86844b09dda6be037c930e0e6624af762e0184749c0557a4ad3ba4b8d6ddb908

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Expense-Summary-Report-xlsx.exe
Size 7.0MB
Sample260608-wyltwaev7m
SHA256 86844b09dda6be037c930e0e6624af762e0184749c0557a4ad3ba4b8d6ddb908
MD5 18039d83553ace979886234e2515b258
SHA1 5ac430370d9621185f76f5c0fa628ac13c6eb93f
SHA512 07079282c2828846e911c72122b36a06d5bebbc0184a0af15d91dc65e3dd53a79ffe4af817e5ca356cfb06ad56d82c36fef61bfaf38a106bb176cda7dd24fe83
SSDEEP 196608:pXzvm6eIrZ3K3xnLZGTIB4M+IFQyXI5q0:U1I130xgxIFQyXG/
TLSH
T1D8762378E3E25DBDDF27A6BCD04E48DBA75BB9A203C4012717F086D58B212D4442EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies file permissions 1 TTPs 16 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2148	icacls.exe
3216	icacls.exe
3344	icacls.exe
1128	icacls.exe
4824	icacls.exe
3460	icacls.exe
1640	icacls.exe
272	icacls.exe
2856	icacls.exe
852	icacls.exe
3408	icacls.exe
1100	icacls.exe
764	icacls.exe
2404	icacls.exe
4668	icacls.exe
2872	icacls.exe

Modifies Windows Firewall 2 TTPs 5 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2448	netsh.exe
4604	netsh.exe
4272	netsh.exe
3412	netsh.exe
4944	netsh.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4062111013\48525363.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4052159476\677742242.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2879188468\1605509895.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1388509667\3993412578.pri	netsh.exe
File created	C:\Windows\rescache\_merged\98783150\6834786.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2343073371\1569279590.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3989159129\434872411.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3766950118\3892743821.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3559780703\2489599704.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2878548818\843200371.pri	netsh.exe
File created	C:\Windows\rescache\_merged\566188972\3048990876.pri	netsh.exe
File created	C:\Windows\rescache\_merged\718100698\3090773605.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1831202810\1497566487.pri	netsh.exe

Executes dropped EXE 26 IoCs

pid	Process
3612	unpack200.exe
272	unpack200.exe
672	unpack200.exe
2392	unpack200.exe
4824	unpack200.exe
2088	unpack200.exe
1360	unpack200.exe
2872	unpack200.exe
1104	unpack200.exe
2148	unpack200.exe
4756	unpack200.exe
3648	windowslauncher.exe
2144	Remote AccessECompatibility.exe
2896	Remote AccessLauncher.exe
752	Remote Access.exe
4916	SimpleService.exe
4888	SimpleService.exe
4612	SimpleService.exe
4752	Remote Access Service.exe
2268	Remote Access.exe
456	session_win.exe
1756	elev_win.exe
1128	session_win.exe
1796	elev_win.exe
364	session_win.exe
5068	elev_win.exe

Loads dropped DLL 61 IoCs

pid	Process
3612	unpack200.exe
272	unpack200.exe
672	unpack200.exe
2392	unpack200.exe
4824	unpack200.exe
2088	unpack200.exe
1360	unpack200.exe
2872	unpack200.exe
1104	unpack200.exe
2148	unpack200.exe
4756	unpack200.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
5084	Expense-Summary-Report-xlsx.exe
2144	Remote AccessECompatibility.exe
2144	Remote AccessECompatibility.exe
2144	Remote AccessECompatibility.exe
2144	Remote AccessECompatibility.exe
2144	Remote AccessECompatibility.exe
2144	Remote AccessECompatibility.exe
2144	Remote AccessECompatibility.exe
2896	Remote AccessLauncher.exe
2896	Remote AccessLauncher.exe
2896	Remote AccessLauncher.exe
2896	Remote AccessLauncher.exe
2896	Remote AccessLauncher.exe
2896	Remote AccessLauncher.exe
2896	Remote AccessLauncher.exe
752	Remote Access.exe
752	Remote Access.exe
752	Remote Access.exe
752	Remote Access.exe
752	Remote Access.exe
752	Remote Access.exe
752	Remote Access.exe
752	Remote Access.exe
752	Remote Access.exe
752	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe
2268	Remote Access.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d75a031035819f	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9001 = "BranchCache - Peer Discovery (Uses WSD)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-37302 = "mDNS"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2\a01460c8\@{Microsoft.AccountsControl_10.0.22000.1_neutral__cw5n1h2txyewy?ms-resource://Micr = "Email and accounts"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77\a01460c8\@{Microsoft.Windows.PeopleExperienceHost_10.0.22000.1_neutral_neutral_ = "Windows Shell Experience"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@wlansvc.dll,-36864 = "WLAN Service - WFD Application Services Platform Coordination Protocol (Uses UDP)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8\@{Microsoft.LockApp_10.0.22000.1_neutral__cw5n1h2txyewy?ms-resource://Microsoft.LockApp/re = "Windows Default Lock Screen"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri\1d75a02fec917bd\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri\1d75a02fec917bd	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-60501 = "Cloud Identity"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7d187d47a1c02	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@wlansvc.dll,-36865 = "WLAN Service - WFD Services Kernel Mode Driver Rules"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\icsvc.dll,-700 = "Virtual Machine Monitoring"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7d187d47a1c02\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7d187d47a1c02\a01460c8\@{Microsoft.Windows.Search_1.16.0.22000_neutral_neutral_cw5n1h2txyewy?ms-resource:/ = "Windows Search"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8\@{Microsoft.Windows.ParentalControls_1000.22000.1.0_neutral_neutral_cw5n1h2txyewy?ms-resourc = "Microsoft family features"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9003 = "BranchCache - Hosted Cache Client (Uses HTTPS)"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9002 = "BranchCache - Hosted Cache Server (Uses HTTPS)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39\a01460c8\@{MicrosoftWindows.Client.CBS_1000.22000.493.0_x64__cw5n1h2txyewy?ms-resource:// = "Windows Feature Experience Pack"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68\a01460c8\@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resour = "Desktop App Web Viewer"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9000 = "BranchCache - Content Retrieval (Uses HTTP)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
456	session_win.exe
456	session_win.exe
1128	session_win.exe
1128	session_win.exe
364	session_win.exe
364	session_win.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5084	Expense-Summary-Report-xlsx.exe
752	Remote Access.exe
2268	Remote Access.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3612	5084	Expense-Summary-Report-xlsx.exe	82
PID 5084 wrote to memory of 272	5084	Expense-Summary-Report-xlsx.exe	83
PID 5084 wrote to memory of 672	5084	Expense-Summary-Report-xlsx.exe	84
PID 5084 wrote to memory of 2392	5084	Expense-Summary-Report-xlsx.exe	85
PID 5084 wrote to memory of 4824	5084	Expense-Summary-Report-xlsx.exe	86
PID 5084 wrote to memory of 2088	5084	Expense-Summary-Report-xlsx.exe	87
PID 5084 wrote to memory of 1360	5084	Expense-Summary-Report-xlsx.exe	88
PID 5084 wrote to memory of 2872	5084	Expense-Summary-Report-xlsx.exe	89
PID 5084 wrote to memory of 1104	5084	Expense-Summary-Report-xlsx.exe	90
PID 5084 wrote to memory of 2148	5084	Expense-Summary-Report-xlsx.exe	91
PID 5084 wrote to memory of 4756	5084	Expense-Summary-Report-xlsx.exe	93
PID 5084 wrote to memory of 3648	5084	Expense-Summary-Report-xlsx.exe	94
PID 5084 wrote to memory of 2144	5084	Expense-Summary-Report-xlsx.exe	95
PID 5084 wrote to memory of 764	5084	Expense-Summary-Report-xlsx.exe	96
PID 5084 wrote to memory of 2404	5084	Expense-Summary-Report-xlsx.exe	97
PID 5084 wrote to memory of 2872	5084	Expense-Summary-Report-xlsx.exe	98
PID 5084 wrote to memory of 2148	5084	Expense-Summary-Report-xlsx.exe	101
PID 5084 wrote to memory of 2896	5084	Expense-Summary-Report-xlsx.exe	104
PID 5084 wrote to memory of 752	5084	Expense-Summary-Report-xlsx.exe	105
PID 752 wrote to memory of 3216	752	Remote Access.exe	106
PID 752 wrote to memory of 3344	752	Remote Access.exe	107
PID 752 wrote to memory of 1128	752	Remote Access.exe	110
PID 752 wrote to memory of 272	752	Remote Access.exe	111
PID 752 wrote to memory of 4824	752	Remote Access.exe	112
PID 752 wrote to memory of 2856	752	Remote Access.exe	116
PID 752 wrote to memory of 4916	752	Remote Access.exe	118
PID 752 wrote to memory of 4888	752	Remote Access.exe	119
PID 4612 wrote to memory of 4752	4612	SimpleService.exe	121
PID 752 wrote to memory of 852	752	Remote Access.exe	122
PID 752 wrote to memory of 3460	752	Remote Access.exe	125
PID 4752 wrote to memory of 2268	4752	Remote Access Service.exe	124
PID 2268 wrote to memory of 1100	2268	Remote Access.exe	127
PID 2268 wrote to memory of 3408	2268	Remote Access.exe	129
PID 2268 wrote to memory of 2448	2268	Remote Access.exe	131
PID 2268 wrote to memory of 4604	2268	Remote Access.exe	134
PID 2268 wrote to memory of 4272	2268	Remote Access.exe	136
PID 2268 wrote to memory of 3412	2268	Remote Access.exe	138
PID 2268 wrote to memory of 4944	2268	Remote Access.exe	140
PID 2268 wrote to memory of 1640	2268	Remote Access.exe	142
PID 2268 wrote to memory of 4668	2268	Remote Access.exe	144
PID 2268 wrote to memory of 456	2268	Remote Access.exe	146
PID 456 wrote to memory of 1756	456	session_win.exe	147
PID 2268 wrote to memory of 1128	2268	Remote Access.exe	148
PID 1128 wrote to memory of 1796	1128	session_win.exe	149
PID 2268 wrote to memory of 364	2268	Remote Access.exe	150
PID 364 wrote to memory of 5068	364	session_win.exe	151

C:\Users\Admin\AppData\Local\Temp\Expense-Summary-Report-xlsx.exe
"C:\Users\Admin\AppData\Local\Temp\Expense-Summary-Report-xlsx.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\crs-agent.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\crs-agent.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3612
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\charsets.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\charsets.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:272
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\jsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:672
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\jaccess.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2392
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\sunpkcs11.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\sunpkcs11.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4824
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\openjsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\openjsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2088
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\legacy8ujsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\legacy8ujsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1360
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\cldrdata.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\cldrdata.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2872
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\access-bridge-64.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\access-bridge-64.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1104
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\sunmscapi.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2148
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4756
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\windowslauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\windowslauncher.exe" "-Xshare:dump"
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote AccessECompatibility.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote AccessECompatibility.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942915809-5\remoteaccess-jar-with-dependencies.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942915809-5\unrestricted\JWLaunchProperties-1780942919966-0"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2144
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /c /grant *S-1-5-32-545:RX
  2⤵
  - Modifies file permissions
  PID:764
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /c /grant *S-1-5-32-545:RX
  2⤵
  - Modifies file permissions
  PID:2404
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /c /grant *S-1-5-32-545:RX
  2⤵
  - Modifies file permissions
  PID:2872
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /c /grant *S-1-5-32-545:RX
  2⤵
  - Modifies file permissions
  PID:2148
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote AccessLauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\remoteaccess-jar-with-dependencies.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\unrestricted\JWLaunchProperties-1780942921305-2"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2896
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote Access.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\remoteaccess-jar-with-dependencies.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\unrestricted\JWLaunchProperties-1780942921997-3"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:3216
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:3344
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:1128
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:272
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:4824
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted" /t /c /grant *S-1-5-32-545:(OI)(CI)RX
    3⤵
    - Modifies file permissions
    PID:2856
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4916
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    PID:4888
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:852
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /c /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:3460

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote Access.exe" "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00095171916-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00095171916-complete\unrestricted\JWLaunchProperties-2826464086-23"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\ProgramData\JWrapper-Remote Access" /t /remove *S-1-1-0
      4⤵
      Modifies file permissions
      PID:1100
  - - C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /t /c /grant *S-1-5-32-545:(OI)(CI)RX
      4⤵
      Modifies file permissions
      PID:3408
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Drops file in Windows directory
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:2448
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service" "description=Inbound rule for the Remote Access Service to facilitate access sessions" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote Access.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4604
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Updater" "description=Inbound rule for the Remote Access Service updater" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote AccessECompatibility.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4272
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Launcher" "description=Inbound rule for the launcher that can spawn the Remote Access Service" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\Remote AccessLauncher.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3412
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:4944
  - - C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\ProgramData\SimpleHelp" /t /c /grant *S-1-1-0:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:1640
  - - C:\Windows\SYSTEM32\icacls.exe
      icacls "C:\ProgramData\SimpleHelp\ElevateSH" /t /c /grant *S-1-5-32-545:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4668
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:456
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1756
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:1796
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:364
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SimpleService.exe

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
Size 113KB
SHA256 313000b647e07fe9c08d538d160b5adb4849a7e2e19c16e5e0f188b176470229
MD5 871f2ae119ac463e75bbeabc1e925aa9
SHA1 694d8b456abc255da9ec0e9b270116163cb5d132
SHA512 cd1e7eda3b0591b20587990bcacaadc2424d2f9f72d071c3c4efac4bbb16665c7b267ae332f95cadf1ca3501f3d7b9cbc9fbbd3cff07e1fc69bf3c9f805f1ce3
SSDEEP 1536:OpbP7TtLV/xaTIn5ei4dJe5xmtvgX93uSpp2cuty/tKBmACNBuACNA:UHj93uuw0/tKBmF+Fu
TLSH
T10AB39E41B9E2C073E442453246C1C7E29F7FBC637EBB1497F7AC06491E923C8166A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secmsg-httpGVV13U140U138U164G8008.secmsg.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\secmsg\secmsg-httpGVV13U140U138U164G8008.secmsg.afos_complete
Size 146B
SHA256 6ebea58d289c86798b612ebe2fb0ea5b6ed86b760184d176e2f95e74ec9b6f6a
MD5 67ce05d461d94eb232178df65bac0253
SHA1 541b4fd6d8751b320f8de428e267ed0d130fa3a0
SHA512 ba40d24f5641920437ed6c629b5b6fdfe319ced194238467269dfec23efd81029f07fe25cca6d1fc8b760710f7954f4154a05b8d2755af6f7e61f4daa76523bf
TLSH
T127C08C1CC690DA4B560C5A5AB8F1AC53808109BDCE8932408F5B0EA117B2220368C135
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 387B
SHA256 598958d9bcf57983e212695b26ee5f4374d275259f76b8242968b3413e9f59dd
MD5 f8a29bbbb5a67f516438468b5fa3df73
SHA1 58252c8147d476f0cb2760fa0cf9b160e405bccc
SHA512 aee228a6c0ea0f9b905326b5b528ed1269b62820532c28f398fd76b5b83a26ae9ba738bab59ed70b040c140739b7687464e2b0d212504b872372e00fa3edacca
TLSH
T1C7E06195F4B2E1BB51CC5307C831406C077045188B342849FED94190BE8D1657F1F4B0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceid.dat.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.dat.afos_complete
Size 16KB
SHA256 dcb80b2a35da7cc3c6972109b10d51bc555f9095c1dd9c86ed477e2397a52380
MD5 af44ece8532e63cfdc2be0b8c5dbdf5e
SHA1 9307756cffe38c609922f3b72d5fb09bdc89af0e
SHA512 67466bd9c7d0f2070328419009efcfe5aeeef239dee8aa9448f6327e84568957d6fee7cc2e35950c0cc96f9ee50f5b045df53edd168e1e92d72be57712b7cdc4
SSDEEP 3:h5OWCK8ZmU5W6IQT94gyNAUuFgb6/:Wlnz5WnGegE2e
TLSH
T1B372121A09081ED8C0900AF410383D01C035B89744833421421918604451F884917400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JreNameOverride.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JreNameOverride.afos_complete
Size 13B
SHA256 e4c596fe101978f244b8f74be616d62bbaae083f881928da51255b0dba50d440
MD5 8199887131477d02232d372bc808cfd5
SHA1 c172ffd15c0fb02432429632272a066b8516e077
SHA512 8623a7e6bb4673572c47035280cecbf09d02a71de54f86a2a3376de080df33af8dbe0d2e5c460779a899ca3d51e5b4c7b1a264ed4089af40b05c187524606026
MD5 SHA1 SHA512

Submit Download

jwutils_win64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00095171916-complete\jwutils_win64.dll
Size 243KB
SHA256 061e2aa6fe2e27b6f2595b4703486c9bfb603cb276b780bc43f63b1f1b844198
MD5 3bc9749f5118f7d5f8c652cb59a60787
SHA1 a570885b6085bb29ae31acf9b806ae7563ca2f56
SHA512 fadfed1fc1ac700149bcce4343720465fc6fa5a96b4da48a7dfffcc0f3ccfc01593688f86d19a4da80bec8370130478fb6336110173d46282c38c443d723e661
SSDEEP 3072:6r89CMpnp0Goz/QHaXipiyRbJFDzQv7khZOq44lZK2hKZyqpiXBbgFFXFxFEsFgq:htxphC/bY/qIhZOzPQxMB/6s6kj
TLSH
T1E6347C86B26520B2D6ABDA3CCAE14257FE727440873453CB12648B792BB7BE4773C315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nativesplash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00095171916-complete\nativesplash.png
Size 8KB
SHA256 5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7
MD5 08051133e368d61036576d3ed5b9cc14
SHA1 817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5
SHA512 93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce
SSDEEP 192:XFcpG2JMh/HwqndQb0qZzAuc6SyLK8hC5W+Cyd9kipsR5iyjR:ik48YadQbxO6PLpCWHGVSIyjR
TLSH
T16112BFCC406E7CA471E2012A8A44C75117B625B11D55BE2A3A41DCEB618CEDF2CFBAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\unrestricted\jwLastRun
Size 13B
SHA256 832d65d39bb45ebedcb69a57640393cb88eeb248325c335348775613c59b80f8
MD5 bde3a12d657624dee4edbc15a6e30f13
SHA1 8f355cc62f589cb3fe4f6f6e8b339bae8232eeea
SHA512 3fbcb3cc2e7b47665c0c884e1cd5a1cf430be8cf348bb3f0ed91aa00264199a0499ce7d7330f2be3e62864cef57a27e46780aa91aa46467c920f8f4b5cf8fe34
MD5 SHA1 SHA512

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00095171921-complete\unrestricted\jwLastRun
Size 13B
SHA256 e31f5dfdbcaf54af6dc3244982254e3f6bed621e060609cdc5d6332cc175d00a
MD5 a66a50b1e6e39007a10fefd6f9b5ec09
SHA1 696cdd0573b8c879821e15aaef246f0bb1e1b7e4
SHA512 b15e0ac1f4b9f9b24cf341cc535d81f8dd0a67d96485ab1b7f112ef927c748343675a976a40870a559bfb03cde8ddafa06a23e54ddb6201fa86e001ab4fbb328
MD5 SHA1 SHA512

Submit Download

awt.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\awt.dll
Size 1.4MB
SHA256 863341b363ef99625f76347a421d49a971e690f7a66f21fa7f897eca41166d2e
MD5 727db926e0e032ca5d96f485638693a1
SHA1 10307fc79c713c55d831557f73e7a64dd5eece17
SHA512 b2da4046ad30dda95caed3c143c2c45df13e919888f5fd4bfadb7cce8e92c99f470bc9f98b0a651d14f4d0a17615b3c3e01e44376c12af4a81f016dbb643dd4b
SSDEEP 24576:a+1kWjiUx2XwBRqfDyBvrPHqzftZY9pRGggc23zIhYUewbpkswERd5u2mI9JA:a+1kWjitXwBUfD8vrPHqzf3Y9ug/ISYn
TLSH
T1C7657C0AA7A440A5D477C2B8C55B870BE7B27445035083DB64AADB2F7F27BF1A639312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\java.dll
Size 156KB
SHA256 12687c8b9bc286807d3bcff6c26465a483900b05aa0da6d15871ea5e9a1ed96e
MD5 c15b283310fcf536e39d816db8349990
SHA1 3db459debe6ebb1cd186e6b34687c62311367546
SHA512 6c2193ad240a26fe12481057d9ce274c0bdd6e3f9491d9b7c611cff1fb5fb8aead309136076511c1e8037e2bbc5f930ea396f7ddfc1c08256f0356967b97228d
SSDEEP 3072:25YvxKbFFDAO35QQlNPai+hkPlf9KipIn3/VUVhEL3c66:abXDnKQFHZ2m23cj
TLSH
T1D7F3184B925240A3F85771B8B0665003E3B67458023D837B47E18B8E5FBFB62BD97B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\net.dll
Size 96KB
SHA256 08f3a8c065d952fcc5cae7a912adc46fe4d02029207b170feaae5410784fc851
MD5 1c5ae3178f47607de9674521c4ee26f2
SHA1 f8991b430a2b8ded0982595e0ac50a2b9623d30d
SHA512 b070cf3563025e6105acf04c872eb234b5891c99ed50db91050b329de55c9ee4339d3f2fdbac184901e6869c861d3cfe079d9eb88bd786183e3f7937b84c8cb8
SSDEEP 1536:d1eU1I80FJXWhHXeHqKimWHkLFMvzsbUxybYIqD/j/Lg3PU3r:CUmJ1W1XeH9ixELFMsG9D7jw83r
TLSH
T1CBA34B1863641095F877D1FCC2818603D7B3B460662093AF13A6C99BAFDFB727E29781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\nio.dll
Size 59KB
SHA256 52445b77e22d3859dbf2d8734eac52812d35915ae46898181fd26e89ea30d42c
MD5 44caf09544edb1c1a23c2c176d5f158e
SHA1 35ac012bbd0bf776640987b2e1be3b8f0cd3d18e
SHA512 6e48610adf9bdaafeb959613a939b605e363518cd6c942926f6e21895dde03d54dc68f2406982fd7ed5907965c98ccd9cf96edb5056a58debf3b4fd9561b3c83
SSDEEP 1536:x037/svhIKfPfgq7MBYgALIu0K8WXJ31ljX:x03KIq7g6LIc8WZ31ljX
TLSH
T1C15329B2836088D3D46AB13C929A074BE423F8119514A76F422CCB559FAF7B33D3D792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\server\jvm.dll
Size 8.6MB
SHA256 f8473f869f6ce88126eabb6ae4b1b765caf2780faabfb734287f33fa9af9df1e
MD5 2bd9330f2caff97fe12f4a330ae1f107
SHA1 3ab7e69839c584a16328d773a657245e19f32847
SHA512 aa3b99ac1ec80e4dc665ebcd5262cc6818f62734e9063ecf4b1bf6ec099c391d1eeb26108677a841b28ec2c558322dc3b114b75206d0aee196f659a263540c46
SSDEEP 196608:xK2Mcih/J+hijUfvHyukXG1h5tnFblKDzQQ7:xK2McidJ+hijU3CShDnFblKDzR7
TLSH
T177965CBEA7B00098F47EC178CE9AC61BDBB174A407309BE792B017525B13BE7157A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\unpack.dll
Size 78KB
SHA256 f6af7e85e44fafc6e32d568aa32f772d2228ea88364ea8b0dba17933994fc7c4
MD5 bb75bfac224db1f34600a575a8124cff
SHA1 ae656bffe117382938eb124c45aad6fd52893f43
SHA512 39ee48f65df195a60f7b374f976d1accfc57f1988569c2e713dc523bb7c8002984bbaf5400ff879c8137288dfdbf6b6383b70bd96f548a1eb83f340007486eaf
SSDEEP 1536:aomjjzWtEoTtq9rMDtmynJmQmANzQZ+zT57p3T:aoizpow9rMDQynJrNzQZ+zTFp3T
TLSH
T198733AA363A00071D4E78135F8D7DA23D7FAB9B60338838F81A587762F173815EA5366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\verify.dll
Size 48KB
SHA256 981dafa227a6ff4e1bf9a38d94800b28f1e39adc6fe5f76b9362206bd7346ebe
MD5 38bdc89172aca98a8df57cc6b0e5e8db
SHA1 2448538975c6daf00f4014d166ebb014d2374e8f
SHA512 9fc3d626948f0990a311e3710786f6028e66cf75d6926c3d433526a349c93492cf7b7b1bfe7499eb88970e5342fd0201b58b7f227bfc009057dea7517b67b29f
SSDEEP 768:WYkpGTievAR+x/Olkj1ZyiQLdYn+KP1aU19pEiOT8rH6EBXdrevPiDG/IhLl:yELxRn3HfpEwz6Sd6vP2
TLSH
T133236C26E2A05871E8C79034E6D79FC7D6B1F8DE1350D29F21E4890D9F4BB5227E822D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00084000053-complete\bin\zip.dll
Size 77KB
SHA256 cf661a6d7172f64f3a7d9559eba32c3363ea26a913ae56420a0a184a42198320
MD5 a9040ad98ad82934efbac3de57f9acc2
SHA1 904e1b26aa21b7e7c065706ac4065ec43310b2a0
SHA512 848678c637349d59b5947a50ae6736882b260f00b31ed6b39d205a28bd9d9415e43bc7499c8cc5b3f1dc2b6b476f964583aa3bdb8fffbc6f35f363bad3d694ae
SSDEEP 1536:JIaBtdoMaf34l03mzjur5WMa0EaIOQIO+VnToIfJIxqV:JIWo74CyMzxG+9TBfJIYV
TLSH
T167738C498AE05291FAFA55B484E68A2FC772305162D4939F934C97921F433A23F9C3FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\MSVCR100.dll
Size 809KB
SHA256 ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5
MD5 366fd6f3a451351b5df2d7c4ecf4c73a
SHA1 50db750522b9630757f91b53df377fd4ed4e2d66
SHA512 2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130
SSDEEP 12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1
TLSH
T181059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\unpack200.exe
Size 195KB
SHA256 2f5955b1d5bfd13f0c3b70c5a261df5d524a849a45c0d31f64478188cbe82665
MD5 ffae954c09033df1ebcd4fe056b183f2
SHA1 ee369cf9a6d4ab2f91a05fe84bf790fdda873669
SHA512 be00fc9c0242d27e0f8cca0a0af39bcee502683dd0246e7453b6b4aebccd81ea221a4b14ccef48244920a180bc268132f7ca4584efa46a648a7bec9c1a7da3d4
SSDEEP 6144:cz9r2O8SSh4tNRIOcTtOTBZAqQNTwd+ZI:W9rAPhm6OTPAqQNTwdgI
TLSH
T1DA147CA227A011A2D9F6817999C3C72BD7B23565037493CB90CC83B61F036D56AB93FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\bin\windowslauncher.exe
Size 169KB
SHA256 214b6e8108349c7bb4944b4d20bbc44c8b2e55ed69dc28f8651e44bf72dd9dcf
MD5 a46bb5fba9e69463fb89039d19fea2b0
SHA1 a96561051f7cd1d10c87bfad290c5131191686d3
SHA512 05a6fd898bd21a9714516def4b564cba252d633ddefa582ffb1920d5ba9fe551d8bc168dd78e4658524aee8e91b2e815d3f800b89357a61d133d90a65653cfcc
SSDEEP 3072:TV8eyUbavDzJwkfJvnWsv9rsuQguAXwZ+LRrwZxm9tZe0GNpNu:5M1dfMsVguQgZMEy3o
TLSH
T1D30427B272F530F1C7B6B63989910652AB62B050473673CB127881350AE77EB6E393F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\charsets.jar
Size 2.9MB
SHA256 a5054fc62377f0eb99fe75e17f3c08ed5fb64f120e0797e6722f51db176aa87f
MD5 95c96b758db5b270c574027da01826e7
SHA1 9546a1e1817847d185fda77ed807ef5c93beb5e1
SHA512 b973fe482d769078a24417c840287292634a38e6f049ba4a8d1f91a9e0d246f42f18a2e869f211bb2a9f7f079d060a59bc7b258cd01761cafd70df09d8877b6a
SSDEEP 49152:IwniRxz1nwdk3ehtSKdEUH2E2CbnvvoelbIsjO:vnirzNV408Zn3dlbI9
TLSH
T13EE5AF9344451EAFD20B52BF1B60EE0B670E7CA61907B240FDB95C1AE94D72F68D2F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\charsets.jar.p2
Size 1022KB
SHA256 62bcb3385c37e914be0ed0eb4e4c41f4b01a4a6123c784a8838aef53f35674fd
MD5 18c2b0d47a25b263c555edc4305b3a62
SHA1 8a76193e200e5cefe782c617966282157a535087
SHA512 f805973fc99d46cd485806d9e4b5a4acf6462d9e900245a3e0208cbded18f78f8e1afb9ca29ed82876ecede79342932c1a4e2645a719ff1408f213f0c4c4b50a
SSDEEP 12288:H+BXim0XyhTMeRoqkobZ36qoCFsQn3cE1JrEc3D4F:Hiym0eRog56Wn3PcF
TLSH
T1EA2583037D6C3A64D61E6F714AB98F56933350183B970AEBDA186A18CEF31F35611BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs-agent.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\crs-agent.jar
Size 145KB
SHA256 2ee219b2825d2174e5a03ff15a7bc3fa2a72d6322672abb2bc3be2ba7153f550
MD5 d1f7a7fb0a46eda64b92d27bf48ff07c
SHA1 e26e4f4b326e4e1e3a47a27b10f4f7335efecaf3
SHA512 6034451481dcf2d4483e5edaae6c60197cb3a7f6c0ec726c7b0f8209632523d24ed7e4548df2942ed18e93c2cdd08a8d4be483d5329dd400aa97543de2b865e0
SSDEEP 3072:T4pT1xcQRJrf1B/dSjNlyx9igbJJQZeOIlfVXWXKQxJM:MpcQRRdB/cC/igZFRVmPxW
TLSH
T130E3D017AD8C907EE91BCAB1A566C472D439D8B8900FF117A6B45DCC0E26E46D70BECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs-agent.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\crs-agent.jar.p2
Size 83KB
SHA256 75e2fcd8e5db747c4f2619c67e9a6898b083318dbab0b4276052593a9ed22825
MD5 7618098477e433a3297beec060e38554
SHA1 e57585e7f78f8290a534bae6bbe85e89bf59b671
SHA512 fc46a67c3c7e3bcb0f3e8e2611a749692fe4c2cdf1ac89b9e5013ddc6f58bbab4d012e58cd85901f0d171c8ff5e9e5ca3c08811abac38d89776f67dd1b72b56e
SSDEEP 1536:7mUlPrLpiahcdI7gSiCRnMxzXWr2j8+Gyp+dkeLLWM7Hj36yu68D5p646bd2yqVO:LlPrLpisBM1xx8Ip+vf36yu68DX646bN
TLSH
T183837D03F99E01B6D1851BB284B543456B30C24F2A235346BE5D56A8CFDABC61E3BF87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\access-bridge-64.jar
Size 191KB
SHA256 5eb097f8dafde9fde128f4551ecba725e8343b637a7564a7fe70b2eb35c9e983
MD5 4d15b4682bd758875cbdafeff2fe6bf7
SHA1 741e6dd1ed48fe2d60db86e55653f8c3a0ae94f8
SHA512 98758c04d675bf9712f1622d8fb4b04199980e0beda3aec5e81d8d41d3f7cd2f0de1e0e89c42d79235e02bc12b332e90912b4f843c35e9c5b8380c91cef7060f
SSDEEP 3072:uS6k44y4fz0LQFdlkfpnMaoyDXrUloNJ7IObmaUsl:ILs70Zqao+7k6J7IObmol
TLSH
T1E9146C03FACAC45BF907C3B25090EB52B90A6D7C90E2927F5DD95B482652C0F1771BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\access-bridge-64.jar.p2
Size 68KB
SHA256 e752dca0e0913fa722aa507538976e66e5425db6b3ef36001013b4398066b2b9
MD5 a9c19296cfff6730388171354874280e
SHA1 48db4034cd603d01603921f19bc623cb08e9c96c
SHA512 96517ff57b0328385b59a1f479e377e0563e316264fd6f9ca0c542c7c0b8669fe012e531ec4724fe85164dd950230c2bbbb1156408c67816832ea1163031231b
SSDEEP 1536:FLpN00QYQvWCdznpQ8Q/JIEzNbyaRUcAgNBY6OjjYIKKuSWdddddKfaW3ttapII6:q7cI2z2RNp
TLSH
T1BA63B455BF8A3112E69BA77219F07600572CC354672F27B67FA8962AC4D22D3423FC4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\cldrdata.jar
Size 3.7MB
SHA256 b75092d771cee147d756f462e8b21dc846abc59199a3abda1ea2a04305e4117e
MD5 a2215ebc2eb45090237ab049407ff166
SHA1 fa8780bb08079fa5a068257809c538b0b58afebd
SHA512 543efc2f87d7469d72c01d748176cacdfe160956c28721a5255266af40856c752a05ac75e9bc1b46faeb785e7a6323744e882ac996a8f3eb8bca4248154f3e7f
SSDEEP 98304:yqh7xUQK1EaAkquBNwTRIn4P6J8DvwMEA+ZAHCK/ht:X7xUEjP6JgyA9iy
TLSH
T170060252ADE5443AC23B95F00420C113F507C15EF096949BEBF48A8A2AF5FDBD247EAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\cldrdata.jar.p2
Size 3.9MB
SHA256 4431aec1f1ab898589de8487b57de2598b4659ae671d02859c3900da509b0b26
MD5 c70a80c9ac49fa51b2b77fc62a7b839d
SHA1 3e1a26f783c86fd60f03c7f3f2df7b739f621bc5
SHA512 33f8fcb9192c4f08a7814e2af68b566c4695deef58feb5237d4f9e1daa315910c119102db19ab02e99adc8a7cd29def4a6440cf55c68717c994c6d6ac832fe9a
SSDEEP 49152:+kSov8bdfSAY3YQMhHBUmrMYHt+e1et++e:PEbd6AY+BzrJH4e1qC
TLSH
T12E162F9365CBBA4BA3D01F285B724268153FE65801A37F19F161B3FCEB72163EE91424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\jaccess.jar
Size 42KB
SHA256 4fde6b2f2c746db62ab5930b4abcecc966131535a83f2cc93067011d7071e6fd
MD5 bdb0f2c26bc783803269facb7d43ec0f
SHA1 73afc0c4510fe6394e9359c4a6b495ed9f7d692d
SHA512 4714127ffa2ef2b4a1789e70d7ade04056f3547d36016b82c7a49881367428a9c664e8f1b32817781c12fd4965dca9320dc9762ac829dbe90164ca1bd5f80ccd
SSDEEP 768:3+hK3ewenO5ULrAjjMSLAr/rzPzCBxAIjlJwHHjKKmJj4:HOweg9LA/zPWBxA4zXa
TLSH
T13E13B057AB85C03BE712F3B2C166E745D403AAB4C1F640AE2D980D8926D1C4F57A1AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\jaccess.jar.p2
Size 35KB
SHA256 29977238c33d12c08aef17139daed8d7ecf97b4f502c40a791062915705ebe52
MD5 171c05d2fefe375032a6babc7dd11515
SHA1 dec20c83b6168dd5d3bb4935322e39e7c46ba3d8
SHA512 9a84fb352224542453863c53f6dbf72829ea019b9d2a771420414daec27920a84e1ba3e6d3161d9b6b447b0ad6ff7088ca9bf1ba266be4757f113661efe03ce5
SSDEEP 384:W+eNocIxRNMNo8CDYhYUZ1d3Vh6yDZvi7dmXypppppppppppppppppYppppppppc:iN3IxRGND1hZ1d3Oamdm9hKaE
TLSH
T1B1F272066747F226C3D8FE3EABFD4249427096C8B71F28966F905058EE978C7290DD8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

legacy8ujsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\legacy8ujsse.jar
Size 418KB
SHA256 f17139ecb92b94a2a3909a5a2f2c8a5feee9afaf25e8cd2b5a8ab0fd3dd73c9e
MD5 80558729bb2edfc3b03b8dee73d527b4
SHA1 521d59e97a3e254ecd9dd06b213ac0fda4c2983a
SHA512 80e5785beb2de61ea8cc9882e94e3abf99917556467ebf935297a9e0f7376b313850cdb0ffea2d98ada9db8c6b3a6104572399667e8cfde0cd537775e445b0ad
SSDEEP 12288:X1H8fn8lnoHhvwUPfveUFn6GxiPdAIl7o:XF8nWE4keu26Iu
TLSH
T17594F114DA5DE0AFFD4B50B6486E4366288463C28CE6263F425289C7EC75C5EF672FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

legacy8ujsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\legacy8ujsse.jar.p2
Size 271KB
SHA256 40799e64da3944f75ddb8e9a378c7d37fe8c94183f173717b2f08dad865cf89d
MD5 3b997068ed80236ba82703b7c8275621
SHA1 63d2bbca29231220d5beb285c9cf263b4c93acb9
SHA512 c67ca18a538ea12e0032728e575f25b11da6b847ec3eccceb59c53d18eddbc4d711d4684e8f60ed0da6e7149ab31a9f8c04ef45f5c5792ceb749c3f7e5b7ddb4
SSDEEP 6144:wkRW6Sp+RI7HP7YJXv50+ACy1av07m2WtozTItNBW:Jc887s5vf0auJ
TLSH
T166449E17BF06026AE3D5297251B5269A9375C048323A17A37E4D4488DF8B9E3C73FED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openjsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\openjsse.jar
Size 1.3MB
SHA256 47545a341a3e7b99164150d000607e10b7b3a16caf3320090fc1e5c6128c13e1
MD5 a2dd6baced76fe17ef8db6d6a6dca1ec
SHA1 26e46d9fb59464f895da1474ed0c545831311bd0
SHA512 a9472630786ca3369c3e1d9303b5430eb744c962d7287b95d75caaf00d15ef735c985e5093cc2d36dabfccaab2782210f71eec1be3cd1cc05886eaa969ddc947
SSDEEP 24576:kZuNn4pYhFTDB+qCmTIyhehSwZhj+LZYmlf8xq54qD8Cc:1N0YHBPibRZgtaCVYv
TLSH
T10E55C00AF988803DED0B94F78C578467642417C65882723F0B5699C7EC75C68EB3BEE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openjsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\openjsse.jar.p2
Size 580KB
SHA256 ec51166a6f4796de2283de2a59e9143d953fe37bf9abbc71873a3978dbec85db
MD5 558a800e89bc6c647e2909a0c91dd9f8
SHA1 8fcfec1b4e704661ff0c7599e0ee2ec60c69088c
SHA512 19e585b8d1c13ab511ee66615442fb2bce3bb529225b623271a8f27a58d76d541434ac02b619d55bbca03f1f9adae94745bc1f2504eadc7f00220b49ba6c13bf
SSDEEP 6144:x7M0OZX224seLcjlbvXd8I6+DwJlZ3yrwgNc7GuffND7votTItNUT:xAhXksdll84MlZiOQ
TLSH
T1BDC46C0AFF0A1A59F2A1273240B557459339D548332313637E0DA1D8DF87AD39A2BEED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\sunmscapi.jar
Size 42KB
SHA256 fd7de375f7cf8bb4edef258b73ec78966394318df262d4cb2a22bcbeb127f8e4
MD5 199a840d4c8163628bc069703282476f
SHA1 1cd2bea3fedc312a9b470871fe87c8f301f8ef32
SHA512 01fda70b4d77c221dd63d2a4e9eab587c667e8af22e920a44b64eb6208c8e96d9044d96a407a05849c2357fc2a9aa3264495ac6559df6df1e2ddfadd088d5aef
SSDEEP 768:ouwfJBvF8NcfidAX76Lzl17mBxGUE5IfBFrN6gZwV510HpkF0iyM8re/eGO9vr0D:ouwfJxmNcuAX76LzlUBxzIIpFrN66eTd
TLSH
T1EF13AF2FB8D8D1F9F15782326021A29F771D44F9ACDA832B1650858FF1089ABD7119EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\sunmscapi.jar.p2
Size 21KB
SHA256 9bf43b7dd1e1aa0270e6c250674a8c0d651ab85463ab0337bf09f04e574b6183
MD5 4ea26f1be03d62f5170c551398913c5c
SHA1 b633de9990e519dd878b5eb20e4f4d0441f96aca
SHA512 e8a0604ff89f570b2291e2192e4e9853981c867f60d471829e7d286c1b9c51db9afc31b52ca5e0428a2bc1c44ff7d875e1fdb7d6efb413b92d979b6f49aedfb2
SSDEEP 384:LnW+lH/HBPpyuH75nreZzZixpfieL68CqEgjpdcnGGx5Lc:zp/HBPpHH75nreZzZip6025LI
TLSH
T19EA24B07EA071151F5C022B270F21B53533AD39069274BB32E9846A4FC82DE7CF2ADE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\sunpkcs11.jar
Size 263KB
SHA256 911970a9929e5e8a16d17ecb2884f81d5f7963636d327846e58139cbfae04fa8
MD5 af127a77a8798a63de54967af500c655
SHA1 b4b82b535dd619607288fdfb739d1d56d6cc6c68
SHA512 b2a94cae4f434130ba579e3131abee5866b444ad7b1e7b51c1bec037c56324ee51e4fcd9ac4b2cbb9ebf17f0df414809a6c718250968921e789e6f45025abd4b
SSDEEP 6144:XbU8EGhBiJmRsvpmw3AzKdHgS3GvAopVqv08sx:LUHGjiIRgldAS3mAWgA
TLSH
T1CD44E1022CF94439E4A3627FDC60C3CB655E0C4E96D6A2AB156484CEF13DC6B4753AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\ext\sunpkcs11.jar.p2
Size 164KB
SHA256 3490e4a3ce662daeccc19aee199e22833f60a5e0f3743ffc99a80ba9b7be169c
MD5 593de57a7abd58e4f31ac663254f85e0
SHA1 0684301a3b0433b51eba019c20560090d79eda15
SHA512 2389ccc97199d64ac81d61c0de67ea25dadec0bc60b741de1247e1b718e5559a7348eb7e52e98e9ed7e20970495409fd8b075dc9d7f3ec1fd0f8733fcbacc19b
SSDEEP 1536:R+/ZoB/6tYyDMjoE0gtsxYZ4tn5NB/5WGob44j44L4EnkQ4444xvqhfCM/G7vpsT:RsViDpsxCehZC8EmYbykjuyWvO8V9P
TLSH
T168F36D07B60FB581E981277269A491BE533DE148AFB707825C0D4698CA832F7CA37FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\jsse.jar
Size 1.8MB
SHA256 3dab1640802f083348c4ab929bfe2e4c8fe7757236b4550a81679d93cf0ed114
MD5 f6f84176ef383688b6c8eba60336a57c
SHA1 f2c7e6a66c7c34d4c0005c89a533454eecf9b007
SHA512 aeaf0da0334882b80b28de29d5f2a0e40ba8ae8d1fcd67e67ab0a3ee8b2948d2e6df6c153ea860871d5cf2ec5b97484a6c3050b9446e6d2249c353dd488dd5b8
SSDEEP 12288:zerrFNscXI7N6xUx6lysoWkId+0i7cWkosIpImfDX9rt:zqrgF6lHx+xkoxXRrt
TLSH
T10995B417E50C99BFF244DAFFED70422837342C325D63B3384A49491AF1DA6B15A78AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\jsse.jar.p2
Size 365KB
SHA256 e935fa86aed1296e44c9b59aeee8d75fd8670d6ce23c1ed418e9af8cc862e9e2
MD5 048afc64953480883554a6b3135de599
SHA1 a7c088c61b0178661012f10802e2de4d3eaec762
SHA512 d6adba78de8fb253f350d1098c54d0824a01e212c6499d8a666a26ed450cea4a2f6413ac9f47717d7781f25d5ac4bac61e094ab1ba199d556ea8e789fdd48224
SSDEEP 3072:NW31G1XEPjwafKNYge+i0mca9KZfH9D0GCCCCbNuamI+o3Uz3U5am8zEXECb1kb2:w3EhafeYg3cceKZfHTuf55rkA8
TLSH
T1B9846C066F0B2995F2E12B3640F55B95973CE148326723A31F48A5E8CC83AD3961FDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1780942904-6-app\lib\rt.jar.p2
Size 15.7MB
SHA256 d97e1a6356e7531e94c1a4457d9e3f41141408a397d4b06f5618d34cb50b423b
MD5 d538beef841a0bf0bd057e663fa74048
SHA1 3f1a1351b0e66357f7a2f9f9bc85c1a7606f2fa3
SHA512 3aefd51aea1c1274ac2cd5b9716d8b198b79fe39d5d4b218ed3a23d159a75c9c35f13a59f0d9bdbc41b3d72eab23454fc7478868df6831fcabf64727125508bb
SSDEEP 196608:auLt6KSgAA4DAVQPZbnevjz0V8NtaJTTFmFkoll/o:LQKPAA4DAVQPZbnevjIAkollg
TLSH
T10FF66C07B64F754AE2911B3140F2175A523AD2092B332757BE0C67B8DE832D3AE17F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 631KB
SHA256 572720421ae498c9e80f077c9a9c89196ecb5f237c137be8fdcb7b50d3caa1d6
MD5 c76979b609305ff32e978a3f867da2b5
SHA1 58f3f74d88606e4507dac238b74e659ea51fac28
SHA512 7f51833f797b12ceac13b15287ee0e795bffe37a34acbdc48df04ca5e10718d1d4efb2964f2d20e4b311c69dd8b37a02d4eb74e1dc87fb3610afadfd5399ffe2
SSDEEP 6144:YwAOVKQ5zRZUuFezkDQpBNPZOkjGPlJYO49sy1XjFCyeVlR9/en:YwAVQt3IzWU7P9aP3tSXgyeh+
TLSH
T196D40B34E2A15DBDDF37AAFCD08E44D7A75BB9A203C4012717F086E28B613D4542EE69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWrapper-Windows64JRE-version[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LDH0M1QA\JWrapper-Windows64JRE-version[1].txt
Size 11B
SHA256 b482d2aace7286c78a565879c3ac49b772e9bd9d003bed856542c2cee1049b22
MD5 271563b96fbbff5dc3e04656f3f18923
SHA1 7f6800a9d6112bf5c360d56f3b0c5c616260fee8
SHA512 fc211920ee469a34e10444d65e9a909c934cfa1c6d332700d33c2aff9aa2201434dbb810ff03188904c9500638444435cbecc25e2b7598356236c8475b02763c
MD5 SHA1 SHA512

Submit Download

memory/752-642-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-592-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-654-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-558-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-571-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-574-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-641-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-638-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-630-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-611-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-557-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-577-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/752-576-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/2144-402-0x0000000000840000-0x0000000000841000-memory.dmp

Download

memory/2144-394-0x0000000014040000-0x0000000014072000-memory.dmp

Download

memory/2144-391-0x0000000000840000-0x0000000000841000-memory.dmp

Download

memory/2268-693-0x0000000013170000-0x00000000131A2000-memory.dmp

Download

memory/2268-712-0x00000000141D0000-0x000000001420D000-memory.dmp

Download

memory/2268-815-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-790-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-775-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-773-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-761-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-750-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-745-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-739-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-727-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-725-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-708-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-705-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-701-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-690-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-680-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-674-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-669-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-663-0x00000000130E0000-0x0000000013112000-memory.dmp

Download

memory/2268-657-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2268-656-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2896-508-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/2896-497-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/2896-498-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/2896-500-0x0000000014030000-0x0000000014062000-memory.dmp

Download

memory/5084-490-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-484-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-344-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-282-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-442-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-257-0x0000000002740000-0x0000000002772000-memory.dmp

Download

memory/5084-445-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-362-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-449-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-486-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-274-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-281-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-560-0x0000000004340000-0x00000000045B0000-memory.dmp

Download

memory/5084-489-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-241-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-485-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-556-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-551-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-328-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-411-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-410-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-358-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/5084-229-0x0000000004340000-0x00000000045B0000-memory.dmp

Download

memory/5084-403-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download