	158
PID 3316 wrote to memory of 704	3316	Remote Access.exe	160
PID 3316 wrote to memory of 2432	3316	Remote Access.exe	162
PID 3316 wrote to memory of 2116	3316	Remote Access.exe	164
PID 3316 wrote to memory of 6116	3316	Remote Access.exe	166
PID 3316 wrote to memory of 3092	3316	Remote Access.exe	168
PID 3316 wrote to memory of 4032	3316	Remote Access.exe	170
PID 4032 wrote to memory of 4980	4032	session_win.exe	171
PID 3316 wrote to memory of 2480	3316	Remote Access.exe	172
PID 2480 wrote to memory of 4572	2480	session_win.exe	173
PID 3316 wrote to memory of 5068	3316	Remote Access.exe	174
PID 5068 wrote to memory of 3040	5068	session_win.exe	175

C:\Users\Admin\AppData\Local\Temp\GoogleMeet.exe
"C:\Users\Admin\AppData\Local\Temp\GoogleMeet.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\charsets.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\charsets.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:788
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\access-bridge-64.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\access-bridge-64.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2176
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\cldrdata.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\cldrdata.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3124
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\jaccess.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4676
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\sunmscapi.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3892
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\sunpkcs11.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\sunpkcs11.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2340
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\jsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4784
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2924
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\windowslauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\windowslauncher.exe" "-Xshare:dump"
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
  2⤵
  PID:2984
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
  2⤵
  PID:5636
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
  2⤵
  PID:4364
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
  2⤵
  PID:4228
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5" /t /e /p "Users":R
  2⤵
  PID:1664
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\unrestricted" /e /g "Users":F
  2⤵
  PID:5548
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessECompatibility.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessECompatibility.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\unrestricted\JWLaunchProperties-1777962164410-0"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
    3⤵
    PID:2460
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
  2⤵
  PID:3092
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
  2⤵
  PID:4744
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\JWLaunchProperties-1777962165613-0"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
    3⤵
    PID:4048
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\ChosenLanguage" /e /g "Users":F
  2⤵
  PID:5816
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:5920
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:5304
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted" /e /g "Users":F
  2⤵
  PID:3312
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:1720
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\JWLaunchProperties-1777962166082-1"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
    3⤵
    PID:2708
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /e /p "Users":R
    3⤵
    PID:5736
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /e /g "Users":F
    3⤵
    PID:1832
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /e /p "Users":R
    3⤵
    PID:1860
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    PID:1584
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    PID:736
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted" /t /e /p "Users":R
    3⤵
    PID:5964
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3992
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    PID:992

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe" "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\JWLaunchProperties-4140675522-20"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
      4⤵
      PID:3484
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
      4⤵
      PID:2316
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:2392
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:656
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:6140
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
      4⤵
      PID:1128
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Drops file in Windows directory
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:6124
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.lock" /t /e /g "Users":f
      4⤵
      PID:4624
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service" "description=Inbound rule for the Remote Access Service to facilitate access sessions" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1700
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Updater" "description=Inbound rule for the Remote Access Service updater" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessECompatibility.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:704
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Launcher" "description=Inbound rule for the launcher that can spawn the Remote Access Service" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2432
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:2116
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\SimpleHelp" /t /e /g "Users":f
      4⤵
      PID:6116
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\SimpleHelp\ElevateSH\*.*" /t /e /g "Users":f
      4⤵
      PID:3092
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4980
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:4572
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ProxyCredentials

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

SimpleService.exe

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
Size 94KB
SHA256 d3be3d6b69dd3ea3bc20d06eafc452b8810d7e58286bdbf21d194d0966f75f40
MD5 aa8bac20c523a9cd4ac3424655498d24
SHA1 e8ed0b823bc2484a80cb6d79423a204953dd0d55
SHA512 0d4dee182116e935e407eb3bef590490e718d54ccc9c12d6a94b823cbfdfec6101778f91ba7e229b7ffe9a828a90c1d13351058cf650ee189942df1e92aa85ae
SSDEEP 1536:CLbP7be/V/xaTIn5ei4dJe5xmtvgX93uSpp2ca9hXQetjiPWmV:RHj93uukbXQetjmh
TLSH
T11B93AE52B4D0C0B2C45641730985CB769B3EF8366F3A489377F81B9A9E622C55B3F28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secmsg-httpGVV164U68U109U204G8008.secmsg.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\secmsg\secmsg-httpGVV164U68U109U204G8008.secmsg.afos_complete
Size 146B
SHA256 20c613969631642961a1f79208169bba244e90488b53e1e5eb2f3f0c7279e3eb
MD5 ec457c2c27869e4f975de615cbe7fd3c
SHA1 24b8aea3c37b89e6bad7b2a43190f9b69f1e8804
SHA512 b032be0a09a2d1f833f4d8498a825996e2fbd9f21f10e4d3a313d664cf5d6f7ff838733fbadc832f0d54b34a3f836cf89e4c826a049f8750d17864d8e4536a2c
TLSH
T1E7C08C11847AC012694C8C01DAB64A839013B46086C33838C4AA8D482C0B30232EC020
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 372B
SHA256 ec4b6fbaaefffb5e600e515145baa6f48a2653954c78248b0e43759285db1856
MD5 e6e167fbaa72005d3da883c666169244
SHA1 2d1d57e3b8640a5364e1019efdaa6836c524b6ce
SHA512 a1fc03768c2d4c8289f7d687b2a4e323597353fe0578acf895d4d325f1d2846c597770a0d8ec3a1addb92dbba4dc078fe0b548d4b3a19a3233e41a34e42cd137
TLSH
T16FE068A6F0A2F1B7A2CC5307C832406C0B318A588B34085DFCD94194BE891643F0B8B0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 370B
SHA256 1b0945cd06924010521f6d48c5dd2721e704af4ddf7beadf8d25bd837e693ea4
MD5 1356e4541a7786545943e5f026abbc4d
SHA1 afe172b4decd7068197ff90517621ce4256a60bb
SHA512 3b0112800771846ccd9f1c3add02254ad957c7c1d48eb3ba1eece40ebb2e5212c94d6260dede008c6b786964492a354ff24db60b9118f637a930839d1e29bc46
TLSH
T182E068A1E0A2F1B7A2CD5307C83200AC0B318A188B74481AFCD94594FE891243F1B8B0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 508B
SHA256 3b4570c82e37d3ef7e8d977e3bb9ab38e637daac473696f8c56fde1a95e58a22
MD5 57005ff8ea381c52e404e6cd98f30e3a
SHA1 aefb58ce2fe7b35d4533aef3b5ffe634d71f739b
SHA512 80bba884dc63f3c70afa1a9722ca746c96cdd48af8ab0da88b540a53def32fcbc2c5534bd6c529b3fa6a5973f73edbe006eb0b9885e101b710ad29c85430b34c
TLSH
T103F05095F193F177A1DD534BC821417C07B5495486745C1ABC994654BE861547F098A0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceid.dat.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.dat.afos_complete
Size 16KB
SHA256 94fd3fe69603367ce134d55c1a610d14b8b18e72019d43a9bc9ce651f33edba1
MD5 ce2fc068a57fec189f6a6b04b52b42bc
SHA1 9e26522555d5bb41fbebbe86a0cffb5ce2857e01
SHA512 7c12f9ca74001a24bbf45c969bfef0e1271c9fdfc604b8bb4abbdee084ea414ce3d981e73de19ccf4bd20223fc84fbcf8fee28bb72b84e9c5179700871febf6e
SSDEEP 3:h5hMwDS6bvbcYfTT3wiyF9uA786dNd2c:xDS6DbcKAiy77rzkc
TLSH
T1C17212179503156BE67CF171C430B86271101386400D3C723646C0B383141402650572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JreNameOverride.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JreNameOverride.afos_complete
Size 13B
SHA256 e4c596fe101978f244b8f74be616d62bbaae083f881928da51255b0dba50d440
MD5 8199887131477d02232d372bc808cfd5
SHA1 c172ffd15c0fb02432429632272a066b8516e077
SHA512 8623a7e6bb4673572c47035280cecbf09d02a71de54f86a2a3376de080df33af8dbe0d2e5c460779a899ca3d51e5b4c7b1a264ed4089af40b05c187524606026
MD5 SHA1 SHA512

Submit Download

jwutils_win64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\jwutils_win64.dll
Size 184KB
SHA256 49c49b94e2a50b865f8a39eb8497bd97a9f3f4c585cd671f8c8fd2b05a24639a
MD5 e7a1e6e40b24adfea986efbcba166bcf
SHA1 f65b974bfaddf8df2e2f812cec31f0a793982ac7
SHA512 2d15c6e9cb3251d2823642319cc7e280c81b0a11cdd8bfea89f0506a3d8526c992e76ebd96cf6f8e33c5062f4f2e62dad3a900e3469938f5f7396caf94e6c1f9
SSDEEP 3072:aDPALDiICFHxb9Prh6Wm2Tv/dchUsZOqSc52ZK26yjdsBqpQ/YSPbR8za:4OGIy7Ru2sZO9cVcjGBJzPbRka
TLSH
T116045A96B29650F5D1BBD23CCAD24756FA7234144324A3CB16A48B792B73BE4B73D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun
Size 13B
SHA256 b435662a8343013250a29d15572be686d2b925cbb3f5f6dd1028e1bc7d509d04
MD5 17cd1f8e25e75b418ba4a1576085b0b3
SHA1 eb3cbf9489cea6b572729662831777fb54ea61ce
SHA512 bf651d8e28757e9e153e004632bdcf112d0c549a7de93e80f6f66e2440a8a7ff7171634f86db710632012c774de7fd3b4c5364fbb5ba0a17cd2c2b95d37c1b51
MD5 SHA1 SHA512

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun
Size 13B
SHA256 eec3ff9e6e341247c94ecc5338147d424de50cbd3ecf47421b2e615dee126b08
MD5 6a111cd0d6093ddd3489aa6053eeb6fb
SHA1 c21742fe208ac9105c2eef94e03c79cba647fa55
SHA512 0b4e39bbca71bf39e20046c20bc6d622f533faa622e8accded5357603fbdaa6290538c9ab6d981c70cf26fed4590a754755e3e60fe54294180f9966fab7f28ec
MD5 SHA1 SHA512

Submit Download

java.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\java.dll
Size 157KB
SHA256 5f77d3d190d3cb4ebb9b4f47aefe826bf6e15f383d6822e1a25a5729227ebf26
MD5 2b3f3da6a443e6be107e61628d220692
SHA1 c90416d47e8689e1338e71bb46946f7e67607fb3
SHA512 c6dcde0e83932506b5d18aa802e2747a4dd6fa9848a424a1d2db1a527b98b7676af67673d40e1a0e9b7f9bc9eecd88380273eb3d29169d681a4fd02324f6b6db
SSDEEP 3072:GwLr0BaOH91zgqMVasnXkI/M5WMsInVSVgcJj0mUgq:eTdGDVbUmYH97
TLSH
T1E9F3280B625640A7F89775B8B0166003E3B67468023D836F47E18B8E9FBF761BD97781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\net.dll
Size 95KB
SHA256 7181c21fa655d389d85c5cdb06c6b4359cde93e47c13269e09bfc5e87fb3cb39
MD5 dd7bf43cab35a227017af46a182c3b9f
SHA1 20cdb203f339d5ef8e80504276a9bf2051fe4342
SHA512 7f34126f121a3057b9d78120a5b8e82dc4a7f285662c0dc526fcc06a547176b66720179c4f41384f5073680d34f99d46020a23a77c2622abc0445ad08cd20d31
SSDEEP 1536:xxhrMqB0lDHzB047E3PkQKJxEFASBeU84qTRGSGkyepGi8Ljo+svghO:LhrSDF0v3PkQKXEFAhUqLrpTgls9
TLSH
T1D9932A08636860D5F877E1FCC2868607D7B3B0706620579F13A2C99B6FDBB617E19B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\server\jvm.dll
Size 8.4MB
SHA256 13b6c6c5c3d0f90588c6d16a2c00436dcf08044b0150a3cd71a15ee69472a6ff
MD5 be7b903d854715572c1c180344f913be
SHA1 7b2ebe4bfa6e3f2ee62e91cabd41636a56f9b77a
SHA512 af2d38a7ffc0f10e0b12cd108ae3a7054334cd4a84cd76095f00c4b28de431b94feec6e3c44e95c514f114855c209f42d58fb683f1eb246b2e2ec14538d6ce5a
SSDEEP 98304:9s4/l53KnlrNX3sEeylN951rtdsotEef3PpecH7ZL1Uk:9Z/l53Knlrt3sEeylP51rt+otEs3PzF
TLSH
T11F965A5762F000AAE9BEC278CE57E617D7F3785843319BCB66A017950B13FE52A7B210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack.dll
Size 78KB
SHA256 8fc62a178716876688c7895e73f21cf9eff99597a180e671c7beb8c8c0b7cb59
MD5 a6ea27289674ff3b3261205163c4df8a
SHA1 ea4a232f7a4d488c3421f106e0981fc87c893ce7
SHA512 d57afa255f3306c579ac1b37b713e67d15ff626ea5323071d55d02a8dfdeed0eaff03a6f5771499218d87ca1b7d27bca024f90de378814df4915181a18dfde1c
SSDEEP 1536:gomjjzWtEoTtq9rMDtmynJmQmcNzQZ+Ne5U0hEQp3hlH:goizpow9rMDQynJPNzQZ+NuU0hEQ1H
TLSH
T1B4834AA323A05071D0D7817AE8D7DA27DBFAB8B50238878F40E587B72F173814E95366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\verify.dll
Size 48KB
SHA256 7e239d228728ffacdd098196b61e954d3af7da83b9359920934330be5866ba5f
MD5 68643834b2e8b5dd58d505c0c470bb56
SHA1 2bb2db6f7ad5029e7b978c52417ea4e3053b4c23
SHA512 7674228fb64d34ea563776c5d3a5e5a052da8a1089325e981421b8ea5e5eaaf96a38f837557885e859f4c79cb1d26e82e5620c3c98505654d49f09ee2158d2d3
SSDEEP 768:OYkpGTievAR+x/Olkj1ZyiQLdYn+KP1aU19pEiOTD6EB+w4vZij+ess3hDN:KELxRn3HfpEX63rvZZe/3hDN
TLSH
T173236B6362A86875E8C39074C697EFC7DAB1F8ED0354D18F14E4960EAF4BB512BD820D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\zip.dll
Size 77KB
SHA256 49be17444b2612bde91d0f59aeaba2ef2deb14a12baa9b90a36d1ad87f9fef4b
MD5 bcc302e0d9f6bdb71cd5cf2f846a5e76
SHA1 b9c5f74430541d08f2a99d82633c7c81530f101a
SHA512 fed292db9cc2aa4c9a9528aac676a96ed48b30dc4ae9df4113670b8b1cec59b52a28f033bbce53787aa6d168c72e2826d2e7b9df670884b96629fa6def0b681b
SSDEEP 1536:ZRUGiGvAKb3shmHisnmjx++8o9IOQIO+VnToIfYt74s3h0Ou:ZRUcvTsc3JPo3G+9TBfYt747Ou
TLSH
T1A8738C994AE091A1FAF651B4C4E68B2FC772716052D4939F529C93922F433A23F483FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\MSVCR100.dll
Size 808KB
SHA256 b4bfa27f677295b00a1df9a7e14db4b75cac2dd41b898d4e9a378eccce3699f0
MD5 aed6d63cfa5a3ef7021af9c457fee994
SHA1 f6ad746ef520b03df6cf0f5a2512d0df964c4688
SHA512 5573b17eb19d13cc96df5d66ef60cc8ff98e1ac9d8582a870ed2befa28ee271fb41741a92aa703234150fceadf4a436d10b8a6518c1816d0c804eb1261650d2d
SSDEEP 24576:C5e4L1vwTowTWqwVeeK7R/myyKgn9IrzOI:C5e4LfUWqAacn9Y
TLSH
T1EC059D9536A907F6D177D53DC996D206F2B2741513315BEB01A08AAE2F23FE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\unpack200.exe
Size 195KB
SHA256 63f6352610d455ad5978e0d37f42a9d2f75bc092b4431d1f3cc0d5931d08152d
MD5 7e1051e9f1ed7a745c8f898e5e613cc6
SHA1 59cc4c4e86e57fc985f2f6d21a8cbc27370027db
SHA512 936e26cdd75ee13c3e9bc43b471a83126ce1737907b33cdd855d6a1818d686baa6c52dc55a208cda896cc753ff3e56447a3cef7382b64e5b13771c54ce30e37f
SSDEEP 3072:xAFlu97I7b6Cw94t0yoqIyqdYoNPyM/TBfxAqQNTwd+6Y7m9yd:xH97W6C64tthIks6GTBZAqQNTwd+nd
TLSH
T190147CA22BA011A2D9F68179D9C3C72BDBB63565037493CB50D883A21F036D46BB53FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\bin\windowslauncher.exe
Size 350KB
SHA256 c4c3a7458bd6e320a09e880954aeab965191954c028fbc5accadec4c5f4c01f6
MD5 4ce82fc3554d7325cfcb73d60bd9862c
SHA1 ef9e23450ce2b9615ddf203f4ed49c7abdeacce9
SHA512 2aaad32f7626a8b25896238879fc1980a4b6fe3731c7c7c401df8be7a6323df29e754821a5a37b0d28b5187924459e75dd32770d98a6d7bed3030598223efb54
SSDEEP 3072:Fxi+TpxEKLUwkjJvnWsv9rJuQgnTiAkLRccllDm9tZeYGlf:mESjMsVVuQgiPluWlf
TLSH
T1DC7437B672F230F5C7B6B23989920642A761B425032273CB167085354AF77EB6E397F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\charsets.jar
Size 2.9MB
SHA256 293da0fddf18e7ae4e1a30ce5703716a0005e9ff5dae3784d4ec7a80df8ae798
MD5 3a7e352203320cac070079f17bfc7880
SHA1 804bb8386d681024cc813aefaaaaabfd67fe126b
SHA512 48f416034addcbe4d6a6647e7eb083272c98c364808505eb527be2e88e5d1de3aa5f8daec7b83bb6211a51b18f9c29eecb719954abb33b1b1eb83c49d3d7e131
SSDEEP 49152:OJriCuz1nXhO7dAVZd1LRIAEpT4nvvnVlbI8ew:gridzNmiN6qn3VlbI4
TLSH
T131E5AFD344491E6FD20B52BF1B60EE0B770E78AA0907B240F9B95C19E95D72F68D2F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\charsets.jar.p2
Size 1022KB
SHA256 02f4bec339cf53d57a78912791fde50daef053954f7b5b933ff3050ad732ca19
MD5 a40d0e4736d9016b531cdc24d57f5905
SHA1 d3ee48936e12dbcbc206b18e0fe9acf219dde6dd
SHA512 4aa87a70a6f7bf5a56b5bba3885def6f4c620aa412b1abeafe8b129040d56ef53f4b3641788850e33c2bff430d9ce030815371e866a809a55ae8763449625039
SSDEEP 12288:h+BXim0XyhTMeRoqkobZ36qoRFsQn3cE1JrEU3s4F:hiym0eRog56Pn3HvF
TLSH
T1F42583037D6C3A64D61E6F714AB98F56933350183B970AEBDA186A18CEF31F35611BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\access-bridge-64.jar
Size 191KB
SHA256 4fc33f9a5e88bf83bf6d9484cef092c0ee81576728ecebc1445af78e065f2f3d
MD5 71a8be3a6f8deb227ef6afb1e8e28cc7
SHA1 308cd9127ac4ab2e4affc9a030afde5472f51e16
SHA512 bbb35fc2ca545a81f91b265a74cf784fb0664e5d105e6744e65eaeb64df35f64511df15a108f47924867212cbd1fbc185eaba3f72615e0f91300f359b282e345
SSDEEP 3072:kXJV63Upvho5UoBJR6PPm+q0He0KIzhLALYlT7q9JvllY:QJX8ain6Xm+g0KUdSCT7q9Jc
TLSH
T1CD145B03FE598467F90782B350A1EE527B486D7CD0A6937F4DD91A883652C0A0736FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\access-bridge-64.jar.p2
Size 67KB
SHA256 d8f89da65ce9b468422ac63572f5223feaab23fd31994062aea32ff51d72e32f
MD5 a52839b91db27e6904148affbf00c910
SHA1 eea0e11bb22933a3c3821ac502db59523401baea
SHA512 96df8aead702bec74f5a2bd63b792aca4ab61e1ae8c41f0e390d752d52ced3bab9779514dd424d36ae7d47ae73d92b157ddc3861345bb0c3d8d79b0b253dcb83
SSDEEP 1536:ZUsyQQIr6KznR0M/IEzKO9als9SgqBo6OjjYIKKuSWdddddKfaW3ttapIII3gA3Q:Hm4InulFNw
TLSH
T13763A456BF8B3112E69BA7721DF07640172CC354672F27B67F68962AC4D22D3422FC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\cldrdata.jar
Size 3.7MB
SHA256 19694ff19a6f89cf5fed5353457898e287ff2ea19bf314dd781fa812a665b0e5
MD5 8cb5ddb698558b042fc2711c69bd76da
SHA1 a4ec75a2b38c80508753e2e0d61785fdd64e3d4f
SHA512 9ef553cf38216cead747bceae4a62885418290e5ed529ae0aed1707794f7629ca14e7fde32592ddf565ed2a539d5aa64e16fc3d40a377bf7f371ca4613c4a3e5
SSDEEP 98304:TKiFxbGv91qcqsFydXLCAPI5+0/whCbjB0pHna5j98bkpp:1FxbGS5N/0/jSp65Jz
TLSH
T1960602D2BDB94432C27398F60420C513B509C19DF056949BDAF84A8A2AF5FD6E343EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\cldrdata.jar.p2
Size 3.9MB
SHA256 dd4745f9b2e9bb0be9dd7456f0409e7cbb2ebf32799c5c582d5f1d151eca9fe2
MD5 94d9c1d8b6039010549463091e3f0da1
SHA1 d9bebd56141e61567d32ca1c044d2a88f8e8febf
SHA512 b9b0cbd0353c8f1f9eae682cbdfc8116289b35f7b7108d977779b81b91f2373f758e89694ded895d6d6901de585f8627916d07f13a74292002f67ae79b27fee3
SSDEEP 49152:zwSOi8bdfSAY3YQMhHBUmrMSHQnKH1WsE:+fbd6AY+Bzr3HeR
TLSH
T15D161E9365CBBA4BA3D01F285B724268153FE65801A77F18F161B3FCEB72163EE91424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\jaccess.jar
Size 42KB
SHA256 f974270dae89a778068545aeac1d08e4f365491f71e51786aad201360aa5bb19
MD5 3d3d4fbe856f6f24eb4a05043629100b
SHA1 83db2742d1b33527287dbe3abb86804f73ab3f31
SHA512 782ea6c705d2095b259eaa81c3e0ac1e0d13a58d4ed1d30fe31a8b5df92a1800d452bf37a64e75e2a31691a4a9df7605fcf3748d41614a53e4142228f41ee7ac
SSDEEP 768:B+hKlewenw5eLrCj5mcLAr/vJ9zCBxAIjlJsH1jmQmSM:NQweenLAjJ9WBxA4VxV
TLSH
T19613BF576F14903BE712F2F3C226EB45B604AAB4C17640AE1D980D8937A1C4B4766EFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\jaccess.jar.p2
Size 35KB
SHA256 14cfd2b22dec236d5f4414b0516dd237539e3740d284413adf4a68273d776dee
MD5 e86163108a0a136ee2247c8c3eedf038
SHA1 699c17815adc3f5599b0367365615a9013677728
SHA512 f8aa141ea4a806aade3f37740304ee753e1aa876bf756773a1293af774f7c7f40c9eca03aa95d82a66890442d586fb54572b774150f915a0d1d76723e4ee07e7
SSDEEP 384:3+eNocIxRNMNo8CDYhYUZ1d3Vh6yDZvi7dmXypppppppppppppppppYppppppppR:pN3IxRGND1hZ1d3Oamdm9hKa5
TLSH
T163F272062747F226C3D8FE3EABFD4249427096C8B71F28966F905058EE978C7290DD8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\sunmscapi.jar
Size 31KB
SHA256 741ecd111ccfda89abe6950185720b8c6e0cbd9c48a4aa813eaace9eedb98739
MD5 8cfda80f6092a348434153bf8c861078
SHA1 d6fb67e571917cb3247c70bfacef54143c958b91
SHA512 b611215b0c43c4bb1ba143e0088353635bf669d920f1fd6d627c600501f336202d8f67fceebc7ab1347fd5f96885f42caa6ec70f2021c53ff20edce2524e130c
SSDEEP 768:C+LghJaxLlqgX8bQ/MbUtIkgHSzgTn2Bkxh/qIDCBLhUdyzdN77lNb1Zrn1pF+63:z0hJaRo1bQ/eUtIkgHSzgaBih/qU+Lhr
TLSH
T1D7E2AF97FD9EC0E8F007CAF78114B14A275C05788D92632A87E58A0EFE11D2717167EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\sunmscapi.jar.p2
Size 23KB
SHA256 2144c97f87a59a82b456ad5dbf643a919ac2ecbf3bad65b6951885e00868f049
MD5 172c7486ec0fe80c8b79cb46c67b775f
SHA1 21282fb0d88e7c3ffef59150b47eee662804f252
SHA512 d04fd010875289efcd03421e3c0b6addd650b785f693bdff02e4394897c5e9a7769217ef506a352c754f02e23ec56b8c43ab7814cb9d113f2b1428a075809d28
SSDEEP 384:vvI22iHBnpHW6wjF8xdvx1ZH6R1OVgX6gljVaHaHmHMcH4HDHQH7HgrHKHzHgHIl:vvI22iHBnpMjF8jnZHOOaKgljIHaHmHJ
TLSH
T176B22A53F61E40E0F1C515FA60FA2146573CAAD2EE130B3A5E88426CF981BB787751F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\sunpkcs11.jar
Size 238KB
SHA256 931ef9cd86cb8dad75b5c5b897a28cc50ab2c8594aa688e2a3f7fdc5e792e141
MD5 f0e38530f8daf9a35318042ffc734bf8
SHA1 0cb05e2bbe37ef9eba163bbeec512132adb56cc4
SHA512 cb5649aa16da09a7a9cf4243cbc1877efd636239dbb6cdff444453a85dc144bc009424b27c5389453c3f9f37b4caf80f400d9c68f84d86e60ad28a3fa11f4753
SSDEEP 6144:qVtYGKQoqtk8x7fe3Z62eBGvgrLQexkSXtBRCxRFhB:P8f28x7fuZ6LBmgrTCSDUxhB
TLSH
T19934F186BCAC987DE52361BFCD209246A61C0A2EC207E17F0565850DB17987A07F7FF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\ext\sunpkcs11.jar.p2
Size 165KB
SHA256 faae5c01233308fc9b1dc81fc21d1f00abd3f9e64000272220ff51524495e43d
MD5 f63fe532d16529ff2a9c29895811f722
SHA1 fd0355837f4f35fff61ac8e868ba4cd5af8cb548
SHA512 c2447dd74396560476412d3c904dafac725adae832937ce8e82af753f2e1973230fb007fc8835d13db96d2d873351bd995fcfc9085e7181d9f7f85401222e225
SSDEEP 1536:/t1+/OCxJoKJHVFfuWtnewck+ECkpleybjWehUXykhvFokdAtjd8Eli0OGJgZfTp:/vGVvFfj49HSeybaSUXykxFlCtjdZ5qz
TLSH
T16AF35C03B20E34A1D9D227BB9DA44259123CE48D8F770B5A6DCC45ACF6461B38A73FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\jsse.jar
Size 657KB
SHA256 f0e62b5e2e7cce1142d2d92796e4f72ebeef5b48619d38b3119a07215fa65157
MD5 d755e0c6cb12459514483b46ed2f8450
SHA1 9a11c48ea3ed6c6aae204189bf1ae3a7008f02da
SHA512 edbaf4833acbeee0ca8c8b9e1e76c7478097cf0bb611885e64659ef5837b61e87250c3cf21566271e7b9098ee9db9b3023d2eb445890a24eea8f75cada9b8700
SSDEEP 6144:866t8vo2BJJHgi0HnPD9L9xH2xJaWYwWHmllrvNvYJAlvO6H+dWefJ4+F:EYAnV20woyDvThg
TLSH
T1B7E4C517E20D55BFF284EAFF9871432C23346C325963E3794E49492AF9C65F14AB0AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\jsse.jar.p2
Size 187KB
SHA256 34ea8e6503dca372934b0f919d605c166f9a2927b2f9e7a4ec1bc1cbaaff1aec
MD5 7063c170a35de18153b4a3cc051896fe
SHA1 704454a9b40a71ff2e7095c274208a19853088a4
SHA512 8993409a67ab94438e520cba43481882cb20b59a668a4adf90ff618816186a3c418badc0d6d3decc0b61bdfb81d44d360c97d3bfc52c85397920c11653a61367
SSDEEP 3072:Y/p7a7115iTgupo2Ap5queewfAaFGCCCCbIP/6wEkOottm1:Y/Za71jiTguO2Axeew4CPrLPm1
TLSH
T1E3147C077F0A2446E3E53A73A0F57AAA9338D108363707676F4A15A8CD875E38B1EDD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962154-4-app\lib\rt.jar.p2
Size 15.6MB
SHA256 6017f2034ca6a1b30d995181f0ea836eb51eebe9bdaddfd27d95f5122978c3ed
MD5 7237793709def0be4fbdf87c8d5e669b
SHA1 23c443e48fee5f1d2387689439b154eca1e012e3
SHA512 65b3402416658ab310f439d1bca8a66fe222f7b6dfee7e7d721e98e237c1111154c85b1498a54ee1c8845352fd1f2c1ed38b5c2d35a0827dc9b3819e6505b891
SSDEEP 196608:KLUfAMux5WAA4DAVQ83sgMT2RUv+piP8jE7AU:CX5WAA4DAVQ83sgMT22RPqU
TLSH
T1A2F66D07B54F758AE2901F3140B2265E123AE2082B372B577E1C67B8DD43297BE17F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppNote-JWrapperJreCompatibilityApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppNote-JWrapperJreCompatibilityApp
Size 19B
SHA256 bf6f11c195addbc386206c29d8f557d296e2e5fefaa129519ce75b4a4228be5f
MD5 42435eb08faee75ec8a791b9a233bd8b
SHA1 d462ca091139a2106e467c4a0fd33b4ee8ddac09
SHA512 e9b4aa8ee09a8c81746f3999e2003214952d3ba41b7e1afada9c6d9e2f1223a41af3212e9c44d42d394611ffeecf25ad0e9a8a2bb79999b1dc32ec55c9667fba
MD5 SHA1 SHA512

Submit Download

JWAppSpec-AutoTest

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-AutoTest
Size 35KB
SHA256 21bbb364194a9abc069fab1b4edfc6e0445f1004a127bfcb19b5e91083fbe3ef
MD5 180151b8d958e699cd22ce28f96faaae
SHA1 fc19531d8554a434b20051e3aca4c1bbd3521772
SHA512 c7c383a2fc31af55dcfd03b2ac6380169fc786a998d472f7ba919c55201cac925c58a809c395f771a1666e85e22aa5185ef18ca3a5a6a664180f94025afa8328
SSDEEP 384:b2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:bPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T104F2AD76BBF1BAD8CBB93676659D02850F3408621253FB3326746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-HeadlessTest

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-HeadlessTest
Size 35KB
SHA256 7acb3dc12e5f1ae773a5f076bb96a205f0e8a0a3b954452e69b318194c230793
MD5 d2b119431f84e94dd4f168b233063d31
SHA1 2cfde51dee9534ac1df8bfa39ea5efb990e5348c
SHA512 0f971ab3c75cfaedddcda44cdfc3c4a7b2b719f0277e7e6400e64cd2203e2e313162b31d603ae4b288f4d8730a047c7a677a92a508ca3e83f3b1716c16b5cef5
SSDEEP 384:y2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:yPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T1BDF2AD767BF1BAD8CBB93676659902850F7408621253FB3226746A7A7DD30C38A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapperJreCompatibilityApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-JWrapperJreCompatibilityApp
Size 35KB
SHA256 cdd4b60322387cfcb15b2761ad0af41212988e65586853f530008af850d70e26
MD5 1ff442165c8416a49bd42ccb129b7a09
SHA1 c0846c7ccbcb4023276646b429da3b9480b24d0e
SHA512 97361b47b5c5f5d59ec1c55ea475b349bb1655d39e07101ca06cfcda0331cfc99c98e611232fa4afdbc3cc2a701e28401d3754215b505c2fab1b9e7fe8b415ef
SSDEEP 384:dryaFx2yl9a8f0MQ8uK5UywnHr8nvC3M2q3eoIzPULDNXTOst5ZWg3eJEzWv382/:jFx2ylwMhfw48v5oa8vNnt5Zn3W0A
TLSH
T1D2F2BF52A743DBC4DC044C31A1281EAAB739ED9B769E523303A075094DEF4D38A7B67B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapperPostInstallApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-JWrapperPostInstallApp
Size 35KB
SHA256 fce347b5beaa1614b4ffd78f1d746609e58e8fab7a3ccfd89edcda956ea52073
MD5 7f6247db5928292d46fd2a142b327b00
SHA1 fddc577afae2222cf805db32b52ca046816454c1
SHA512 e96b4974a14a1abac5bc4cdac5db44d3a5b29dfbe77d3226aa0735cb07921448876062f5f6c820ab63c91d6584165eb896de65e31dc72811031c85d514720740
SSDEEP 384:E2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:EPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T12DF2AD76BBF1BAD8CBB93676659902850F3408621253FB3326746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapperPostUninstallApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-JWrapperPostUninstallApp
Size 35KB
SHA256 89682e1c52dbd417cd8a9dea51f5e96d9e17032a480477b7c5b0accb1a08c072
MD5 45d28ac79e0e256380f5aece6c15a1e9
SHA1 0bb6a88f57fc984aa3e8baaa6afc15c96968f4ba
SHA512 0e20934c2229406e10c39b66a80ceadfa67d507abea0d22beadd2227e870523da5204868a2abc1d3f7904c09b972563ec79e56c0ef3806e177b90562d708a293
SSDEEP 384:lO2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPy:wPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T199F2AD76BBF1BAD8CBB93676659D02850F3408621253FB3326746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapper_Service_Management_App

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-JWrapper_Service_Management_App
Size 98B
SHA256 d6d85963b3f1b78c47864d86bea785982f6d766da712dbf5331acea680231df5
MD5 0b1f8897cf02e7788537e2c2a1707c7d
SHA1 760fafb7fb7a463accdd43781d3f11f96e7fff3a
SHA512 a17226d6b969ab63c35e7af04153aaa4251180c34010ae68a3b41e6b5b4fcde12dd197a55e4f17dce9af656c288672dafe9f4eb410e3c935bb9291afd7452925
TLSH
T1E6B01128AAAEB0A0C08800BF2C0300000AA000BAC0ACB28C8AF0802E02E2C8C0308000
MD5 SHA1 SHA512 TLSH

Submit Download

JWAppSpec-Manage_Remote_Access_Service

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-Manage_Remote_Access_Service
Size 35KB
SHA256 72f3aadcd69843f51f9d492332fd5ad40a7bb329ccbcbb4f5ff6b8cce33bc590
MD5 2fb748d2198cecb34ee6afc16ae2e232
SHA1 ba6d2ce27f729b03f52deae52126faa8e66a2b87
SHA512 03824f3861dbc6836a395d978ad42b802563e4018de8e7d42c716d931d520f084b8a9f7babc7e4705182938f8a97428df2ce185e557a181e1796e5328e91f341
SSDEEP 384:S2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:SPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T14CF2AD767BF1BAD8CBB93676699902850F3408621253FB3326746A7A7DD30C34A529F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Configure

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-Remote_Access_Configure
Size 35KB
SHA256 eb088051e55be6d6577bd18c529a4331f5e279f78a770c647bb11639a272d1a8
MD5 0686e00a121e61a25e099ec91825fec4
SHA1 87a4355c1cbd69ca331b4a0be561d26a294f23c8
SHA512 2f067b472f295f6fce7415b99211ead5e6f87295b36e3a76fff61ed8890c397b2f3dda5769e439fcea4595d0c9d46f06ae9e8bcc4ecd769eca588d5ff441637e
SSDEEP 384:P2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:PPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T1E7F2AD76BBF1BAD8CBB9367665D902850F3408621253FB3326746A3A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Monitoring

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-Remote_Access_Monitoring
Size 35KB
SHA256 1def1b46e04da4f0af455c8a0c631450e5382acbfef2b0ae70d6299297042995
MD5 103ccad977c28885befa8a291650995a
SHA1 7db8aadf37de5d81c717db3a370bb5b246a1fa80
SHA512 14ecadf7bee0319cf8270a63c9a1b292d2b1f8060f25a586b3d5ef1876d9c49f3a849a007072020083a3532533cc34ba5913adc1316c7b5c5cb76d57fe5d9488
SSDEEP 384:v2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:vPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T12BF2AD76BBF1BAD8CBB9367665D902850F3408621253FB3226746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Restart

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-Remote_Access_Restart
Size 35KB
SHA256 486be79f05b5b37b5ec9fef78eeb552e18fb836cad069fead1ec54834864fc8f
MD5 ebf87930ff1d4339e4a50d45b1961c14
SHA1 6aae3a5451a9aa15febd36466737f4cbeb8a74f4
SHA512 f73326a681a1ac9b37fc514148b58f5747a57489eb9ae07b83570b1fc6e28ffe904b104feacd2ea05a924c4cb33f0611f6f2d81857c4b799eb17e7a3e5a8313b
SSDEEP 384:i2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:iPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T171F2AD76BBF1BAD8CBB93676659902850F3408621253FB3326746A7A7DD30C34A129F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Service

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-Remote_Access_Service
Size 35KB
SHA256 5a7a8412c3477f58c49b976325a2cbd4adeecdff72bc805d887c49c23119e5e3
MD5 cf2bf00f1cb0d433ba957004d9018bc6
SHA1 27026e5062cfbeff36b31f97f859665df2b6fcb1
SHA512 76b8b7761f1bd726fad572b59d55d6229befa3b68c0fcc11c9e7e4eb55bb5b07ba0f559f15ce529c66d9a2f2060e06e0cc51b1a1e86e41378de4717a5b592ea3
SSDEEP 384:M2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:MPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T12CF2AD76BBF1BAD8CBB9367665D902850F3408621253FB3326746A7A7DD30C34A529F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Session

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\JWAppSpec-Remote_Access_Session
Size 35KB
SHA256 d54427f655341f7df976c9b0183d6a50f1ec2a7639a3a1f1aa4d402a69263003
MD5 aea6a34adbb657db75e681daea01a024
SHA1 5e12f4beb0689b6fa60d06e197034a7d88a67b93
SHA512 5dc42f0df03e7536a08c36dcda04d064b93d03b7c1cf6d4efbe7e4a21e17db9345a0d47627a3f4caae9d75d1148052c3150e575a51d591d9c4bf8a0a313f4912
SSDEEP 384:M2sN86zrU5eOFgdeGZ21qRqJrLqBRKZOfh0NIqw8g5V6sf32RotjnnwhX+tqSPUl:MPe6Ig8wZ2/lARKssIx5/3E+jnwJ+sLl
TLSH
T140F2AD76BBF1BAD8CBB93676659D02850F3408621253FB3326746A7A7DD30C34A529F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\customer.jar
Size 16.4MB
SHA256 72c882d00a238df1b4b2f3a5026f780ab88129686ebbeb08ab718b15e690822a
MD5 12989e215d42d53a8d47206643a661dc
SHA1 01f53436ed70554811cec4b90f04c8234fc2ec0a
SHA512 06c265cc8ba38f747070cffd118c8d89ef953773bbd6cf3900a5b603b2c4a3ded3317d255bfe0ddc2eb19d81ff73836f36a5fa9631772db8573c0a979e0efe4d
SSDEEP 49152:fYvMdnX8N8ZBMhc9bz3RB/2CVWlgHS9if/vqmFt0Eu6OiGl3R1LrDtE2tVmxy/z4:fYdvhclPh5vKti2tVmxCBhhM2zsUE
TLSH
T1A0072A2BF3106E6FFB99D3BDB56183713AB068309283D161BFE958275ED61D88B442C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elev_mac

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\elev_mac
Size 71KB
SHA256 512236ac6593d422e98295b7d5055d3155cdf07d1abcc81b2ddbbb76add47b86
MD5 f572c88bf32fd38f8ea31d3d2dd8b2d1
SHA1 f421e4299ab2510e1ebb833d9a4bb728ff11c42b
SHA512 f904fa1d789640f3fb36d40c29705fc8e61ddfa67f16fa05b28019444c417a40b69039af68fd78a88dc1f4b9d1cf2c1a45ea8682eaf9365dc3a274cd4d23291c
SSDEEP 384:3LcLIHKIaDlUhsr+Q8Prt+XMKr4Nrq/rNab8erVHXI716s7KHxZXnGtr+Q8Prt+Q:3LHH/h28kMEab8QI7UbWz8kMDr2ab8i
TLSH
T1077339B24B486435DE8D95B013CE93E3DE32F3545F92021B6581C4E12FD3BB87A29A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elev_win.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\elev_win.exe
Size 84KB
SHA256 56215984cfd933d274d3a99be01503a7e5d2c2e909457a9a7a6aa224f14400fc
MD5 2caeb2d6a1648542f4a8f790bdf86efc
SHA1 7a5812d5f57d2bad267ec538fde66c078dc99bd8
SHA512 ab0e8e73d84f6316e2c287b50a9feeb6afd87f401d7a58b5d9a1a802c2e261b80229f900e9a50ec76fd7e9043a90360404d312a0109bfa0c4bdbb018b73f173c
SSDEEP 1536:iwQKJgsYhrA/sbV7dTM2yddlfKERzQuh0:iD0/mbklCExQuh0
TLSH
T1CE837D157D83D033E04504B6419CC7919BBF7C433BB6952BFB5C068B5BA32949BAA3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontbox-2.0.19.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1777962161754-5\fontbox-2.0.19.jar
Size 1.5MB
SHA256 e879372ee9a043774a0248e9fa61976ade727803136350633830f3d757cdb6fc
MD5 da7e494a9eb3f2f49475700ba42d98d6
SHA1 0b7d2eeff13c04c50163b1c118510acd1345dd02
SHA512 04d0d9539caa74b63e0b12d4f64bef72469ad4f8a771598e95a02e79f0ed4cd3586ef43e27ca1d766d43c8504fdb3aff3a5ff5d482ec1f46e51259eaef611cca
SSDEEP 24576:0qcKx6QH6wGDuOYCzxqTq0G5Olv2VyFj8fbkEF/Ok4uWymXkVp0vyAXK6Gbxw:0qtfawGDuXCzx62OZhN8DJGDuPmIp0Yu
TLSH
T19975221AFF41D199F41B807A23978673BC7E868CF097969B097C12FA9460C154F8BBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 538KB
SHA256 6da0691e19faa283d291bbe99af654fec4f7db3f05f68e308bc33637b2091a41
MD5 133bbd5f859abad6d15b77fd188aca40
SHA1 151eea6d83e2bfafdeb4226d229f5bb86f29d372
SHA512 6d2cd3aeacae1262bfcc6c2e9fa5da7adf5a15281d5f78338e46c51e3288459ec3c33d0c5b3cc722ec139b4ce13abed9bd4c161d937abf1232fd56221dec44d5
SSDEEP 6144:3PWh3m0k3YfHbPr+t/LRMGxrICk+zwYOLdcHGJTgUA:fR0BqpRMGur8wt5Tgb
TLSH
T1C3C4D924B6E19DB9DF276AFCE04E88EB5A5FC9E303C5002327F186E5CA602D5841ED5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWrapper-Windows64JRE-version[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z8Z5RGOK\JWrapper-Windows64JRE-version[1].txt
Size 11B
SHA256 614b81760f9ff0b69dbb87d23a22b332b135142a66aba6e0e75fd8f6700ba427
MD5 883be1bd1372d4abf305aa39239a9253
SHA1 52884b650a3e1882f60b949616b81709367c84b5
SHA512 62bbac9b1b92d50ac068d7f7071e14644f4f79891f107361cfd8be4e437d32a7ae0d7aadd56a7f0b775f551594565a045091dd7fede4115c8127048e6423c9c0
MD5 SHA1 SHA512

Submit Download

memory/704-843-0x0000018378A50000-0x0000018378BEA000-memory.dmp

Download

memory/992-641-0x00000000009E0000-0x0000000000A5B000-memory.dmp

Download

memory/1700-840-0x000002158D3F0000-0x000002158D58A000-memory.dmp

Download

memory/2432-846-0x000001882C220000-0x000001882C3BA000-memory.dmp

Download

memory/3180-467-0x0000000014460000-0x00000000145FA000-memory.dmp

Download

memory/3180-465-0x0000000000940000-0x0000000000941000-memory.dmp

Download

memory/3180-459-0x0000000000B30000-0x0000000000B62000-memory.dmp

Download

memory/3180-453-0x0000000000940000-0x0000000000941000-memory.dmp

Download

memory/3316-833-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-708-0x0000000013330000-0x0000000013362000-memory.dmp

Download

memory/3316-775-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-747-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-736-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-735-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-733-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-729-0x0000000013450000-0x0000000013482000-memory.dmp

Download

memory/3316-728-0x00000000133C0000-0x00000000133DA000-memory.dmp

Download

memory/3316-722-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-715-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-836-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-705-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-784-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-698-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-690-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-674-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-805-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-670-0x0000000013110000-0x0000000013142000-memory.dmp

Download

memory/3316-823-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3316-664-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3660-315-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-447-0x000000001EFD0000-0x000000001F16A000-memory.dmp

Download

memory/3660-267-0x00000000042C0000-0x0000000004530000-memory.dmp

Download

memory/3660-288-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-295-0x0000000000A30000-0x0000000000A62000-memory.dmp

Download

memory/3660-329-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-346-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-383-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-446-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-496-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-549-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-548-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-520-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-519-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-569-0x00000000042C0000-0x0000000004530000-memory.dmp

Download

memory/3660-568-0x000000001EFD0000-0x000000001F16A000-memory.dmp

Download

memory/3660-552-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3660-565-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/3672-652-0x00000000009D0000-0x0000000000A4B000-memory.dmp

Download

memory/3880-621-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-600-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-580-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-584-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-642-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-646-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-570-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-655-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-573-0x00000000024F0000-0x0000000002522000-memory.dmp

Download

memory/3880-611-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-566-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3880-657-0x00000000145C0000-0x000000001475A000-memory.dmp

Download

memory/3992-638-0x0000000000840000-0x00000000008BB000-memory.dmp

Download

memory/6124-835-0x000002E70FB70000-0x000002E70FD0A000-memory.dmp

Download

memory/6132-505-0x00000000004F0000-0x00000000004F1000-memory.dmp

Download

memory/6132-510-0x0000000014410000-0x0000000014442000-memory.dmp

Download

memory/6132-517-0x00000000004F0000-0x00000000004F1000-memory.dmp

Download

memory/6132-518-0x0000000014460000-0x00000000145FA000-memory.dmp

Download