hxxps://amerilifegh[.]com/DocuSign

Analysis

user interaction
yes
max time kernel
110s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://amerilifegh.com/DocuSign
Sample260527-ewjhashv4x

Score

8^/10

backdoor defense_evasion discovery persistence privilege_escalation rat

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
8	4760	chrome.exe
8	4760	chrome.exe

Modifies Windows Firewall 2 TTPs 18 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5804	netsh.exe
1744	netsh.exe
1084	netsh.exe
4692	netsh.exe
4228	netsh.exe
2248	netsh.exe
5168	netsh.exe
3108	netsh.exe
3912	netsh.exe
3368	netsh.exe
4584	netsh.exe
3624	netsh.exe
4144	netsh.exe
4636	netsh.exe
5936	netsh.exe
4832	netsh.exe
5748	netsh.exe
2600	netsh.exe

Executes dropped EXE 32 IoCs

pid	Process
3000	DocuSignSetup.exe
5012	unpack200.exe
6064	unpack200.exe
884	unpack200.exe
6040	unpack200.exe
1120	unpack200.exe
960	unpack200.exe
3464	unpack200.exe
5740	windowslauncher.exe
5204	unpack200.exe
2336	unpack200.exe
3992	Remote AccessLauncher.exe
1952	Remote Access.exe
3488	SimpleService.exe
3028	SimpleService.exe
6140	SimpleService.exe
1300	SimpleGatewayService.exe
5248	Remote Access.exe
5484	DocuSignSetup.exe
2228	SimpleService.exe
2404	StopSimpleGatewayService.exe
5268	Remote Access.exe
2332	SimpleService.exe
3932	SimpleService.exe
3184	SimpleGatewayService.exe
5708	Remote Access.exe
4368	DocuSignSetup.exe
4504	SimpleService.exe
3896	SimpleService.exe
3368	SimpleService.exe
5376	SimpleGatewayService.exe
3064	Remote Access.exe

Loads dropped DLL 64 IoCs

pid	Process
5012	unpack200.exe
6064	unpack200.exe
884	unpack200.exe
6040	unpack200.exe
1120	unpack200.exe
960	unpack200.exe
3464	unpack200.exe
5204	unpack200.exe
2336	unpack200.exe
3000	DocuSignSetup.exe
3000	DocuSignSetup.exe
3000	DocuSignSetup.exe
3000	DocuSignSetup.exe
3000	DocuSignSetup.exe
3000	DocuSignSetup.exe
3000	DocuSignSetup.exe
3000	DocuSignSetup.exe
3000	DocuSignSetup.exe
3992	Remote AccessLauncher.exe
3992	Remote AccessLauncher.exe
3992	Remote AccessLauncher.exe
3992	Remote AccessLauncher.exe
3992	Remote AccessLauncher.exe
3992	Remote AccessLauncher.exe
3992	Remote AccessLauncher.exe
3992	Remote AccessLauncher.exe
1952	Remote Access.exe
1952	Remote Access.exe
1952	Remote Access.exe
1952	Remote Access.exe
1952	Remote Access.exe
1952	Remote Access.exe
1952	Remote Access.exe
1952	Remote Access.exe
1952	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5484	DocuSignSetup.exe
5484	DocuSignSetup.exe
5484	DocuSignSetup.exe
5484	DocuSignSetup.exe
5484	DocuSignSetup.exe
5484	DocuSignSetup.exe
5484	DocuSignSetup.exe
5484	DocuSignSetup.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5248	Remote Access.exe
5484	DocuSignSetup.exe
5484	DocuSignSetup.exe
5484	DocuSignSetup.exe
5268	Remote Access.exe
5268	Remote Access.exe
5268	Remote Access.exe
5268	Remote Access.exe

SimpleHelp remote administration tool 1 IoCs

SimpleHelp is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral1/files/0x000700000002471c-76.dat	rat_simplehelp

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 54 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StopSimpleGatewayService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleGatewayService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleGatewayService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleGatewayService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4760	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243290580762072"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe
Token: SeShutdownPrivilege	5860	chrome.exe
Token: SeCreatePagefilePrivilege	5860	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe
5860	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3000	DocuSignSetup.exe
3488	SimpleService.exe
3028	SimpleService.exe
5484	DocuSignSetup.exe
5248	Remote Access.exe
2228	SimpleService.exe
2332	SimpleService.exe
4368	DocuSignSetup.exe
5708	Remote Access.exe
4504	SimpleService.exe
3896	SimpleService.exe
3064	Remote Access.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 5648	5860	chrome.exe	88
PID 5860 wrote to memory of 3356	5860	chrome.exe	89
PID 5860 wrote to memory of 3356	5860	chrome.exe	89
PID 5860 wrote to memory of 4760	5860	chrome.exe	90
PID 5860 wrote to memory of 5460	5860	chrome.exe	91
PID 5860 wrote to memory of 5460	5860	chrome.exe	91
PID 5860 wrote to memory of 2428	5860	chrome.exe	93
PID 5860 wrote to memory of 2428	5860	chrome.exe	93
PID 5860 wrote to memory of 4160	5860	chrome.exe	94
PID 5860 wrote to memory of 4160	5860	chrome.exe	94
PID 5860 wrote to memory of 2872	5860	chrome.exe	95
PID 5860 wrote to memory of 2872	5860	chrome.exe	95
PID 5860 wrote to memory of 3200	5860	chrome.exe	98
PID 5860 wrote to memory of 3464	5860	chrome.exe	111
PID 5860 wrote to memory of 5204	5860	chrome.exe	113
PID 5860 wrote to memory of 3820	5860	chrome.exe	114
PID 5860 wrote to memory of 2056	5860	chrome.exe	115
PID 5860 wrote to memory of 3000	5860	chrome.exe	116
PID 3000 wrote to memory of 5012	3000	DocuSignSetup.exe	119
PID 3000 wrote to memory of 6064	3000	DocuSignSetup.exe	120
PID 3000 wrote to memory of 884	3000	DocuSignSetup.exe	121
PID 3000 wrote to memory of 6040	3000	DocuSignSetup.exe	122
PID 3000 wrote to memory of 1120	3000	DocuSignSetup.exe	123
PID 3000 wrote to memory of 960	3000	DocuSignSetup.exe	124
PID 3000 wrote to memory of 3464	3000	DocuSignSetup.exe	125
PID 3000 wrote to memory of 5740	3000	DocuSignSetup.exe	126
PID 3000 wrote to memory of 5204	3000	DocuSignSetup.exe	127
PID 3000 wrote to memory of 2336	3000	DocuSignSetup.exe	128
PID 3000 wrote to memory of 3016	3000	DocuSignSetup.exe	131
PID 3000 wrote to memory of 5204	3000	DocuSignSetup.exe	133
PID 3000 wrote to memory of 3688	3000	DocuSignSetup.exe	135
PID 3000 wrote to memory of 3992	3000	DocuSignSetup.exe	137
PID 3992 wrote to memory of 516	3992	Remote AccessLauncher.exe	138
PID 3000 wrote to memory of 4924	3000	DocuSignSetup.exe	140
PID 3000 wrote to memory of 2732	3000	DocuSignSetup.exe	142
PID 3000 wrote to memory of 3248	3000	DocuSignSetup.exe	143
PID 3000 wrote to memory of 6020	3000	DocuSignSetup.exe	144
PID 3000 wrote to memory of 2072	3000	DocuSignSetup.exe	145
PID 3000 wrote to memory of 4268	3000	DocuSignSetup.exe	146
PID 3000 wrote to memory of 2612	3000	DocuSignSetup.exe	147
PID 3000 wrote to memory of 4628	3000	DocuSignSetup.exe	148
PID 3000 wrote to memory of 1716	3000	DocuSignSetup.exe	149
PID 3000 wrote to memory of 3404	3000	DocuSignSetup.exe	150
PID 3000 wrote to memory of 3544	3000	DocuSignSetup.exe	151
PID 3000 wrote to memory of 2032	3000	DocuSignSetup.exe	153
PID 3000 wrote to memory of 3052	3000	DocuSignSetup.exe	154
PID 3000 wrote to memory of 1952	3000	DocuSignSetup.exe	162
PID 1952 wrote to memory of 2124	1952	Remote Access.exe	167
PID 1952 wrote to memory of 3092	1952	Remote Access.exe	169
PID 1952 wrote to memory of 3824	1952	Remote Access.exe	171
PID 1952 wrote to memory of 5368	1952	Remote Access.exe	173
PID 1952 wrote to memory of 2340	1952	Remote Access.exe	174
PID 1952 wrote to memory of 3064	1952	Remote Access.exe	176
PID 1952 wrote to memory of 5096	1952	Remote Access.exe	177
PID 1952 wrote to memory of 1840	1952	Remote Access.exe	178
PID 1952 wrote to memory of 3488	1952	Remote Access.exe	183
PID 1952 wrote to memory of 3028	1952	Remote Access.exe	184
PID 6140 wrote to memory of 1300	6140	SimpleService.exe	186
PID 1300 wrote to memory of 5248	1300	SimpleGatewayService.exe	187
PID 5860 wrote to memory of 5484	5860	chrome.exe	189
PID 5248 wrote to memory of 4048	5248	Remote Access.exe	190
PID 5248 wrote to memory of 4592	5248	Remote Access.exe	192
PID 5248 wrote to memory of 5088	5248	Remote Access.exe	193
PID 5248 wrote to memory of 5324	5248	Remote Access.exe	196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://amerilifegh.com/DocuSign
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb3fb2c728,0x7ffb3fb2c734,0x7ffb3fb2c740
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,15999042115403102910,10705734669732279174,262144 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,14125984120433505060,10285857885445137901,524288 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,4600777766501835569,1695759528707627812,524288 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,18107796383799103265,16798759419181710551,2097152 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3392,i,8568346211844311675,17140393057637837007,2097152 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4148,i,6017096799881949220,11021434593003955342,2097152 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:2
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,17665212935838639102,12478182440502618983,524288 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,8683496489147225989,3160234340304490352,524288 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,13307058410126828730,9230377436166179461,524288 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,16463179614776533349,336100284143028412,524288 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,7787307820149227718,16728655681997390415,524288 --field-trial-handle=2060,i,7492959505884928117,10144057378014370353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:2056
- C:\Users\Admin\Downloads\DocuSignSetup.exe
  "C:\Users\Admin\Downloads\DocuSignSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\alt-rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\alt-rt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5012
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\access-bridge-64.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\access-bridge-64.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6064
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\jaccess.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:884
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\sunec.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\sunec.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6040
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\sunmscapi.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1120
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\jsse.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:960
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\rt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3464
- - C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\windowslauncher.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\windowslauncher.exe" "-Xshare:dump"
    3⤵
    - Executes dropped EXE
    PID:5740
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\customer.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\customer.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5204
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\unpack200.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\jwrapper_utils.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\jwrapper_utils.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2336
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
    3⤵
    PID:3016
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
    3⤵
    PID:5204
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
    3⤵
    PID:3688
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1779855510120-64"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:516
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\ChosenLanguage" /e /g "Users":F
    3⤵
    PID:4924
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:2732
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:3248
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:6020
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access" /e /g "Users":F
    3⤵
    PID:2072
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
    3⤵
    PID:4268
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig" /e /g "Users":F
    3⤵
    PID:2612
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete" /e /g "Users":F
    3⤵
    PID:4628
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete" /e /g "Users":F
    3⤵
    PID:1716
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
    3⤵
    PID:3404
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app" /e /g "Users":F
    3⤵
    PID:3544
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\logs" /e /g "Users":F
    3⤵
    PID:2032
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" /e /g "Users":F
    3⤵
    PID:3052
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1779855510636-65"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:2124
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /e /p "Users":R
      4⤵
      PID:3092
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService" /t /e /g "Users":F
      4⤵
      PID:3824
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /g "Users":F
      4⤵
      PID:5368
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /p "Users":R
      4⤵
      PID:2340
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
      4⤵
      PID:3064
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
      4⤵
      PID:5096
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" /e /p "Users":R
      4⤵
      PID:1840
  - - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
      "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3488
  - - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
      "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3028
- C:\Users\Admin\Downloads\DocuSignSetup.exe
  "C:\Users\Admin\Downloads\DocuSignSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5484
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:5080
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:3480
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
    3⤵
    PID:4112
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
    3⤵
    PID:1452
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    PID:5568
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    PID:5928
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    PID:4136
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    PID:1760
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" /e /p "Users":R
    3⤵
    PID:5396
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2228
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:740

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6140
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-1739051685-22"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5248
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:4048
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:4592
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:5088
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:5324
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" "SHRemoteAccessServiceSH_3_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4228
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" "SHRemoteAccessServiceSH_3_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2600
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" "SHRemoteAccessServiceMA_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2248
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java-rmi.exe" "SHRemoteAccessServiceJE_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5168
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java.exe" "SHRemoteAccessServiceJE_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4636
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\javaw.exe" "SHRemoteAccessServiceJE_3" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5936
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "SHRemoteAccessServiceJE_4" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5804
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe" "SHRemoteAccessServiceJE_5" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1744
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\windowslauncher.exe" "SHRemoteAccessServiceJE_6" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3108
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.lock" /t /e /g "Users":f
      4⤵
      PID:2732
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2404
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-1739061728-22"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5268
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:3732
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:736
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:4328
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:4200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4636

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3932
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3184
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-1739063276-22"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5708
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:2816
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:4336
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:3420
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:5396
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" "SHRemoteAccessServiceSH_4_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1084
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" "SHRemoteAccessServiceSH_4_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4692
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" "SHRemoteAccessServiceMA_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3368
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java-rmi.exe" "SHRemoteAccessServiceJE_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3912
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java.exe" "SHRemoteAccessServiceJE_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4832
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\javaw.exe" "SHRemoteAccessServiceJE_3" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4584
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "SHRemoteAccessServiceJE_4" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5748
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe" "SHRemoteAccessServiceJE_5" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3624
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\windowslauncher.exe" "SHRemoteAccessServiceJE_6" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4144

C:\Users\Admin\Downloads\DocuSignSetup.exe
"C:\Users\Admin\Downloads\DocuSignSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4368
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
  2⤵
  PID:5068
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
  2⤵
  PID:4268
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
  2⤵
  PID:1728
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
  2⤵
  PID:636
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /g "Users":F
  2⤵
  PID:1176
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /p "Users":R
  2⤵
  PID:1492
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
  2⤵
  PID:5620
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
  2⤵
  PID:1812
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" /e /p "Users":R
  2⤵
  PID:5664
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4504
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3896

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3368
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5376
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-1739076098-22"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:5364
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:5992
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:4436
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SimpleService.exe

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
Size 97KB
SHA256 dbdddea03c3fc4c2574ce4221450ec86221ebc615c4915c4c4eb3f2a5e3f5b25
MD5 c23278308e390b10a8cb67498c7c672a
SHA1 89c4cb94e48e63a84714f0b22108849946ea823d
SHA512 352feb688d83239d53130b4967a1ea709038305a0dc59f7a92e3e5bd7874490420d35ab608fafe9c5a51c3b0f948a5bab27d93d92dcacb94367e124b49cd03d9
SSDEEP 1536:uXJ6XWMb5aE3x3wye9Dyqi52D6Tua5FIYF5pdMmcoKjQwXfTk1:aqPa92TxdNKjQwXfg1
TLSH
T13BA39E4178D2C0B3E40545328681C7E69FBEFC233BB755A7FB94069A5EE11C41B2F6A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete
Size 259B
SHA256 8db2cfa7d7b23ca46b326f47f7e611a66716ab70a6e96fc823f8077b2f843628
MD5 0484ad346166af79ab266351c3c0b1cd
SHA1 e0662499f35833be245bc8d971aec79cd8f9e0a8
SHA512 06ee5c20bb9c251ad4db9594a82179a9412f78e3fe4100f2b894edbc045c281fb3efe0e8963d23044589a4b7c712b50ec603a122f3d1759ef8bd099b12e7c022
TLSH
T114D02BE45855265AC700DD72014E39CEB76952A40780C3D87120898AA5634A955A6188
MD5 SHA1 SHA512 TLSH

Submit Download

JWLaunchProperties-1739055170-22

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-1739055170-22
Size 14KB
SHA256 085d9d4c7d67bb2f49bcc50dece658ef6398e23b7520aab024a7ad5d266abce9
MD5 974488764c2165c5917b74b189e675b5
SHA1 8e1f9aaea50922e8b56d74813dde4eca8f6116c5
SHA512 348fed25d25c519885ce74a44c318c2a0b185e28f750661f281b901bb1c0b297fc0384f089b4397b88ce9567519725241d78be6350bde237ffbffbafe4fcf075
SSDEEP 384:9maYuhbXHWQvXNQFD3BxIhMLOo2KxwdSBQ:EaYuhbHWQvyzMhMLt+dSBQ
TLSH
T1F562BFE919387A734D92B4F5350A3ABAFB3253E48191EFCCD7A7B214C7EA007614D049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacerts

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\cacerts
Size 110KB
SHA256 d020172012854bb4a9d461885c6816eb855498c63ff78bc60944f4fba1e9091a
MD5 2ecfd7e5a8789c3f0e68ae85a26dea23
SHA1 8bccdebcd485eba9a0ac324efe458a087dd55c2a
SHA512 9c350aa5bf3d975d64988f9f33ac3dd0533322f57b9a7a07db479d0082693b5f74c4a90be853dd1af8f2749f003bd8633632732c7ad6bb1abbb894b343ae10db
SSDEEP 1536:n1kP9UXlkT1ze0WuQHoeCHtVjnIhEObD4lyCpcJa7eUS:nKLI0WuybotVnINbclyCpE
TLSH
T190B36CCB4F383921BFCA9E546288E6373E75B3D6A69A24171575C0E16DD27F43A8C00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nativesplash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\nativesplash.png
Size 8KB
SHA256 5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7
MD5 08051133e368d61036576d3ed5b9cc14
SHA1 817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5
SHA512 93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce
SSDEEP 192:XFcpG2JMh/HwqndQb0qZzAuc6SyLK8hC5W+Cyd9kipsR5iyjR:ik48YadQbxO6PLpCWHGVSIyjR
TLSH
T16112BFCC406E7CA471E2012A8A44C75117B625B11D55BE2A3A41DCEB618CEDF2CFBAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-AutoTest

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-AutoTest
Size 37KB
SHA256 64d7e23681d9eaf3da0707c19129490b63aad203ba396898b3050ac444c968d5
MD5 e26848c033edca804c3eb0f16101ff78
SHA1 a6bb60c0fe531682fc1fb7349f77d526f0daea22
SHA512 9127636a4bc528fe771266339ada958dd08e9621d6724da94d8759b289e9f0cedf4a421135a009cc3eb9b5f2405fa303a9e47c7c3877fcb56a6ba3c629222b3d
SSDEEP 768:0T+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:C+YEgQvu3DnUl5eySSHypGy
TLSH
T1B103BE02BB84F3DED26B9173765D170B132B9D0326639B5B288EC3679DBB0704B47662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-HeadlessTest

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-HeadlessTest
Size 37KB
SHA256 95c5ef6d4d9326952cf7435c4d8383357d4621a9f78839bcedbec52729bad94e
MD5 d035f43d2de95a2a6a63ddc2a915c979
SHA1 e6459637d788aaf19b135e05c5e47e9385b5fcf7
SHA512 f2eff066349b984127a96325014b21014fa60c7577f30703357df83e348b5e340f667da25289085692d50b7cd337cd1982baab98df27ac260616b7bfd68d395b
SSDEEP 768:BT+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:p+YEgQvu3DnUl5eySSHypGy
TLSH
T10603BF02BB84F3DED26B9173765D170B132B9D0326639B5B288AC3A79DBB0704B47562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapperJreCompatibilityApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-JWrapperJreCompatibilityApp
Size 41KB
SHA256 fe5cf53e4af7148b175f2d2e5202a3a35014b3df3ba7beb91c26213e75cbf957
MD5 ae9a15c064c6b169f2ba3a3659487da0
SHA1 dc34f9b45367f615626a20bf2b496164b2bbf8c5
SHA512 ebe4aa71f15a5eb67c115636199dd34678f005c2c95b79b3a0c93393490acb80a2fd405c2229bec5a9d57bf1c079938a44409585f74f179ad449641df83c1f9b
SSDEEP 768:3KQEc8OOdLphvZAmkqEDb2jnyf6GHvRa721v9DJBisoVjPlDO60o:3K3h9vymeKgHHJxjNJcPlMo
TLSH
T12613D0C3EBA03F29DC5D5832201A4A2A572368BE45DE273731D87C1758E61A71B37B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapperPostInstallApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-JWrapperPostInstallApp
Size 37KB
SHA256 b357418415c347a928a0264ef7ebaf09d4c02c6ae75d2229d64c9fa71ffd0675
MD5 afb9d5c27297ca0a259acbfd8dc924dc
SHA1 40fd9fa54ec89e5b0886dcb2ae482d23261063f9
SHA512 cc8c030733ee64689494b4a3a7bd207adbf704461dae35273fbfb03b1e43d76c340d81e2ca131e9c1abe005368f51d1988b8670ded35982dcb6a42071bbb9a04
SSDEEP 768:rT+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:/+YEgQvu3DnUl5eySSHypGy
TLSH
T1AB03BF02BB84F3DED12B9173765E170B132B9D0326639B5B28CAC3679DBB0704B47662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapperPostUninstallApp

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-JWrapperPostUninstallApp
Size 37KB
SHA256 905009ce9e85af1cbf696d830862c5c06e50504194826556fa4581f63bdeb8cf
MD5 46c60378493926e3f7dda887b3d17411
SHA1 c0948de046fe9d3ea291d79cbf143ff97f15885a
SHA512 ddcddb39ae6464ea828468fa48dbe0e2629d084f2cbda13848a14523f5c5e6eeb3bd930b5a0e19e4e48b82acc22fb196f1adecfff6d31d191f4a9a3948450572
SSDEEP 768:XT+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:j+YEgQvu3DnUl5eySSHypGy
TLSH
T11703BE02BB84F3DED12B9173765E170B132B990326639B5B288EC3678DBB0704B47562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-JWrapper_Service_Management_App

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-JWrapper_Service_Management_App
Size 98B
SHA256 d6d85963b3f1b78c47864d86bea785982f6d766da712dbf5331acea680231df5
MD5 0b1f8897cf02e7788537e2c2a1707c7d
SHA1 760fafb7fb7a463accdd43781d3f11f96e7fff3a
SHA512 a17226d6b969ab63c35e7af04153aaa4251180c34010ae68a3b41e6b5b4fcde12dd197a55e4f17dce9af656c288672dafe9f4eb410e3c935bb9291afd7452925
TLSH
T1E6B01128AAAEB0A0C08800BF2C0300000AA000BAC0ACB28C8AF0802E02E2C8C0308000
MD5 SHA1 SHA512 TLSH

Submit Download

JWAppSpec-Manage_Remote_Access_Service

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-Manage_Remote_Access_Service
Size 37KB
SHA256 32e5397480eead605666d010cb69b84d66e8631424d0beadb604cc5b697ddcb6
MD5 33d43bf3c7a3d050455078c6ae781dac
SHA1 a53ec4da97c2a4d1103e0d91f925ae72a54c79a0
SHA512 54b6677554d69d306cf6e32f88222eec15d192fbdaba546d63da9a346e3b1f0f11590ce0a271c77c31ff22cf79cc5fe7f5d257b6166f884e3336c9a7ea86a002
SSDEEP 768:hT+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:J+YEgQvu3DnUl5eySSHypGy
TLSH
T11603BF02BB84F3DED12B91B3765D170B132B9D0326639B5B298AC3A78DBB0704B47562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Configure

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-Remote_Access_Configure
Size 37KB
SHA256 c2c6117e05958c57ccd35fcc169d6a05a86b86b006aca7821c11945762bb1e5d
MD5 05f9aa58b05e616b3c35b750f4658a3e
SHA1 0ad2e978f8f3ad66b1109ca01187c3ff02bb0a92
SHA512 cd4203547e6fe3719dc3a1e65e0e0c0dc8b4d134aa1dd6d614b19f63a459cdff13234369cfb2cc879a516c9ce7bc849381228273959d7170aa7c2218a2cc10e1
SSDEEP 768:4T+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:++YEgQvu3DnUl5eySSHypGy
TLSH
T16503BF02BB84F3DED12B9173765E170B132B9D0326639B5B298AC3679DBB0704B4B562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Monitoring

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-Remote_Access_Monitoring
Size 37KB
SHA256 943cf6bce4e9d5006c864435fc99d788e8ebd09b642d810068dace46acb02866
MD5 772a981ad4582cf9b5bca30d4e1d8938
SHA1 7936635e0c964e76bef9149b26d481271455ab7e
SHA512 daad74dbcbee5c7dba10bf99104b1ba76641cd76453a11aa72cd7d546c5ec53f67551597e532bd5af894a5738f61ecfa40dccc6535315308a06b7068c54c149b
SSDEEP 768:YT+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:e+YEgQvu3DnUl5eySSHypGy
TLSH
T1B703BF02FB84F3DED26B9173765D170B132B9D0326639B5B288AC3679DBB0704B4B562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Service

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-Remote_Access_Service
Size 37KB
SHA256 eec0a69c8e51fed5d85329d18010b4b63949010d80a2bd6ede3ef6be56a02c33
MD5 3461ad550179e2f785edba944c852d63
SHA1 ced684aed69eff96100f39bf4da8e43ea2ed0f7b
SHA512 c6a967bd554b950687b1423f5aaa4a09c92d1d1c0825169a642747d0a13c27389bae8d6dcf7785bf2279521f7fb16899b946e534cf4a74c31b176d75bac85ae3
SSDEEP 768:zT+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:H+YEgQvu3DnUl5eySSHypGy
TLSH
T14003BF02FB84F3DED12B9173765E170B132B9D0326639B5B298AC3679DBB0704B4B562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Remote_Access_Session

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-Remote_Access_Session
Size 37KB
SHA256 8d311b64136e16b5d2de3ad8597f141610ff9d9e1d64d14e6793f196619dde7b
MD5 7fb88b7512e45820651951e9f0ac717e
SHA1 d231be332d248184264d12b863ea110250820853
SHA512 8a426cdb637bf0922e19b704e05c8dcab6a20fdde530ca535ec4c51263d1452662835c992e90399bb7936c42af5ce109ad610e8fc0889e03c93e4fe88d02da4d
SSDEEP 768:zT+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:H+YEgQvu3DnUl5eySSHypGy
TLSH
T14603CF02BB84F3DED16B9173765D170B132B9D0326639B5B288EC3A78DBB0704B47662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAppSpec-Stop_Remote_Access_Service

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWAppSpec-Stop_Remote_Access_Service
Size 37KB
SHA256 45d0cbb1bea6cb58d43d9c18710a385aa1e017fa70fdf912d99aecc04ac09315
MD5 32358c1612f48084efc19f7d8a4abc55
SHA1 710f1d9de7db9ab03f23134b8eee87a5e3e0c4b5
SHA512 fa35c87c24dd6d7263507704ea229c9d87ca0f3d6a6cf678d83333b1436519d21109c2a46f912fba3e66ac196589fd46b89637df31020a90badbc61ca2a93a8c
SSDEEP 768:2T+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwt:4+YEgQvu3DnUl5eySSHypGy
TLSH
T16703BF02FB84F3DED12B91B3765D170B132B9D0326639B5B298AC3679DBB0704B47562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWLaunchProperties-1779855527949-66

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1779855527949-66
Size 15KB
SHA256 66507e375760f0bf3afd6e2e5476327a1e76aee980b6b2d400e4362d816bc36b
MD5 f28ec5b4d88688305f4782c9d6dc24b0
SHA1 0324ccebe33864139499290702882e19d1f34986
SHA512 55cebd765e06cafe70a68423320903081b7b5e81601e99d0677764f7a39718e021ddc394ff9c83d95387e33e7030e9652b91a0eed593ac4a8e4b99b117105c21
SSDEEP 384:ZqzYuhbXHWQvXNQFD3BxIhMLOocmpKY+MuZc:ZqzYuhbHWQvyzMhMLtxv+MuZc
TLSH
T17862AFED183876734D82B8F9394F36ADBB32D3D4A291FF8C5697B625C7E6006614E048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWLaunchProperties-1779855534190-66

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1779855534190-66
Size 15KB
SHA256 ac4a49dddd8d52481a0339db9d15a85d397be2ccbf7f7877565d6c203b8298ba
MD5 62fd382046b9422a493d3b3dd427e414
SHA1 1de93e4defc7a33fea6f18b88936330922562a48
SHA512 f68dfe8a146c6f0422477e93821fca5df1bb4f4c69161195682b79e931b49832ec4e39516dd54fc75e7adf18a408df525b37a35684466f4b876652302bb05da8
SSDEEP 384:ZqIYuhbXHWQvXNQFD3BxIhMLOoRmpKY+MuWc:ZqIYuhbHWQvyzMhMLtwv+MuWc
TLSH
T14762AFED183876734D82A8F5394E36ADBB32E3D49291EF8C56A7B614C7EA007614E049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWrapper-JWrapper-version.txt

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWrapper-JWrapper-version.txt
Size 11B
SHA256 f40892e754a7247d4bb7368b612a366de1f0ed61647bfef645319cf28a927cf8
MD5 bfc7119811bdb3c90d76b89e4073159c
SHA1 75bb6baeb9cc15154e036108cc3f5e7af66bf7fc
SHA512 9d63a6d0c79743bb4f12c542bf5f38962c6530a30d75944f50d1a2dcc12f6211966257abef5662ecea70be6073f39a57cee5f656875d6bf175b23f8ef0e1ba92
MD5 SHA1 SHA512

Submit Download

JWrapperLaunch

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWrapperLaunch
Size 374B
SHA256 c4d6622444117a75a104690c1f495eff6a4a08a38a06e04026b7558f62d29864
MD5 bc2476aaec2d00289d4d369cc98afda1
SHA1 5dfa671071f2c84335c35e97772c59399743d5de
SHA512 8da9e77e8c22eb98c1a3e818fb854d49513a6ec326db39b7989c109e9bc4bd7dac5a8d04ba640484e820b7c8d91a2e7fe361f3a76e91cfb7c996ddafc8d9aa92
TLSH
T1CAE0F8E86D303A468200CD3E08CE38CABA7C02F88280C3DC316076CF6BA30A85255189
MD5 SHA1 SHA512 TLSH

Submit Download

jwAuthorPublicKey

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwAuthorPublicKey
Size 1KB
SHA256 b72d40a45a55df2c60142d734630e5be9464b52a09cf71a2951bd4553f785a12
MD5 1128dcb368df4e55c20a4657d6b9b6a5
SHA1 a5288d935233702de687aa089dc864e7b9db3f84
SHA512 45741d62559ab3bb476835cc99f0ce76dde0135de6dcadcf52ebb489125aa822de2efaf9146fba144fc3d5d9a5d76b8e64bd976f1fc0c8b9048f82e2b8369814
TLSH
T19C11D870106F3A955E791180DA0B23DB1F17A1C9BC6052892B69723167AF2CF47C8771
MD5 SHA1 SHA512 TLSH

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun
Size 13B
SHA256 5549447c1d3debf348567526c8ca012bc5d7c11992f7ec3b92537d110ecb1300
MD5 04a65f6c86649cf9719c4e60ba7cf27d
SHA1 d12b19b50f9fd024e4b6ba6094573aa0564bdeab
SHA512 914efc4686eafac2dead2d3a9c18302a6d140c9b620ccfc5d921c8d5716bc3cbc12d6d5130eee42c7fd31832ed9bce7f109a606a87d374882ee516e694e63243
MD5 SHA1 SHA512

Submit Download

jwstandalone.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapperlib\jwstandalone.jar
Size 2.4MB
SHA256 c94fb07b474427eca85c692e6dcac18fc4321667ff8496a8ded8cc56136640ec
MD5 17130d677856f356689f725491e57bd3
SHA1 3fb7f608a80469a24362dfd14bf8698ac20d99f5
SHA512 a73890588ac5c48f64ab45587085b7d14dda7b208a04603bd17d3285e92ad9a6f183df7bf079be10675698cf60c427acffbe0b46ac7dbe832cc6cbbfafef4f27
SSDEEP 24576:n5fxrZTzz+uLZm5UNn+j+iSHWQEs3TnNdprhNJiucgSGCmDQIGVCvHxZ:n5JZTzz+uLI5jOAs35jh7iucgSt+vxZ
TLSH
T1EAC55C17F1101E5BF291F73D19A48398777080708313F7A26F99A86BAFD62E8DA463D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwstandalonelaunch.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapperlib\jwstandalonelaunch.jar
Size 4KB
SHA256 a259f0a3641a997933cfc8d93c7c2d1b1855117172d9bea07ed62848bf9aabb1
MD5 578cc7a5908296562f43298292a05c2e
SHA1 fe761334e22670bb74e7f620f092f5a875e1a3e8
SHA512 e9560b10e38efae7c0b7afe9be1ac5c0f873dcc4f67c18727fc9a714d15c53f673bc16410112020d7173d8a9632fe43fed5b3fc55c6eb83a2c7798ef0c824417
SSDEEP 96:gjFlOlJJjKFlwKjJfLiFl1Q91GyMhwb1H3PZP7:g5l6UlTRLIl1g1G/hwJ3R7
TLSH
T1B0A1205BF0109163F09FF17C58548328513024379922BAE16FFE098E9AF76684F9A6D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_linux32.so

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\libjwutils_linux32.so
Size 10KB
SHA256 45f9bec62e6e74f0e82698f5a4253c94456be31b1daa802d64cc09ec8ade35b7
MD5 9a5d5f9dc54f9fb21e89619688b9675e
SHA1 9e6b04d6839e53ec6f2c674e4446a1b4e298f15c
SHA512 ed5b9779886d9d4d2141601fb573ca2bed796888a51a531909d8d3ef1b20c7c59d0833d94cda428bb6c9fb77656d338b4ce71360818f1a637ea95ba5611ce9c4
SSDEEP 192:cSljcrhRDpX3Qgc2xZmh+spEtSOqUMoB/iD:c2oTggyUwEUOHBO
TLSH
T1F8229519AAD1CC71E08E0B3C01FB475CB336882396538373525C25AC6BF75EA9771BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_linux32arm.so

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\libjwutils_linux32arm.so
Size 10KB
SHA256 7fe175492f67d950be416e4ad28d94ed4b9e028c6a42d4ded8450aceed8d6a89
MD5 ee854028c8c4a3690eeb89ce6d7240d4
SHA1 5ea91e433bc400b6a392b0af5a5670f663c4e449
SHA512 9072b28bc5ec89ec0d495dd9c9851fe1e2cde3d2717e8f5aff2851b3ea6e3fc499527bf23a51bb5ad0e3413e1aa77029bc81643bbcfe777618a2c4631b6b1e9e
SSDEEP 96:HQe/9cusYRXi3odPR41SY1QR5qFxBxTOD44ieMrIg+AO4y91G4It6HhVK/4PO:92/hsq1d1fxBo4DrIHAb6BJO
TLSH
T18322749BE5E5D821C4DD127C817B87CCA26D8C638AC14337022C9A683F979BC7B31AC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_linux64.so

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\libjwutils_linux64.so
Size 14KB
SHA256 1915dac6c495012b928912d029f4a4f514a2e43f5e8264109afc0c0928f9026c
MD5 4b93bf58eefd8e42b4d87ccfbf80fd87
SHA1 788e1075ee6dee44b93d19ffe21bbb20db6fc3f7
SHA512 fc898615a228f261bbb6d71ac0bae65c1ad6a4c00d941d2808f8d960b83c24d6b9a68877ec4b40725238e821cfb8fe1773f91ba77facd3258aba4452d5120a27
SSDEEP 96:R0mBNsYRXi3Ka2ZqjkuQx8nRC3RjOk8k5KDezDZB3p1kxTYmqaxpaiHlOpfXusUV:R0mB+hRcD3p1kJYMjHgfXV2uSYCmxa
TLSH
T127526527BBA1DD2AD0CD473C049BC3A8FA729425830353071648E1AD7FD77861B7E685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_macos32.jnilib

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\libjwutils_macos32.jnilib
Size 30KB
SHA256 d9a35402d0505763aad1f83621a726771d0e3144f6925987f2c5507c72fe5332
MD5 46761940fe82242d0ee5d0f3719ccd7b
SHA1 927d30a78953ae45d695a46ca98ce565f01657ba
SHA512 996db13325950644f6a4a757fc6369e073a922c328adcdfb60f59c5ef7f3341a1344314bf905ca87e83a6f592bef7f60e08e075e998a256f23b3053fe853c1b7
SSDEEP 192:KxemXYJ3BuGf+0O/oh+tJBn09ZLOu3uX3X4XvgtrXvBLBrw5NxVt0CQv2zsxD3DN:Kxem038Gy/g+MDHgJ5FkjzIraXFDnE
TLSH
T1CCE2C7721B2EF73AC45B597940DFC29F8334A31AD4114B53CFCC9DA89BAB6A4BD0411A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjwutils_macos64.jnilib

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\libjwutils_macos64.jnilib
Size 27KB
SHA256 83e0fff9a88d2f170cf689f0008ea3654044690e108ccaede8fd7f5dae0b9212
MD5 f777972d33da464b94fbf80762db08d6
SHA1 e3b6e3ee53a4f2ffd777ba81631ba27ca5fc6fa6
SHA512 b9b560fd834823b5d3675ed89f1b0f88d4d8e4bf4fbb6e924cda48c769dd89e3a0208e4574d725455fe82611824f2601f177b699972f83b14be31e68235efc63
SSDEEP 384:INhE/lvzmfdFUWgDhh+c1fOteUpymKayZraXFDnoc:IWlzmfdFWDhh+Ltxfy5a1Dnoc
TLSH
T199C2D82AEFD5C4A9D04D993CDC1F8252CC54F8991692226F01E8FF382FB5A6026CD64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lzma.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\lzma.exe
Size 71KB
SHA256 410bfdaddee3767151296fe4f16052c39546151916f05bbe4ae1c6b698b18f0f
MD5 e59aa0e52e93c781dcdab8ad7cc4054c
SHA1 1be9c2d8b48d6e0c8a7cab6013cc36ea42ec421e
SHA512 d0be3580640bb2cca0c097ec2154132eeefd2b2b4b0e45027cc303c47a42f5c545d5f50182c70a69b5d1673112d24f8ae320d097d7034e810dbc0a5128b09050
SSDEEP 1536:e4iIoFd/iQuGIpJrnuRctWN5UbhYLEnCwaXEY1:e4iICd/iHVrnuGtmUBgXE0
TLSH
T18F63AE007BD780F2DC6358714A0BBBB58672E3AB0B0559C793506E2EDE351F2D93A389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java.dll
Size 147KB
SHA256 98dda25cc003d49232108012375fbd15e8c721030d27b0150bc8d7fdf11b99eb
MD5 5ce65a4198ec258940cae0e66b951f0f
SHA1 194e6e9be561f1e38b97d6a2c2516e8bb0c592c2
SHA512 d1337362eee45ba0fb107f0696be1f60c41e30143a3b226cf5c57a3cc6585eebb04ee5af92c1c147bb9bc02a8c3387e7dda356251e0dd8bac9adbd73edaf455f
SSDEEP 3072:C3PUO1vb0afLDRqu67YmITk+Jy/77VKdwTkZ4eE/:S1FnRxZZy/QK82
TLSH
T198E33A4AA34640A2F49772B8B0149107E3B6B598023C93BB47E48B0F6FBF761BD57B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\net.dll
Size 90KB
SHA256 dd493878350d5ca8812e85c2cbf46aad22f9665c36d559d290c850d053a13f8a
MD5 c61a2ce2df9b8670e92450a48729b4ac
SHA1 ae1ad89df8a6527a132a49bb8feb0703e70ba0b8
SHA512 16743cfecbb64cd197f7c420c5cf7da53e80f14899455bb851c8d86518b46063bbbd7b3d84a8ab803f94b9f4300d6fe0fa9439d14da918777f580b86e885f8bd
SSDEEP 1536:957o97I5ZyBDczJBnxnRRcwn4U744+gMExMRhdolsyIcYVSbvw:9kDBKBn9Awn4U7440EHsyIcYVSbvw
TLSH
T1E8934904636820E5F877D2FCC6568207E7B274705660939F12B2CA9AAFDFB717E09B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\nio.dll
Size 57KB
SHA256 ed08fc11b05c728083485a550118afb9c85959d654c3580967d1fe8f9ae7170e
MD5 f1b9456b9d1e4689f70476226a375ddb
SHA1 d189e91eda8d52d20dc0bc1f2f7e2ad293a2882c
SHA512 8540a493aad2dd19f000baa158a8f5f9e0b7d58789c829195b79e354f46b882bd28664b61b81a38169d794625d1d2829393f31ccdd8756a720527c41fde37241
SSDEEP 768:ivTI+hiL5dma7Q8m8KiiKEiql6tjfNObdb45GNrSapXVqlsmB5KP8eCMiIy31Sd8:WERXEv0jqEkrS5548ekv3Y9ciYD
TLSH
T11D432AB7436484D7E46A7138829B4787E463F8108524672F4238C7959FAF7B23E2EB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\server\jvm.dll
Size 7.7MB
SHA256 f534c181ff411fed4f82e2e4417fed7e4f0c644bdfef1bfc27b72d53facdd6e0
MD5 4905b7ce66d1d106693539433b47ad36
SHA1 24ed2d4f11688f3592749803c87f7b4aa4a81160
SHA512 8464d8bf45683f7dcda3921a27022cb23ad84e6c4a5d9fc290cbe8664699878cd06f50d8111cdbee2f8f4b68dd95cad01a01b042a406b3bc0dbef1de426676d4
SSDEEP 196608:3buJXYXfcLDCugihw407humD0qFO9g6mpv:3buJif1ih1mD0qFO9g6mpv
TLSH
T198863A1EA3B580E9F82AC0788E6A970BD6F274A5133097CB9FB047451B93EE5157F213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\verify.dll
Size 47KB
SHA256 d2b5ce56fbaa43f470ecd23f3e37b179d57cf181cbc4f6066f857603c97e3aff
MD5 68f9115344ddcbb428d0af8ebb1eab18
SHA1 3ca54b9530d77f9109489f492973dcc608d8494f
SHA512 574bdd87c0bef081745b1f75cee7a3ea90c4d4261bcaf493a6edc09c88069c6e3e004a988a11aef9811323d998f4b9ab2ebcfa2086d0abf693de8b8d5e4a12ef
SSDEEP 768:1E1NR6iCgj+m/wpbj9pyIstEGF5ecO/JDwAsjD9jQE716IvL2v46jHJ5/:CPYnstvocyXq9ME002v46jHb
TLSH
T192234957AEE516B6E1C3C331C89DA31FC9B1F881137486EF45E04AD59B93B5026BC70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\zip.dll
Size 73KB
SHA256 eed8ab307be46321799bdcaee6e2a01dcf9bad202f5f2ea62aa9edd71c14410f
MD5 8880ca93a2690707b5b6fc8e7ad60406
SHA1 886b5719004d1fd32040a11d98c9fb9bd4f12cf8
SHA512 3adf917293728a526ea56d41a451b2f7df49ebd0ee93c04f44afc20d810b81cea1844460c6d91a1d79f379b522e5022bb92847839dc1c6c35efd7d9651d11feb
SSDEEP 1536:wIt0O1bmgGRWuWW9jZ8CMniIOLIOyVnToIfdK+Pj7Q:wItZZbSBWCOnA9y9TBfdK+PjU
TLSH
T1BA739F165AF46261FAF655B4C4E7CA2FC372341412E4A79F429C97821F077A23B983EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAuxiliaryArchive-Remote Access_macutils32

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\JWAuxiliaryArchive-Remote Access_macutils32
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

JWrapper-Remote Access-ICNS.icns

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\JWrapper-Remote Access-ICNS.icns
Size 20KB
SHA256 7aa5bc4eec1fb270f691eed61df9d1d6747e79fd4ffc61cb42184c5453ff53af
MD5 ff93a57a50dc962ac15705fa89d90299
SHA1 be270ce368e4236152d8adf569a210a903781f91
SHA512 be0e0e462fe97d56b166b015153b6600c0bb7f8a0141723bdd420ab2393565c9ed433838eeb0564a7488d5bb3f468de68c51a15dccff9967f748fe2a994aba7f
SSDEEP 384:s5vdczFAamiBDTuyFhIHlHZABkIHDunLDdVYrfcPReZATzC5feSVpG+fI:mviFxBDnh2l54HiPdSrkZ7HkFVpGwI
TLSH
T15D92D055DAE5F6CD6B0B40932F1A7B27607F800B5A727E4C5C8EE2BB5A621008E4B097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWrapper-Remote Access-splash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\JWrapper-Remote Access-splash.png
Size 4KB
SHA256 2f7d3bc8ffbe9b3152ec9c332363247a4e89591fc1349bc0eb2e3a3d93055043
MD5 a3be1246247cfc9a93352d288e81f358
SHA1 b091ac5e9a4c638dc4d499c52fda4469d99f91c2
SHA512 f4b4b868796f5239adc7fc9d75f3c66c99a0a02fcec2b8094dc24cfe80328ca8920ced932688932d1c4328b4ab37bf74193800f27fa2017e983bb031eb9c4250
SSDEEP 96:tRbMDt1APL6F9Z7DMQC14nGVoYnunsDHvTOrnsUzlJG7bsFoBFS:UDLHXMQm4nGOg8sDH7OrnsulJGXYoW
TLSH
T1F3916EAA1B6C2CC04878C596B4C719BC391DE1748156D3D27C6EC507EA2FFDD52E2350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWrapper-Remote Access-version.txt

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\JWrapper-Remote Access-version.txt
Size 11B
SHA256 b763b26017745c203140ff015559c136a3b313dce87242c620012b03f9a3eff9
MD5 dd1e3ca806ad272ce608751c7de09566
SHA1 262eb244dc73e1ee107924987b6f787085a195f1
SHA512 1af497071d7c15c4798e0d4c0848c21909910eb822c9f6d3aad57aba4ea54f79fc384e0554154c9c55d0e54b0b86c3225d26838f3de783bdb0206b0b08e2600c
MD5 SHA1 SHA512

Submit Download

customer.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\customer.jar
Size 12.7MB
SHA256 846dcebcbae6d76c235dd75ef85f078db3658cf26ceeeabaebd26a6e5eb957fc
MD5 f44d7748e96474172ed1d1a3e64b4e69
SHA1 e73be31037e7af748cb8959576b9cb1cac64cbe0
SHA512 b573eda410cb507765d3c0dba4338e90d8755d485d63f25d71fa4a4fdd22942cf2e8d9600c26c1397a7d69f141db9cd9ea914528a57de8c0ff4c639d992a7933
SSDEEP 49152:V7SKEJhiXnIZt6ZMjr3/RZQPdCcRkaRNTOXDu6b2IMIPN7IcJosOIk/R4UmNBh0j:FXp8Jy3kafi2lANEGMqI
TLSH
T130D63A1BF3105E6FF789D3BCA56083B53A7068705343E1A2AFD968276ED66D88B407C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\customer.jar.p2
Size 3.8MB
SHA256 7cd88296a137fccab944509ddfc2cd3017025e24e1cf40e3a2e28de2b5b5300d
MD5 05179a73279d59dff1cad55af324a171
SHA1 285913f11c83376a1a51a472386240d465ae2563
SHA512 ed7f6f059e498851cd511e47a3ed82e55ac50429c8e65e95ef31470e550018966997dfe5486394c1c74a599f3b0baacfd98548baa497f8c90b5164c28b623ce6
SSDEEP 49152:aoI/AaqsUJILBO1HFOdCd4AFIuIPxsqibQB+/2VAcaIh8tJ0clv87mKNGh:afOJIdO9r9FIuIPefhtic
TLSH
T16C068E0BF74D609EE251127184A5930A2329D05A3F321FD37F1C5EA8DF867D26A3B789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\jwrapper_utils.jar
Size 2.6MB
SHA256 5c4b755a86296e29092cc59e9cc83aade7d509f2528c28d1217e59acdbbcc870
MD5 c0e7992fa5835b1d2a9e474ac2f5fde1
SHA1 2ff8017b58debe310f552f800914ed45ec7c890e
SHA512 1d74d28a8e82fb46b11dd11bdc5ebd55794bb139a545a3f4e93f58631846b6439bb75e389bfb975cdf7df950ebf13ccb6ca35de4eec756e424e059b896dab3d7
SSDEEP 24576:df0t1FIwZdFpDH38sgwZJUqZqxuFOgm/iYEOnmQtj9RtHoMBc+P1LH:FC1FHeqZqxuFOgMbnmQtDtoMBcwH
TLSH
T16BC55C17F1105E1BF285E77C296483A8777060308313F6F25F98A96B5EEA2E89F453D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\jwrapper_utils.jar.p2
Size 923KB
SHA256 bd13d69cb69faf7882a00f934a825c08669879f831c99df273eda2db1846c5e8
MD5 992336253c3205dd9b8cfac12dc307ce
SHA1 9d9e21e4aa4271276bcdccf577b02d960bbbedfa
SHA512 d81340c5f0c4477de689054c6a6a35688438390a4f36dcecc0466d6fecdabd37990359ae073ded0839fc7e768fd4cdc9bdd529a4dadacdc1846da7c2d80de661
SSDEEP 12288:BD8FXQT9muKMUQqM4nQfKPFEaabAScvtvlwStYUT10wsdQ:OXQT9muKYonQQBa0dlBj10JQ
TLSH
T14B157D0BF74D76BDE5910B3248A1870B5739D0086B3217D3372C69A4DE8339B5E2F2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwutils_win32.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\jwutils_win32.dll
Size 152KB
SHA256 5e1171f0af257c2a50235d34692f67530ef0f0d9c449cb0982ee71cfda500225
MD5 8c2bf459403b0ac34ca3f28778e7138c
SHA1 11bb00943e4c2c3fff7ab806d011a9e77e2c3b9f
SHA512 7d4c5953734fae7b5f05cf8e0ae6a87de62df72921e9d6bbbea80bbbe83d79f703c08cdf5ff2f5a729c6ca80350b3f27d7384436a8b31eed1a99d4b898bc2277
SSDEEP 3072:VtPJhhaFMlQMl0wRRfLlSZdtFPy8X+Y8+L:DBhAnMl0w7jl6+8J
TLSH
T1FAE3AE1534A3C072D04E023E51628BA5AFBF2D1377AB5ACBFBA41F891EB43D15376291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwutils_win64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855484-4-app\jwutils_win64.dll
Size 178KB
SHA256 837fefd495e9325fcbf173b6c129794ee468df2d33b6c020c5624a27738a59e9
MD5 44d8cde0d01f105b1dc3d67f096ca8e6
SHA1 ca9e3fd2971934f7afd183cb9f42786ccb9bc7ad
SHA512 9b27fb6f5fb3d17fc28b0d14cae70e59ecdbd0d16c6d04f003d3ae07281c5ff9f846d61c12a7d2e6c0c9bd8864a490d94e1ca21b21a11d01706427ec179a5caf
SSDEEP 3072:ZuQFNbxwmckLpSMyLv3vi0VloZi91wSnP7ZOq1za12bDouxpMB/gt5:D/Drq/UEESP7ZOiBHwNM5
TLSH
T1FB045C96B29640F5D5BBC23CCA924356FA7234144325A3CB17A08B792B77BE4B73D360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\MSVCR100.dll
Size 809KB
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
TLSH
T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\unpack200.exe
Size 176KB
SHA256 fc928901712fa8b6c977eaa909b2727f6b3bff577319d1a0195804bf1826cc72
MD5 e5adb17ec52853e05edb2cc715b59cc1
SHA1 0abb4d6f6eeaf18aef4474cfd27662591468643d
SHA512 ef04c83b7fccf74d7cb48535f798ff30b171627cc9f21387273feed3a8eaf575694ff4ad9f7c6e7d10de8a4bddee379579f2962c1c2cfab7adcbaffe0355043e
SSDEEP 3072:U3sMlZbgLgHFusSEc1G8YKXFk9H6PTBfBsBMER9iKE5:LMlZbgLwq7PkkPTB5sBf+
TLSH
T17B046D6227A41267D4F68179EAC3871BE6B27959037893CF80D843B21F136D12AB53ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\bin\windowslauncher.exe
Size 354KB
SHA256 6b8fa0274a99950b0d4fc89ab531092dd36038cd18b33ce570f33295536916f0
MD5 9eed0e6f480263f696cb5faae57b6238
SHA1 49aad5618fdc9fb3a29d334777915ef2d33973d9
SHA512 d5caac25ac3bef33565e9b8586122733a27d83dc4956c6b421a819ac60c470557a1ccc8c27dd0da303b682cc2a2e9d047a1c1bdd0de5cd2fd5787c7913387a0b
SSDEEP 3072:uu9l+2xLMaRyXQcp9rIzpLzOyW9VRULQwrr96imiuznUlJ2Anjv6:u4tV/w/MzpmC96tiMUlo
TLSH
T123748C92B28140F5D1E3D23A8AD60B56E7B6B015073563CF1B60846A4F7B7E86F3E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alt-rt.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\alt-rt.jar
Size 164KB
SHA256 12b54648e9d26b494c76c9e3756dab60add8f854688fc12e2c36c05891989ade
MD5 b485c439bfba1362f43a9aa241f0ff2f
SHA1 5d3fdfc49a44d0e4f1bbc1c98a4f4a22b8379479
SHA512 8ac5110301bb4f2d626a344c236fa1bd45d4d2ca0d07bdf5423706195a2259db6e30d65df135ac8f3680f3152e5223e2fb1430475f4270cae14d6d6de41964e0
SSDEEP 3072:pHgtsfIAy6ErvenLKmlit8q5cgwqE7W4QwaW7Nnkr0cfUdcPXr5:pHgigPrpjbEi4FRnkr03Ir5
TLSH
T18BF30116A200A931DB0EEE3579915213FF3EC976C203E16090B9555AAAB3C33779CF74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alt-rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\alt-rt.jar.p2
Size 132KB
SHA256 c0fd6bbba914e8c46e36cb41135dae5d6d2ff4a81b249b1f7ec7602a71743c2b
MD5 5e5864d5d3fb27ffd4cbed9c1230330a
SHA1 82a9ad2b542b21e817cb53a6da22cc2790e85216
SHA512 6c3e2b086e549a0a2f58ecc79627c20066bb03e130fd3bba2160e38148887908191c2b4ce9a316e03ae0a5f9b46019d004066a6eb0729c4e536d5d84c1f2a512
SSDEEP 1536:k9s3KRSOrqvVHFjKDu8k1gVmKa+1wBqB+YxohPr7huSrJ3ACYbkG:TmSOrqvtDiwBqBZePr8u1G
TLSH
T1D4D36B267E672749F7847D3346F42AE603E5E208383729E77E081ED4C9C379B6A10D96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\access-bridge-64.jar
Size 215KB
SHA256 0e9cf10e8be711a7fb1ac1d75924a3038421c8a6d4454dccae52588a3808687d
MD5 71003f590365d865b19f40a3ccd2cdd5
SHA1 a69d6096a773448269cf46ce0f2c8a60f24a6532
SHA512 a4082fc5ef9e85d0f8620ae564ac18d822c28189d5942ebc5e89bacef23d9c3bd94efd3c6534350e676e983cc9fe667dbd9e122816c40fc384527c954c0e3f81
SSDEEP 6144:4WD5hjfqxCifx9lpUpGhf5adUH+dcFjVSys+aU:4u5RfqxCif7bYI0d8+dGjsysnU
TLSH
T17D245C53D21DC4A7FB0E83B270A1AE527B246BBD92A342794CE92B053656C1B1734F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\access-bridge-64.jar.p2
Size 93KB
SHA256 af00fb47a4ae321b14fe5fd4438b06232e804693bc8ef8aecf7768f7bfa4dbce
MD5 8d99561938fa23598f868a72a3fd9cc6
SHA1 3e5f879f3c58011e2e0ad3e7fca6a245e952a5b1
SHA512 bc682ce0d9e097a4c9413b5bb3e1a28722a181820c319a2b9a251f26927540261f432d574e002d9af0af82be9b3a3d41817e70320b09f1c083555954ed91d6a0
SSDEEP 1536:QQaGqQIPSKzn2y3Ky4lEkE/ePNAFK3nl+G6OjjYIKKRSWdddddKfZW3ttZWIII34:vZVDla0TTTTTJTTTTTTTTTTTTTTTTTTm
TLSH
T18293F7177F07B162E2576A3652E5AB445328C388772327E76F285229CEC66C31E1FC8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\jaccess.jar
Size 40KB
SHA256 bf6d1d818d7be1a78796a1fbdd55e7b4d1b319a3aa0f29559c86a709aefe33ab
MD5 8f9b5f170f7d2b3aa31cc06da221f006
SHA1 d9af43c9fe21bc28fcc34b2b69103e54bf87a27d
SHA512 21cc4557caccafe4e48fc9ec03e283391b4ffdc8f0488fe63b9311f4f9d63eaac4ef1238dd2bbe9360fc74c1a4fe46e49cc451dec260154a946ab649df59b8bf
SSDEEP 768:Gda9mppiCkVk/34YCaXcbyOCK3QQZKNBMU+mDwl9uVngBL3YOt:GdaAzGkAoSydKgQZKNimDwbuaBzJt
TLSH
T12113B01B830CC23BE31EB2FA9651568277345DB9E45310FA0CA45B193E92C4F4BB4B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\jaccess.jar.p2
Size 34KB
SHA256 4c73ac4c8d3c02865564ab67fc5ebf0cca604463e79f0d5d34b50aac24f0495e
MD5 420b1dbe9d88f0b845af70b2b85a7174
SHA1 d6efec20f7660293780857cd77717c66677a8ec2
SHA512 5672731e257a162532fbd164d31eb724ac38d136e5e484d0c6b982e73d700aaa5d2a372e9cbef0dc19c12a6f3770dcb06ed6d5097b6ad5773db7752cc8ffae35
SSDEEP 768:hraGpFampC1dt8TTTTTJTTTTTTTTTTTTTTTTTTlMhPac:IGpwmp3TTTTTJTTTTTTTTTTTTTTTTTT0
TLSH
T194F274073353E222D3DDDE356AD5428E412092C8B75B3AAB5F889044DF96EDB2A1CD4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\sunec.jar
Size 14KB
SHA256 a7daa91c20e87c99ac165c3236ddc0b0dfab98158e927947b58e40a67e205980
MD5 12c6b2c194256c242fa90ce1d13ba327
SHA1 cdfa0c07c8563a7a5b0415d5dbc39881ca8f79c0
SHA512 41d3125f1304b1b40878b7265f645544e119c7d0856d795d2b2f537408b5d5a9055479874cf4cefe6e027558bc2e62d12652c6e28227fb37af75c86a63aada2b
SSDEEP 384:Mv2K9V+4ArJ5odMrwnjoro7EGklDkeccBm1APHsQW9/32bV9HSTt9AtSyV:Mv2K9VwJ5AMrwjoro7EGklDkeccIAvpp
TLSH
T18F628D01A935045EE64E09BFE821014BB7E906895B9393344CF0472CFD2C5BB3FBA69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\sunec.jar.p2
Size 13KB
SHA256 6b95b35c9423805cac95f85e068da8e05ea78059798b2547791a06f0913c365f
MD5 17a80f10122fbd1152586f1a629b4ca2
SHA1 4a2d56799ee970512abce9bd55413c9f5524e965
SHA512 5db24cf73fff921897684e8a06d0227d1bb1be2f4660771021d5310390dc27bc757758d9d3c5fd721eb0f67b27fab8a4d3b99dc611c7f8d78dca43efde8365e4
SSDEEP 384:yNWjdw2q03HkDAoSPUXwBIOEpHvHYHPHUHVyhHGHqH1HvHwH89Sqrs9HdHTHTH3M:y4EDxSPU2EpHvHYHPHUHVGHGHqH1HvHp
TLSH
T12B52196AB60813B1D0D41AF360F9181E293435C397463BB85EE8437CFC65AF853A92B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\sunmscapi.jar
Size 29KB
SHA256 12caaa6b270707e23c9c5f3e28c5befc17fb7620d1561854df45f606d7320d28
MD5 9887ebb27924ccfc2cf8a08d2e4edd64
SHA1 93e32c0947cb60f0d70f36f2b7c2faf91d6b1494
SHA512 9573760f5c6ba226432c3eacd1d26c0cbec0e013c00908b9f9e465e07189b6e0b791fddc7d99ed543382d962fd31d90f024aa9a5d4e8f1488b492dd227f90ec6
SSDEEP 768:uoldp+RT5fOKmRQKVnh5tjNJOs8TTHMSLRFkanDyUZClQwasRbhN362Rkm991XHA:fdKpbmR5nh5FNJZ8T7FR2aDyEwasBhNY
TLSH
T1AFD2BF17C52CC1F8FA1544F642286046BB5D4AB2CEE3632C08B7898DB52DE1F6B54A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\ext\sunmscapi.jar.p2
Size 21KB
SHA256 41e33600589250ce9af3060d071b07c6439dff055d095f473ee6f339ad9dbc4e
MD5 99c37613224c3bea31b6f4f7f6cb5edf
SHA1 b10d4bf0812c99c8dbad698b47f911b4fda2354f
SHA512 eea1c66abc9fcc13f8a49415cafede8826fcc07a1a30033fec570b74d5b7cb20241b5fd5dae47cbf3f167289298d1cc7c9677eaed62bc331dc05d7a79c2a7c74
SSDEEP 384:B/4HBDNWKTwibG12ohM1UjrYeIGjHYHvHpHIdHQHfHeHaHqHjHfHTZHXHuhH7HFW:B/4HBDTTwib8fhOUjr2OHYHvHpHKHQH4
TLSH
T141A20717F22E80E0F1C401F660FA504A173CA6D6EE135F396E9C426CFA41B7A87785B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\jsse.jar
Size 517KB
SHA256 fbe2591fcc4099b28ad1557a66daf186c52a3d9533775c742da4b1ebae7d07b0
MD5 ffb80952a3fbd720aa0e90076d4f12e2
SHA1 f1fa6555862790b26028c632334b2ba9440f8a43
SHA512 77cd6a51753e28a586e7293678027077579562a292f3dc272351ac63f11229f1df8096d47068b69d8614bf38f85f814f991286ecd204349493020408a4935cad
SSDEEP 6144:KF+e7mFaeB/+xLNgOWsrqCoRAF/zY35Mpr8VIeB:KFlAc96AhqmXeB
TLSH
T1D2B4A317F20D95BFF240EAFF9831032C23346C3259A3A3794E49492AF5DA5F54A71AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\jsse.jar.p2
Size 140KB
SHA256 8ceb17083d8934ad7d1a21dc60fa9816ca3eb18c07b04e753d82230cec1c2a5a
MD5 d661f861824fbed70a45895b1fec148d
SHA1 fb44974295a9e12c717f28f0139bdec1cb01a43f
SHA512 8d8aa3ad2b38419a215da5c3beb254e94130bc78a8fd75f77fe828526fcf90de4f64fd50071b58bf55658e7358575675b0c761ee699bd0f20602c3e0103f355f
SSDEEP 3072:gXRJdrAlQMcNuiJ82M+lz1GA7TgGCCCCDqhZIvz3p:ghrrAlQMcN3LMYt73lz5
TLSH
T1A5E37B177F0F5102D2EA2E7660F46392933AD210367A27536F451698DDCAAE2CF1EED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\rt.jar
Size 49.4MB
SHA256 f0ec1174458bbb7c5ff7aeea74a879b30cdfeb3476e9feee1eef97a287f3ce3d
MD5 181e9977a9486e9f17d050b75b856275
SHA1 6156941373d2344820a1b0e144ba6d81e1b05177
SHA512 cf7820060aa213ed54606f66b3b3e848f2bd9336985174e9e1804bc6cf0bab078cc553a85e5cc6e75a8e92fde264333d9a2aae2beeecde1e469e06696ea29d4f
SSDEEP 393216:e8BSlT0OpXHmdByAk3r8/kQi20w/eFSJd:e8BSlT09SAIr8/kQi20w/eFSH
TLSH
T14BB74C27F202DA5BEA45E2FE146103651330F4B14A83E3A95FA88D63DDE75D28F643D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1779855494-6-app\lib\rt.jar.p2
Size 12.9MB
SHA256 4d831bd637883bc58ec3d73aa8408be0ce600e205e6667d4f29097a4114dccb0
MD5 b06fd9da46b89972d0afbc7810d1cbca
SHA1 744052107972e3fdb4e4552beb97825f6a87c139
SHA512 f387e2432023488613dd96bf788eb0f1dbd80eca1e633aea8e01911e904aabc4becaae2aa2522ff757d2a7dc060097eb1ee72f351e2eedc6e41948a13b78a5f3
SSDEEP 196608:eos0S7V4zmgggLYJ4nouGR4eWC2cSw6rJn9rr:hKaagggLYJ4ouRZbln9rr
TLSH
T150D64A037A8F790AE3C11F3442B16392027AD20416773B57BE186BBCDED61E2EE15DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 536KB
SHA256 eced541580a4dd0282b47023fc2833d41a9baf8d2d895901a103b35faa613c31
MD5 60c0a746e29df97454862e63752a3a51
SHA1 df711180ead180f8665a8090732ce709fa7f8b93
SHA512 a72ea2d400029a8aa3711ba366c62b6ece44ad96a29176e1bf48ba491c7613b589e4c6490cd23bb7e202028334d1f110fcc80b902d7c6684291de8895598ee5c
SSDEEP 6144:kxS6C032eXnov1ePr+t/L8FefSjZZwh6GYOxdcG1ocX96tiMUltse5:kxS6cejKp8FefSFK4Gt+cX9OglO6
TLSH
T199C4CF0271C1E1B1D6928632B31E8BB3DF7EE1611725C1C357F059A99E392D29B3B389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 89d667e7a2c5d25bd509ccc1020c9eaea064e7d2738ea9da14c36404ca491095
MD5 8e30384e6ba44c9593eb379780f32e77
SHA1 b7462bbe1e49f55d9ebe6e8bcfd3bf196a6b2916
SHA512 b48a76c064badacb6342c2e17099e2ecf9c3905c114e7a0707001e37095ebd7b86af5b20886b9be1ae8a8e9720e490eabaadbc4cb5ed04c28d55e0424ea0d090
TLSH
T1E8F0F9B6DA20AC3B18FC072930580747E754135B2B40485B3B3D830D8FB553B8546C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 3354707a7e57324b0f39277c523bb6533fa301f195d0efe42c88d96320aff28c
MD5 df4b94170f4a8ed36c61e6a3c2476acc
SHA1 b1a59e029ab345b78a8fdf8c39f99de3697eff56
SHA512 1cc836ad80fc68cc494cff96d4a8662823eb55747efa272148000f03ef4fc6a8def118c75a384da14f5f940841031d8d2bf5226da08d71a4daca3239bcd358f3
TLSH
T121B02228F2C0A003CFC023F080C0088830B00EA202A38F82B3E320CCE03BBF0800E288
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

aed6a95b-a693-413f-8da8-af62deb0281c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aed6a95b-a693-413f-8da8-af62deb0281c.tmp
Size 2KB
SHA256 0fc0808779544fd140eaced8c294eddd3d4307b47fc032cab46e3615928123ab
MD5 080069bf01993baa349d17cac052df0f
SHA1 1e08437b8db7fab6d44101b5b6dd0367cfeb1cc5
SHA512 3741405bab988add0055b3aa1a2c51300fe319ed01e19a0245cffee401ea32284c6235d882404168445238f10255452b8dc6e970beb42b313ff3b94d270838ae
TLSH
T1F55178B3C7E8857D891152F4AB156E2FCE690A24532C3C5688E4AF4F57E2971E20068F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 080d8d1620023f7d819eca157242a0ef39f8ba4946700a798de151127bf3badd
MD5 f8471ec96ae9028766def83c7b946add
SHA1 2a0e50e2aed60d171908463ca77a32998c5e518b
SHA512 3b89e62368c5a7d3e60a6603a366aa6bb6ab4daf18fd53cd8c550f04948584864c774188a09a7589a17a817679f08277a98cee7a2c288813138ef90136f78d76
SSDEEP 192:wRAmd5RanrF9v72ympAPRp2f195Hsb+WNnmW4Kx2rX2uknkwRcz+VyIsnAUge:wRAm8R9QUXa7wvb2L2362e
TLSH
T1F242D92FBD24697B9CC7C21AF9167753E7F5106225941E84EAFC8B2C14EB5CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e15bca7bb6c4a354adbdee155112fc732db99c86e04d86b23a32a1c3784a7eba
MD5 1a00636dd6d0008495dd296be6a10e3d
SHA1 649c9ea638c0eb9961e437fba87a8a845013be15
SHA512 7e8917a2082e8571f76c6551a1c137a90cb882fafe55861f0644cdb074c565d9292dda3c17ae476e9a0fe04f8437d6567055733651758762b3b778502a71fa67
SSDEEP 192:wRAqd5RanrFWv72ympAPRp2fJ95Hsb+WNnmW4Kx2rX2uknkwRcz+VyIsnAUge:wRAq8RiQUXW7wvb2L2362e
TLSH
T1A242D92FB924697B9CCBC31AF9167753E7F5106225941E84EAFC8B2C14EB5CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5a3707f9d71e8a3ad816c8db3eb952115e060d1e42945d77187d482ce3aeb3ea
MD5 08a9e1a3fc0328999ed58c00f46dfed8
SHA1 fb83bb7639fe3dcb409075c03707a4a7389868c3
SHA512 47d47589306e6f85630dc41cc6e34de45cb96a8737461c674ccf970f1619319e4660248a305ab7cc69e49809bac35727e7e7d785aa045511ded8c32da280c629
SSDEEP 192:wRAmd5RanrFYv72ympdPRptf195Hsb+WNnmW4Kx2kX2uknkwRcS+VyIsnAUgE:wRAm8REQDXP7wvb2m2312E
TLSH
T1D852EA6FB9246D7B9CC7C21AF9127B53E7F5106225942E84EAFC8B2C15EB5CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 53751d40b86a3e9fa58aa738d7ca77e507fb774e6e5534ff906de0908024779e
MD5 885d1a4721d4b024601305a42e6f87b4
SHA1 b39cf99ecce220f8b29ac540756e723fa1f77623
SHA512 a21a70e3867654ee8496ed3f51e4b30b7119b18261ad5252c868157db524a387b373ce0a70540381d1907fa1cb9df5a965100fffb4ad4edbfafd77cf55098ecf
TLSH
T12EB01200C0039641D04302B0214754C871149F11D70B171273E06AE7CC27171C018090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585203.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585203.TMP
Size 96B
SHA256 935a5acc57e03a49088bdfac87f173ee328083f9b888da465c94166a619f5c00
MD5 dc41e5c59a85fe945413ec8fd29f0b8d
SHA1 92afc3fd10f099849908de5c4434a02412a589eb
SHA512 5d21411df782e05fd663d53219aa43174d0ddbe053e0b3700f1f61f62eeba35d4a0f75dafbdf910f9d9a3c1e68e5f9791891250a6c8a40ee00c3b0ad306d2c36
TLSH
T1FDB002E5C5026212C48217F12AA9B6D97160DF35CA131213B2E13E7BEC35B724665171
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 424561688c380eaa254170bd6f193ff2da4a02960bdd51d698944ec3c493850d
MD5 a4f73a8a77b0c2a2bd67d083b3ed8c83
SHA1 215889f5b4f540b3ac50b5f0c7cde19df9bf6316
SHA512 779ea4c38c4489192f48e9e918342eae011a2b7de3acbedff5ab5c92de9377f63281cae221f05032397d2428dbf66d7a1a96a605d430a355f6bae7ea2e23a47f
SSDEEP 1536:YExZyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:Z3qfd7NtZL8cHQRZEQ6Spsk
TLSH
T11AC30237ABC61E339ED2CB70B9130ED797B544A99034D301AB7D27EB6883495694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d273d88d60364058614290fb575382e46877be30722c2413ce744205c604ad3f
MD5 ffab12f2dcecb4a90001f285afb85f47
SHA1 8ab17b24fe4c38c965d20b286b051d9bb344b9ca
SHA512 ec7d984f4b371f23d409df8bd095bcbfdfdabbf743788e47fce15d1618d213d9bed12b4bbc69a662999cdcd06c7a2eff99da776aea615236105164cc6b852435
SSDEEP 1536:T/QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:uqfd7NtZL8cHQRZEQ6Spsk
TLSH
T118C30237EBC21F339D92CB64B9530FD697B644A99034D301EA6D77BF6C83491644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 834f3e9f69b6d41dc04bcd30df2fae4c02ca34d9809d5c7c526de5be9526a29a
MD5 b3c57509d1576237a44119c8fa64e9f8
SHA1 9cbc5667a337c6064b641641b9c692856901b396
SHA512 ade778e6f0fab55986ca35eb8d1b38fde8aea9a9894456940eb78d9865213014fbb87b787c1720a3ca765c48c04cb1a5008dfe5aedddeb1b3e35618360de8619
SSDEEP 1536:YuyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:tqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1C2C30237AFC61E339DD2DB60B9130ED793F644AA9034D305EA6D77AF6C83491A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e4655fa819649b5a55a35f1f627d94fc27b044c344bae664d8cbc90b434fe441
MD5 c92e00588025fc5db883cab1b5335480
SHA1 8b361bd3d6dbf0619d17eae59e5cf7605f592add
SHA512 e6ddf23436fc1c8a2be045985cfc4051e000f1286076047f475e9ccc05095bc9fcddd6a6975d35a53a187a243ca32e7f6174f8434e9f2736bafe373f627135e1
SSDEEP 1536:TExZyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:y3qfd7NtZL8cHQRZEQ6Spsk
TLSH
T1AAC30237ABC61E339ED2CB70B9130ED797B644A99034D301AB7D27FB6883495694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SGConfig1281926459052002200temp

Path C:\Users\Admin\AppData\Local\Temp\SGConfig1281926459052002200temp
Size 360B
SHA256 d1562fee0bace765150ec530ab473a2ca20f8625906a98ae3ec4ce6d3205f29b
MD5 3d9bafad3679666ae3bd59addb40c990
SHA1 7b1ceffaa2b96aad861cb52a7ff025b97f464028
SHA512 0dd151fd5420e34155eab58e1b5b73b4d624b27145183d3c1821ed70c23372f8c665163e48c9efcb3b79ebd3c6540fb908132e181f2c9b94bdf4788326dea521
TLSH
T176E0D8A6F0A2E1BB52CD1347C821406C0B7046185B385859FDD54250BEC91642F1B8A0
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 963029.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 963029.crdownload
Size 15.9MB
SHA256 3e56f68d4053b7ee76e381e35ac07a50e063f21f37910232cbc08bb677266bbb
MD5 601a8e538de524cee0f035247fd3a3b3
SHA1 13e9c4aa9094879a2d899bd1610b296635a6e8e6
SHA512 6bb0f44b7ffbb374daa51534d2e4b382b45d736a43cf2567679c2c20c4007381c03c9f02c88145f033205e2581dd1c1021af7ebe34fbf9ebdedb9f6f76d7c383
SSDEEP 393216:wJrPSIwPrxgU5+0QXcZBae/2TonNiY/x10CFDN3cccQrgeQToFFWJv:groPVk0GMb/Ji4x1NDa88Jv
TLSH
T1A3F6332BF65A04FAD877D538C99542A3FB71B156032962D707A48C361F7A3E5223B30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SGConfig8972271354570692137temp

Path C:\Windows\Temp\SGConfig8972271354570692137temp
Size 358B
SHA256 c97a470f43dc9382ed28964be55cdaf74557195c4328a9607a0a335d8684f875
MD5 2eef839960ca1202b631d80c324afafe
SHA1 915ef81dd58cd187129d0ed3bb1be9d4294f98f2
SHA512 04995dffe35bdb0f5549cb9b4493fee01e772a96b3eee854dcd42d1fbe11e54be867df5b48d430ea2b35adf939abcf3b71813a3f0d9c1ecf6743ae979423062d
TLSH
T1F9E0D8A6F1A2A17B52CD1347C821406C0B7186185A388859FCD54290BECD1642F1BDA0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1952-1191-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/3000-1029-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/3000-1030-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/3000-1014-0x0000000003050000-0x0000000003082000-memory.dmp

Download

memory/3000-1074-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/3000-1145-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/3992-1086-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/5248-1318-0x0000000007170000-0x00000000071C8000-memory.dmp

Download

memory/5248-1298-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1315-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1329-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1339-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1338-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1346-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1350-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1357-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1360-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1361-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1368-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1373-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1385-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1310-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1237-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1424-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1668-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1239-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1314-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1256-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1264-0x0000000007310000-0x0000000007342000-memory.dmp

Download

memory/5248-1266-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5248-1295-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/5268-1634-0x0000000006B00000-0x0000000006B32000-memory.dmp

Download

memory/5268-1605-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/5268-1670-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/5268-1636-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/5268-1625-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/5268-1608-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/5484-1503-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1470-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1541-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1508-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1498-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1571-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1497-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1580-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1586-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1537-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1538-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1534-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1495-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1542-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1532-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1468-0x0000000008360000-0x0000000008392000-memory.dmp

Download

memory/5484-1419-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1511-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5484-1460-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5708-1689-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/5708-1706-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/5708-1708-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/5708-1729-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/5708-1745-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/5708-1747-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/5708-1749-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/5708-1663-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download