579eb84d9867257570bea074a64ca2de55d3fb96fdd9f186fee4088686260af7

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
Size 14.8MB
Sample260630-eeta6sdz9x
SHA256 579eb84d9867257570bea074a64ca2de55d3fb96fdd9f186fee4088686260af7
MD5 c451dc5126a97ba6d84da5b55e1e5da0
SHA1 d0317693af8683c129a0887fa167f7cdeaa0ce0a
SHA512 9cdd090fbcf5e4c7369b1aed4923dc1c50a66bcc40ccedfb1046575d37d71bae649137d788262de8cbfb7c575ed7ffd5fcbd999e152801622cd0bcc68bc5748e
SSDEEP 393216:kWFJrPSIooySZNhm22I0BVISekcrNPzYQrgeQToFFWJw:brwopZjm250LISekcrN7Y88Jw
TLSH
T1C7F633023A61C0B0DAA28A70556A9B33DE7673A117BC51C363F48DF22E6D7E36D7214D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 10 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6852	netsh.exe
2892	netsh.exe
5976	netsh.exe
4640	netsh.exe
3024	netsh.exe
4816	netsh.exe
1600	netsh.exe
1468	netsh.exe
5064	netsh.exe
5140	netsh.exe

Executes dropped EXE 23 IoCs

pid	Process
2564	unpack200.exe
3064	unpack200.exe
7072	unpack200.exe
3324	unpack200.exe
3784	unpack200.exe
2156	unpack200.exe
1296	unpack200.exe
2676	unpack200.exe
1632	unpack200.exe
7120	windowslauncher.exe
1444	unpack200.exe
3824	unpack200.exe
6480	Remote AccessLauncher.exe
2212	Remote Access.exe
3324	SimpleService.exe
6564	SimpleService.exe
2312	SimpleService.exe
2116	SimpleGatewayService.exe
2676	Remote Access.exe
3296	session_win.exe
3016	elev_win.exe
236	session_win.exe
3948	elev_win.exe

Loads dropped DLL 54 IoCs

pid	Process
2564	unpack200.exe
3064	unpack200.exe
7072	unpack200.exe
3324	unpack200.exe
3784	unpack200.exe
2156	unpack200.exe
1296	unpack200.exe
2676	unpack200.exe
1632	unpack200.exe
1444	unpack200.exe
3824	unpack200.exe
2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
6480	Remote AccessLauncher.exe
6480	Remote AccessLauncher.exe
6480	Remote AccessLauncher.exe
6480	Remote AccessLauncher.exe
6480	Remote AccessLauncher.exe
6480	Remote AccessLauncher.exe
6480	Remote AccessLauncher.exe
6480	Remote AccessLauncher.exe
6480	Remote AccessLauncher.exe
2212	Remote Access.exe
2212	Remote Access.exe
2212	Remote Access.exe
2212	Remote Access.exe
2212	Remote Access.exe
2212	Remote Access.exe
2212	Remote Access.exe
2212	Remote Access.exe
2212	Remote Access.exe
2212	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe
2676	Remote Access.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 30 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Access.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unpack200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowslauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unpack200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleGatewayService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Access.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote AccessLauncher.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3296	session_win.exe
3296	session_win.exe
236	session_win.exe
236	session_win.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2676	Remote Access.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2564	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	88
PID 2876 wrote to memory of 3064	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	89
PID 2876 wrote to memory of 7072	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	90
PID 2876 wrote to memory of 3324	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	91
PID 2876 wrote to memory of 3784	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	92
PID 2876 wrote to memory of 2156	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	93
PID 2876 wrote to memory of 1296	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	94
PID 2876 wrote to memory of 2676	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	95
PID 2876 wrote to memory of 1632	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	96
PID 2876 wrote to memory of 7120	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	97
PID 2876 wrote to memory of 1444	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	98
PID 2876 wrote to memory of 3824	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	99
PID 2876 wrote to memory of 5968	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	100
PID 2876 wrote to memory of 6036	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	102
PID 2876 wrote to memory of 6228	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	103
PID 2876 wrote to memory of 6480	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	106
PID 6480 wrote to memory of 4776	6480	Remote AccessLauncher.exe	107
PID 2876 wrote to memory of 708	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	109
PID 2876 wrote to memory of 6096	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	110
PID 2876 wrote to memory of 3484	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	111
PID 2876 wrote to memory of 7092	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	112
PID 2876 wrote to memory of 3920	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	114
PID 2876 wrote to memory of 6268	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	115
PID 2876 wrote to memory of 6724	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	116
PID 2876 wrote to memory of 4284	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	117
PID 2876 wrote to memory of 5748	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	118
PID 2876 wrote to memory of 4260	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	119
PID 2876 wrote to memory of 5996	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	120
PID 2876 wrote to memory of 6848	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	121
PID 2876 wrote to memory of 2212	2876	2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe	133
PID 2212 wrote to memory of 2352	2212	Remote Access.exe	134
PID 2212 wrote to memory of 7028	2212	Remote Access.exe	136
PID 2212 wrote to memory of 6380	2212	Remote Access.exe	138
PID 2212 wrote to memory of 2936	2212	Remote Access.exe	139
PID 2212 wrote to memory of 364	2212	Remote Access.exe	141
PID 2212 wrote to memory of 268	2212	Remote Access.exe	142
PID 2212 wrote to memory of 2816	2212	Remote Access.exe	143
PID 2212 wrote to memory of 2256	2212	Remote Access.exe	145
PID 2212 wrote to memory of 3324	2212	Remote Access.exe	150
PID 2212 wrote to memory of 6564	2212	Remote Access.exe	151
PID 2312 wrote to memory of 2116	2312	SimpleService.exe	153
PID 2116 wrote to memory of 2676	2116	SimpleGatewayService.exe	154
PID 2676 wrote to memory of 6748	2676	Remote Access.exe	155
PID 2676 wrote to memory of 6516	2676	Remote Access.exe	156
PID 2676 wrote to memory of 6660	2676	Remote Access.exe	157
PID 2676 wrote to memory of 5536	2676	Remote Access.exe	161
PID 2676 wrote to memory of 5976	2676	Remote Access.exe	163
PID 2676 wrote to memory of 4816	2676	Remote Access.exe	165
PID 2676 wrote to memory of 1600	2676	Remote Access.exe	167
PID 2676 wrote to memory of 1468	2676	Remote Access.exe	169
PID 2676 wrote to memory of 4640	2676	Remote Access.exe	171
PID 2676 wrote to memory of 5064	2676	Remote Access.exe	173
PID 2676 wrote to memory of 3024	2676	Remote Access.exe	175
PID 2676 wrote to memory of 5140	2676	Remote Access.exe	177
PID 2676 wrote to memory of 6852	2676	Remote Access.exe	179
PID 2676 wrote to memory of 2892	2676	Remote Access.exe	181
PID 2676 wrote to memory of 4328	2676	Remote Access.exe	183
PID 2676 wrote to memory of 3296	2676	Remote Access.exe	185
PID 3296 wrote to memory of 3016	3296	session_win.exe	186
PID 2676 wrote to memory of 236	2676	Remote Access.exe	187
PID 236 wrote to memory of 3948	236	session_win.exe	188

C:\Users\Admin\AppData\Local\Temp\2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_c451dc5126a97ba6d84da5b55e1e5da0_amadey_elex_glassworm_smoke-loader_stop.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\alt-rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\alt-rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2564
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\access-bridge-32.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\access-bridge-32.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3064
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\access-bridge.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\access-bridge.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7072
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\jaccess.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3324
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunec.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunec.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3784
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunmscapi.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2156
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunpkcs11.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunpkcs11.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1296
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\jsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2676
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1632
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\windowslauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\windowslauncher.exe" "-Xshare:dump"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7120
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\customer.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\customer.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1444
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\jwrapper_utils.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\jwrapper_utils.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3824
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5968
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6036
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6228
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\Remote AccessLauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1782791528600-54"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6480
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows32JRE-00052234578-complete" /e /g "Users":F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\ChosenLanguage" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:708
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6096
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3484
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\jwLastRun" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7092
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6268
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6724
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4284
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5748
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4260
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\logs" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5996
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" /e /g "Users":F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6848
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\Remote Access.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1782791529541-55"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows32JRE-00052234578-complete" /e /g "Users":F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2352
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /e /p "Users":R
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7028
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService" /t /e /g "Users":F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6380
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    - System Location Discovery: System Language Discovery
    PID:364
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:268
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2816
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" /e /p "Users":R
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3324
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    PID:6564

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\Remote Access.exe" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-380103662-22"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
      4⤵
      System Location Discovery: System Language Discovery
      PID:6748
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
      4⤵
      System Location Discovery: System Language Discovery
      PID:6516
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\jwLastRun" /e /g "Users":F
      4⤵
      System Location Discovery: System Language Discovery
      PID:6660
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows32JRE-00052234578-complete" /e /g "Users":F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5536
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" "SHRemoteAccessServiceSH_3_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5976
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" "SHRemoteAccessServiceSH_3_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4816
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" "SHRemoteAccessServiceMA_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1600
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\java-rmi.exe" "SHRemoteAccessServiceJE_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1468
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\java.exe" "SHRemoteAccessServiceJE_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4640
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\javaw.exe" "SHRemoteAccessServiceJE_3" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5064
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\jqs.exe" "SHRemoteAccessServiceJE_4" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3024
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\Remote Access.exe" "SHRemoteAccessServiceJE_5" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5140
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\Remote AccessLauncher.exe" "SHRemoteAccessServiceJE_6" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:6852
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\windowslauncher.exe" "SHRemoteAccessServiceJE_7" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2892
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.lock" /t /e /g "Users":f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4328
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3296
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3016
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:236
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Share Discovery

T1135

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 358B
SHA256 6c2e02b19c5f32608dacfe2b6d5383632ef2cbee020f991ec7d5faaca5ccec97
MD5 43efaa92c9f1d2b500a00f852240c74a
SHA1 e22f6eb3488a903158f9c67b0a4d082abad7e815
SHA512 719e2793e5b50d2f90983d9ae8e73ae71a7bbb9eb803a2a6c867fead67cf9f7dccc6f3b4ddead93f64859d7a1aae3aefe670506e53f5afa0ed42560d2ed6dd32
TLSH
T1CDE0D8A6E5A2A17BA2CD2347C82240BC0B704B445A388859FCD54651BEC91742F5B9A0
MD5 SHA1 SHA512 TLSH

Submit Download

JWrapper-Remote Access-UninstallerICO.ico

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico
Size 48KB
SHA256 85f2b156d63d64d4e9998f2e8207a03c096b8aed5b1631823dff36c2e89c52e6
MD5 3629d03fef69370d6933829d175147a5
SHA1 52320b01ee8c0cf248b60180eb8046ab350fe548
SHA512 f3cb0a706e8ec58795d99f0d3476098872e63c45fd3b50f0b6ceafc632b5f9db74ca8c5e1813c50600e7e235f285157c36a0d7cab099ff2257aa8286224b1fd1
SSDEEP 768:fZ51+/60ykkmZoVLl/rvikFjoFOcmn51+p73VGxWqHb6aLiXVhKr+yf71M:fZ2/qkmL5L72FOR58GYOb6FXDKr+yBM
TLSH
T10223C00693D59BFFF414E837505E8A6133FA90B9B57A12EB5B1263280C7F1239E836C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote_Access_ConfigureICO.ico

Path C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico
Size 37KB
SHA256 c69313659be4dd0a2532d5d6d80b703bb0821c9763ff0f8e7600e35d668bfb49
MD5 1dedd3cd749cc418dbbb55104c789433
SHA1 26487fbb05d102fc039c4c8b87375eef6a874092
SHA512 d1c67ea73d7414915820934433bdac022e112f9cc16b26206f435670764305b61157aea158dd388c5f446b1b532d83195c3b811ab64e0914d5b82dcf49c39a3d
SSDEEP 768:6T+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwI:k+YEgQvu3DnUl5eySSHypGT
TLSH
T13C03BF02BB84F3DED26B9173765D170B132B9D0326639B5B288EC3679DBB0704B47562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwutils_win32.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwutils_win32.dll
Size 152KB
SHA256 5e1171f0af257c2a50235d34692f67530ef0f0d9c449cb0982ee71cfda500225
MD5 8c2bf459403b0ac34ca3f28778e7138c
SHA1 11bb00943e4c2c3fff7ab806d011a9e77e2c3b9f
SHA512 7d4c5953734fae7b5f05cf8e0ae6a87de62df72921e9d6bbbea80bbbe83d79f703c08cdf5ff2f5a729c6ca80350b3f27d7384436a8b31eed1a99d4b898bc2277
SSDEEP 3072:VtPJhhaFMlQMl0wRRfLlSZdtFPy8X+Y8+L:DBhAnMl0w7jl6+8J
TLSH
T1FAE3AE1534A3C072D04E023E51628BA5AFBF2D1377AB5ACBFBA41F891EB43D15376291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nativesplash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\nativesplash.png
Size 8KB
SHA256 5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7
MD5 08051133e368d61036576d3ed5b9cc14
SHA1 817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5
SHA512 93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce
SSDEEP 192:XFcpG2JMh/HwqndQb0qZzAuc6SyLK8hC5W+Cyd9kipsR5iyjR:ik48YadQbxO6PLpCWHGVSIyjR
TLSH
T16112BFCC406E7CA471E2012A8A44C75117B625B11D55BE2A3A41DCEB618CEDF2CFBAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwBuildVersion

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwBuildVersion
Size 11B
SHA256 b763b26017745c203140ff015559c136a3b313dce87242c620012b03f9a3eff9
MD5 dd1e3ca806ad272ce608751c7de09566
SHA1 262eb244dc73e1ee107924987b6f787085a195f1
SHA512 1af497071d7c15c4798e0d4c0848c21909910eb822c9f6d3aad57aba4ea54f79fc384e0554154c9c55d0e54b0b86c3225d26838f3de783bdb0206b0b08e2600c
MD5 SHA1 SHA512

Submit Download

jvm.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\client\jvm.dll
Size 3.4MB
SHA256 f4c26b4086b1099c24bc56580f49a7f8e90ecd3b9c4bcf54443acd0787360e6d
MD5 1ae4cccbe00484d713deb14784778f08
SHA1 c7562e596a2727a7f239d062aabf0e4377151fdc
SHA512 5729c08852c22233863e3cf27e5b4fef30291aa02564152cbadf4ce87cd3e10b497f550f03cc1e06263b95c2b9ecf81f32a19b99644fa4c1e40175259b184c49
SSDEEP 49152:4GfYpaMA7ueXEJokK2eKsRogP6by7lpl/IHEt6SIVuRGALVrwIISZiKmscv/GZ6b:85BJ3N+og7pl/suv7rJHcv/GM
TLSH
T17FF57C22EA01C075EED211F2AABD7F6DC46DC235433D1AD376943C9A6DA14E2393A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\java.dll
Size 116KB
SHA256 7e252d9b8f9bb0011bf1cfbfa64329668279d4d64ca22922bc4057ff486b8867
MD5 ee9528c8906ba89d17a79c69f1ce2082
SHA1 bc83ff1767922bb03fdd5c6b6690f710f7c86166
SHA512 d5bccd57e702dd3159e23e34b9273b5e7405691bf3c5abacf2a9468633624f9e2f18b4ae5cec9433bfdd676e9fcd7ceec3ab425630b2273ebfdfec1aa8def551
SSDEEP 3072:YARELsKuI5GApq3um7C5S8pzItI5GyhYgNAocYeEsvrx:Yu02+G6q33CzvhMVF
TLSH
T18BC38D1B36D0C0B2F4663CBDA52DEB6F52699E300874FFC70752C946CA8D3E115276AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\net.dll
Size 74KB
SHA256 9d306ab0e8c8fcdd1cf4f13b7260c3f20fde7c4699a1492fda020a3865577402
MD5 d533730bb95bfaa69ae7c5e6d38cdf5a
SHA1 6076c5708bbf4595ad64643b3be9e6e0d5bca50b
SHA512 b7046f384cabdc99df2efd8ff54e21c2c16cf9e98a60a628ceacd22cb3eb2eb33bc8c4da0677d11104170a0e4f4f04b8eab57c17c1b4e3f8f001c023caed192f
SSDEEP 1536:Ok7x6oqHL9120Q4uo8WOeQeYCbPn5fGsnuCMOc1FxegTNbvQolIn:Ok7AooL9L8wbnhm7GKNbvbe
TLSH
T161738D216030D8F3F971F834188CABCA857AFAA75E645DCF2510CD9651FEE902E37A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\nio.dll
Size 48KB
SHA256 1ff77d483aa6967db925d5e7475f04c3d4e9060554858cec63b761b8af796198
MD5 8ab67f77c9d56ce35f75269119c40b4b
SHA1 7cdb00d1c3b4bb2d0a32f3550338c380a66da016
SHA512 aefc0c20f7c0ac62864cc9591727c8a5fd3c643298544f356bfd02cc663fab3926de5e1ebe19788871e51b4c4b1bd81b37270db2ccef8cf0b40fcbe6c3704104
SSDEEP 768:uzfkZOF0BzM2CH8v+D0rs/wH4bpH1l77ZPBw0BU8oxwE+T72HPqniYGs+y5S:SkZxlyKcwHMpVlnZw8ooavqniYz6
TLSH
T19E232C724250CC7BE5BD363423DF6B9C7152F80089247B5E615497E19CBEEB32A3B682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\verify.dll
Size 38KB
SHA256 dac4a036e43e323ee417b62e8190cfcbb2046416c694f2f18719e85f9bc81223
MD5 635dcf3b992a82b481500e2717eec308
SHA1 63e06ad21e25a917634453fb5d8dd4584a2b48ae
SHA512 e2fcd0fa4e06988539daa7b9b7ecac9d4a75e037a072d47f8d11152a76f576e8094aaf80ef4fc3301f019c680bac3908aa45c18a37d88711622ef59e33662011
SSDEEP 768:B3mVTQuE54u2loHXzJSSAcLtFoO2NfrZt8zndbjHb7I65L8:JmtQd4bj7BZktjHPIL
TLSH
T15A037C03A0F39039E4D3847767A3E3360775FA40EBE3D88B2591C1D7AADA7501B2594B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows32JRE-00052234578-complete\bin\zip.dll
Size 65KB
SHA256 940689b0596fc9d4995c5ed600d14e07fab792a43650dbb63fc30e5e789d4da2
MD5 c8e2c44cd05761111f9ed6b82a0f1e45
SHA1 f45c717c74ce78da1a160cd132b2c1e87a0e87aa
SHA512 81a46e5c88aec47aa9f3b836c1bf7aabd4a90575957f892f1115a8a1ed843b1f3855702209ea1f5975590204ba00eab0bdcf18d45d327ea56a3b547be6012a80
SSDEEP 1536:PikazhLa0cwYrUhlMFStC9Wo5IODIOyVnToIfSQTPj//r:KBJcJ8C9W8ly9TBfSQTPjb
TLSH
T18563AF2247D08262D5F53A7480EACB3DAF76B7108694A9871FCCAB54284DB71A7217CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAuxiliaryArchive-Remote Access_macutils32

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\JWAuxiliaryArchive-Remote Access_macutils32
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

cacerts

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\cacerts
Size 110KB
SHA256 d020172012854bb4a9d461885c6816eb855498c63ff78bc60944f4fba1e9091a
MD5 2ecfd7e5a8789c3f0e68ae85a26dea23
SHA1 8bccdebcd485eba9a0ac324efe458a087dd55c2a
SHA512 9c350aa5bf3d975d64988f9f33ac3dd0533322f57b9a7a07db479d0082693b5f74c4a90be853dd1af8f2749f003bd8633632732c7ad6bb1abbb894b343ae10db
SSDEEP 1536:n1kP9UXlkT1ze0WuQHoeCHtVjnIhEObD4lyCpcJa7eUS:nKLI0WuybotVnINbclyCpE
TLSH
T190B36CCB4F383921BFCA9E546288E6373E75B3D6A69A24171575C0E16DD27F43A8C00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\customer.jar
Size 12.7MB
SHA256 846dcebcbae6d76c235dd75ef85f078db3658cf26ceeeabaebd26a6e5eb957fc
MD5 f44d7748e96474172ed1d1a3e64b4e69
SHA1 e73be31037e7af748cb8959576b9cb1cac64cbe0
SHA512 b573eda410cb507765d3c0dba4338e90d8755d485d63f25d71fa4a4fdd22942cf2e8d9600c26c1397a7d69f141db9cd9ea914528a57de8c0ff4c639d992a7933
SSDEEP 49152:V7SKEJhiXnIZt6ZMjr3/RZQPdCcRkaRNTOXDu6b2IMIPN7IcJosOIk/R4UmNBh0j:FXp8Jy3kafi2lANEGMqI
TLSH
T130D63A1BF3105E6FF789D3BCA56083B53A7068705343E1A2AFD968276ED66D88B407C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\customer.jar.p2
Size 3.8MB
SHA256 7cd88296a137fccab944509ddfc2cd3017025e24e1cf40e3a2e28de2b5b5300d
MD5 05179a73279d59dff1cad55af324a171
SHA1 285913f11c83376a1a51a472386240d465ae2563
SHA512 ed7f6f059e498851cd511e47a3ed82e55ac50429c8e65e95ef31470e550018966997dfe5486394c1c74a599f3b0baacfd98548baa497f8c90b5164c28b623ce6
SSDEEP 49152:aoI/AaqsUJILBO1HFOdCd4AFIuIPxsqibQB+/2VAcaIh8tJ0clv87mKNGh:afOJIdO9r9FIuIPefhtic
TLSH
T16C068E0BF74D609EE251127184A5930A2329D05A3F321FD37F1C5EA8DF867D26A3B789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\jwrapper_utils.jar
Size 2.6MB
SHA256 5c4b755a86296e29092cc59e9cc83aade7d509f2528c28d1217e59acdbbcc870
MD5 c0e7992fa5835b1d2a9e474ac2f5fde1
SHA1 2ff8017b58debe310f552f800914ed45ec7c890e
SHA512 1d74d28a8e82fb46b11dd11bdc5ebd55794bb139a545a3f4e93f58631846b6439bb75e389bfb975cdf7df950ebf13ccb6ca35de4eec756e424e059b896dab3d7
SSDEEP 24576:df0t1FIwZdFpDH38sgwZJUqZqxuFOgm/iYEOnmQtj9RtHoMBc+P1LH:FC1FHeqZqxuFOgMbnmQtDtoMBcwH
TLSH
T16BC55C17F1105E1BF285E77C296483A8777060308313F6F25F98A96B5EEA2E89F453D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791504-0-app\jwrapper_utils.jar.p2
Size 923KB
SHA256 bd13d69cb69faf7882a00f934a825c08669879f831c99df273eda2db1846c5e8
MD5 992336253c3205dd9b8cfac12dc307ce
SHA1 9d9e21e4aa4271276bcdccf577b02d960bbbedfa
SHA512 d81340c5f0c4477de689054c6a6a35688438390a4f36dcecc0466d6fecdabd37990359ae073ded0839fc7e768fd4cdc9bdd529a4dadacdc1846da7c2d80de661
SSDEEP 12288:BD8FXQT9muKMUQqM4nQfKPFEaabAScvtvlwStYUT10wsdQ:OXQT9muKYonQQBa0dlBj10JQ
TLSH
T14B157D0BF74D76BDE5910B3248A1870B5739D0086B3217D3372C69A4DE8339B5E2F2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\MSVCR100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
TLSH
T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\unpack200.exe
Size 142KB
SHA256 02e1cf8e3e19f72f1ea0fec30b36ebce9e397e61f8a0384af86d3d05a26f3be8
MD5 8d04707100583489d14cb5c298a6774a
SHA1 a8b033c3203c3e36973e186a16906d8ccceb0442
SHA512 863a30a0427b0ea457e07db25c3bfb74364bd7cea05965d9946f830da8700b08392bccf3455ec578f1ee47c91c0dfb0d907d93112990b6d58976ba9b9f5e27e9
SSDEEP 1536:az4xwXrzhWq/wZsM63JfLC+8siSdtpT8fYLh3LMa2B9nToIfP+IOfIOn03GjOKED:AxvB5fvBUfYd2TBfPsRn0WjOKEgDw
TLSH
T132E38EB267D0C17FD4FB06BA81EAAB6D6E78BB1047641CC711CC2B5136107F45A362EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\bin\windowslauncher.exe
Size 332KB
SHA256 56ad775142e0685a350dcbb7b7a5d8180c026c332850e2076a028f1b4e1be6f4
MD5 d634d52f55e18227e08777726a12b167
SHA1 aab0ec040e276ec6bf83ed94f1cdfc31fa5f39b5
SHA512 8ce075fdba2dfbef651e19384a263b6342181f924c2867833cbbc45bf01d1a17d72a5b1a2834f0fb32e21e2a0fe1856195999ddeb802c0859e342355df2b1476
SSDEEP 3072:TdifNTlu1jBH/ll3T+Q696imiuznUlJ2Antb:5r1jBH/I96tiMUlL
TLSH
T1B274BF027992C1B2E0954133764DCB929B7FB9532F7A98437B95428F9EB63D0872B3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alt-rt.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\alt-rt.jar
Size 164KB
SHA256 07aec0e9b8b947046b8617f02ffd6c05c5f4a63f365d6184db8fceaa7739e6ae
MD5 09d94d80f8e697bfd00017610d3e519f
SHA1 c389a6d46aeae0206e4011bb69d7d383c7f0d714
SHA512 55bdda67c02f13939ff87dab880f73348b69b45c316b79c09d01240a7194eaee400fb7e671b80bb834f519fafcb7555512be80d4f63d0c082753e9861d2d99ec
SSDEEP 3072:fHgtsfIAe6ErveSLKmlit8X5cgwqE7sAfwaB7DMkr7nBx3tnId1:fHgigLr6ebEoAVnMkr7rOd1
TLSH
T1D2F3021EB200E931D64AE639799173137F36C132C203E178A0B9955AAAB7C33779CB74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alt-rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\alt-rt.jar.p2
Size 132KB
SHA256 1ac2936e2d101ee0bfe463889cf45dc287afb28609ae4acb4c973d6dea34343e
MD5 f7098f223c76b78bf51d235bbb801715
SHA1 cd56c99f4da49f983a78ca61e400f3f677d7b9d7
SHA512 c38064293b5b14a9eff6d7848df840b1ba36dbe997a8d1885cdbacf7ab1955dc0b361bb550384c01fc661b236644a8b73941a4b82d130e20d17c4159851dbd50
SSDEEP 1536:p9s3KRSOrqvVHFjKDu8k1gVmKa+1wBqB+YxohPr7huSrJ3ACYbkG:mmSOrqvtDiwBqBZePr8u1G
TLSH
T15BD36B267E672749F7847D3346F42AE603E5E208383729E77E081ED4C9C379B6A10D96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-32.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\access-bridge-32.jar
Size 215KB
SHA256 195504f00147a7f9ad2d37ca77633d5b77b408181b8b28314067c97d1a4ded6c
MD5 5814b9baeb3e892491ce0fe0dc41a82c
SHA1 3f29ea3fc09bc5ec86ba72677fbdc0420ea2eb20
SHA512 2883ded4ede0f16c72ac1bdd167fd8eae27241bbee9794c1297ca687789470d2dcbaf687964992810174171f205ac5341a555ffcff17f27a0d4f3672a74f7991
SSDEEP 6144:qWD5hjf+xD5KG5my3kw8bBhdJHLLcWDj5Sy4HCA:qu5Rf+xD5K6v0fzdxLLxDjQy4iA
TLSH
T199246E53D31DC467F90A43B260A1AF527B247EB9D1B342B94CE92B053A5AC2B1734B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-32.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\access-bridge-32.jar.p2
Size 93KB
SHA256 4da30330a35bee72e8d844a93eb987da731906c5b22c3de79af8a2e5f3d6a6f9
MD5 c174608783bdd88cb19552d24e6cbc82
SHA1 f3040a83793230796f6c07499a07b35168d411bd
SHA512 6f73bed179311e96beda65c231e6cf86290fe8f62bdc5eb8c1acf3f7b48e2849c9862e0e6a88a82311c61e4cac0a7a5b65bb2bf15c337a5ac0e6089ffb187f89
SSDEEP 1536:sQaGqQIPSAzn2y3Ky4lEkE/ePNAFK3nl++6OjjYIKKRSWdddddKfZW3ttZWIII34:DZ/Dli0TTTTTJTTTTTTTTTTTTTTTTTTm
TLSH
T17493F7177F07B162E2576A3652E5AB445328C388772327E76F285229CEC66C31E1FC8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\access-bridge.jar
Size 215KB
SHA256 3f3ece721348e6865329553c3609afcde23e862de8c8947377eb0548627c6051
MD5 6cc02ec9d8b624c428594ff40393aeec
SHA1 409b73866e272fd57ba8d9addf85338b0cc34ec4
SHA512 4631ffdd08cd89af42fdc4b553445cf70c1a2536940d98945d8cb49fed7bb0a445e75e0745087140d0d66fea61513650fa6dcb490547c6c18e85c88e13b870bc
SSDEEP 6144:kWD5hjfWxmSflpNBAVi9HN+doHqlcujtSy8+Oa:ku5RfWxmSfrXMEYd4qlnjUy87a
TLSH
T1AB247D17D11DC467F90A83B264E1AF527B345EB8D1A342B94CE92B05367AC2B1738B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\access-bridge.jar.p2
Size 93KB
SHA256 738a976ee7497e0dcf31db2964b96992a0184b39181b5c4d570c4c642b6062e9
MD5 dcdd6c14eb417056ac4690271ff26c87
SHA1 4dda17272adb2bab2d24e1c4b3cbda9ed8d3baff
SHA512 d461498d0a21e979d82858e50e9a3e38f5b4cf6b41eeab39b838f01051ad1eca6d91869897e7ceb3121a5deb7b6a9c6bde4bf5ebabc2d3b5ba23054ba22dec3f
SSDEEP 1536:DQQGqQIPSizn2y3Ky4lEkE/ePNAFK3nl++6OjjYIKKRSWdddddKfZW3ttZWIII34:QZ9Dlm0TTTTTJTTTTTTTTTTTTTTTTTTm
TLSH
T1BB93F7177F07B162E2576A3652E5AB445328C388772327E76F285229CEC66C31E1FC8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\jaccess.jar
Size 40KB
SHA256 810d37fef00f943feb1442475576f0eba233347121c9cfbad624780d46912ac3
MD5 63bfef8debdc06e3b6247b130d24c7e8
SHA1 73180cf04817c20248ed38919eee9f4876e7bafc
SHA512 49ec0c9f706f3a9df3bd6f91ab5c4890c78fb959f6a57b6e60b18617d1b1680c5dd450ae085090bf335a8162a8508acab81d53a971094f35272c2e63df2ac745
SSDEEP 768:mNa9mppiC0Bk/3UYCCXcbyOGGPQQZKNBMU+mDwl9SVngBjPYOd:mNaAz2kMcSydGIQZKNimDwbSyBTJd
TLSH
T10413B01B830CC23BE316A2F28255568273385DB5E55390FA1CB45B153E9AC4B4BA4BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\jaccess.jar.p2
Size 34KB
SHA256 c180b1af860e74031343a24da2e571f812be370fc5412e69ccf89defe2fc127f
MD5 67986bb86786c6656fdab5a63cecd140
SHA1 37f314261fef2d5194628ce847baa0a390627d13
SHA512 800f5aaa96d003a50e5a8133199444348c64c5fe947d9ab2747aa592fb8e23d640d4a5c2a578c205ce78031066157a4eadaaf6b95e81ead427426939203bd313
SSDEEP 768:rraGpFampC1dt8TTTTTJTTTTTTTTTTTTTTTTTTlMhPac:6Gpwmp3TTTTTJTTTTTTTTTTTTTTTTTT0
TLSH
T1DEF274073353E222D3DDDE356AD5428E412092C8B75B3EAB5F889044DF96EDB2A1CD4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunec.jar
Size 14KB
SHA256 a7daa91c20e87c99ac165c3236ddc0b0dfab98158e927947b58e40a67e205980
MD5 12c6b2c194256c242fa90ce1d13ba327
SHA1 cdfa0c07c8563a7a5b0415d5dbc39881ca8f79c0
SHA512 41d3125f1304b1b40878b7265f645544e119c7d0856d795d2b2f537408b5d5a9055479874cf4cefe6e027558bc2e62d12652c6e28227fb37af75c86a63aada2b
SSDEEP 384:Mv2K9V+4ArJ5odMrwnjoro7EGklDkeccBm1APHsQW9/32bV9HSTt9AtSyV:Mv2K9VwJ5AMrwjoro7EGklDkeccIAvpp
TLSH
T18F628D01A935045EE64E09BFE821014BB7E906895B9393344CF0472CFD2C5BB3FBA69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunec.jar.p2
Size 13KB
SHA256 6b95b35c9423805cac95f85e068da8e05ea78059798b2547791a06f0913c365f
MD5 17a80f10122fbd1152586f1a629b4ca2
SHA1 4a2d56799ee970512abce9bd55413c9f5524e965
SHA512 5db24cf73fff921897684e8a06d0227d1bb1be2f4660771021d5310390dc27bc757758d9d3c5fd721eb0f67b27fab8a4d3b99dc611c7f8d78dca43efde8365e4
SSDEEP 384:yNWjdw2q03HkDAoSPUXwBIOEpHvHYHPHUHVyhHGHqH1HvHwH89Sqrs9HdHTHTH3M:y4EDxSPU2EpHvHYHPHUHVGHGHqH1HvHp
TLSH
T12B52196AB60813B1D0D41AF360F9181E293435C397463BB85EE8437CFC65AF853A92B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunmscapi.jar
Size 29KB
SHA256 12caaa6b270707e23c9c5f3e28c5befc17fb7620d1561854df45f606d7320d28
MD5 9887ebb27924ccfc2cf8a08d2e4edd64
SHA1 93e32c0947cb60f0d70f36f2b7c2faf91d6b1494
SHA512 9573760f5c6ba226432c3eacd1d26c0cbec0e013c00908b9f9e465e07189b6e0b791fddc7d99ed543382d962fd31d90f024aa9a5d4e8f1488b492dd227f90ec6
SSDEEP 768:uoldp+RT5fOKmRQKVnh5tjNJOs8TTHMSLRFkanDyUZClQwasRbhN362Rkm991XHA:fdKpbmR5nh5FNJZ8T7FR2aDyEwasBhNY
TLSH
T1AFD2BF17C52CC1F8FA1544F642286046BB5D4AB2CEE3632C08B7898DB52DE1F6B54A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunmscapi.jar.p2
Size 21KB
SHA256 41e33600589250ce9af3060d071b07c6439dff055d095f473ee6f339ad9dbc4e
MD5 99c37613224c3bea31b6f4f7f6cb5edf
SHA1 b10d4bf0812c99c8dbad698b47f911b4fda2354f
SHA512 eea1c66abc9fcc13f8a49415cafede8826fcc07a1a30033fec570b74d5b7cb20241b5fd5dae47cbf3f167289298d1cc7c9677eaed62bc331dc05d7a79c2a7c74
SSDEEP 384:B/4HBDNWKTwibG12ohM1UjrYeIGjHYHvHpHIdHQHfHeHaHqHjHfHTZHXHuhH7HFW:B/4HBDTTwib8fhOUjr2OHYHvHpHKHQH4
TLSH
T141A20717F22E80E0F1C401F660FA504A173CA6D6EE135F396E9C426CFA41B7A87785B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunpkcs11.jar
Size 226KB
SHA256 6df464125beeef581365fb337aad57837be73e0edfd866e2b8769a613563c948
MD5 1a728e64b267d1db42db1ad22e59ff4f
SHA1 58dfc9e1c97df0d62b481cabd85eb10b97181a2f
SHA512 c23acda41794c0504226285c769263166720c02aa864fa539b133e207490845c78c97154e5d1be0c2830ed9496affcd46f928f9a610a300707107499e582d7d1
SSDEEP 6144:qjKp2RQ2KOQDVkCX+AUHOMKDGohuUX5LW:qjBZY4AUHO3GohXXxW
TLSH
T12034E006503A44B9EF7B227FFD61025A37380C8AE743E22D78F4995DF53E8211B167A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\ext\sunpkcs11.jar.p2
Size 158KB
SHA256 38f1aa5901caf739864d2bcc7228a6a8d47ec0be67b79d7b61547218c371dcf8
MD5 5f37c837a70efae60919de59dd3a8b61
SHA1 058032219dd74cb42cf8df61738188db104cac8b
SHA512 9cdf27ccec46dee1d953eb5ed6eb93a6c450189a39037a8ef3f53ef4df279ed74b8cda14d29f642369ef2c2b0ec9cf8798d10e9c971089b8bd605b3f18a8a193
SSDEEP 3072:h+gR6FrvQGVbiIMzQtNb/lUy96jiKJ2nNFO0g:hb6VIAbzlUyxq
TLSH
T1A7F35B43715E2967E2D2B7BBECB441151338D08DD76B271BACC8109CF54A0EF82A5EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\jsse.jar
Size 517KB
SHA256 fbf81ba96022506e1a98a71fe397a2c6778baf91e715dce14119ac0dd8cec748
MD5 fa18a9c585b8fd5cb50222bc6f3a42e3
SHA1 03316cdea929cfdf6e6c20cb05f4e22b8d6b5e96
SHA512 4469f0c8eb223d353cd432787ce82c83a2ffdbf383de7831c2a5a6397dd5da2c487e1b86a5e155e1f8792dad4c0209c34d0e9eba8645784f8482af7fad804e46
SSDEEP 6144:yTWIVEhaEBVObb3IiusBqAoRAfj5Y35k3JK38cX:yT9syNyA74KHcX
TLSH
T1F7B4A317E20D95BFF244EAFF9831032C23346C3259A3E3785E49492AF5DA5F14A71AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\jsse.jar.p2
Size 140KB
SHA256 cd2dff83d8c9d97810341acd0951ffe04dbf4b98129469f396cbcccb8a6910dc
MD5 b671da3b1ab8b0398650e94780ab2bc6
SHA1 19575a0d2c40c0608ffff9224484b8fdd7663383
SHA512 914c6765e00c000cf4141c985ff0f92d292576fd589743072899b2493c29c37f4b4d7030e824b61d030837fc4899b157f336ebaefcdc2519c1e6410c52271716
SSDEEP 3072:uXRJdrAlQMcNuiJ82M+lz1GA7TgGCCCCDqhZIvz3p:uhrrAlQMcN3LMYt73lz5
TLSH
T11CE37B177F0F5102D2EA2E7660F46392933AD210367A27536F451698DDCAAE2CF1EED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\rt.jar
Size 49.4MB
SHA256 bb254c37c8527fa86948fb33a3878313118b69e906fc0a3ae54e012536c4ad6b
MD5 f253cf7aaabbe019c9e03f12245e34c3
SHA1 7d75767c546ee94a7709f173d2a39e9aeba8ef74
SHA512 e55f77ecea9e6e7df294bcdba4bf2883ab0100986c0c72a2db83857de4465e1f8d6d3bb05f5b67d3d872714ad65208b4b24565c823a8e8217e1dbd3f39e96b7b
SSDEEP 393216:CaBSlrl9GvOIS+iGRnr1Z0S3QRd6IuA+SkT:CaBSlrlYmG5r1Z0S3QRd6IuA+lT
TLSH
T185B73B27F2029A5BEA45E2FE14A103655330F4F14683E2E95F688D639DE75D28F343E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1782791515-0-app\lib\rt.jar.p2
Size 12.9MB
SHA256 294c7882bd1728de612e41fec0684cd6f6b46c3da3896a421f826ce984d3a670
MD5 1aaa139ff7c3d00de0d998752ac52aa2
SHA1 37f844c7cbb1591fcbcf2dc31daba0b0dfb46bd1
SHA512 b48e790a42ae8a78589aba45a61ccb798c078e3b2c95782af79183801ad4da814bddadc9c318f98281367e74171c3972afa60bc045c8cd194ed7f9f088c353a3
SSDEEP 196608:yos0S7V4zmgggLYJ4nouGR4eWC2cSw6rJn9rr:1KaagggLYJ4ouRZbln9rr
TLSH
T13CD64A037A8F790AE3C11F3442B16392027AD20416773B57BE186BBCDED61E2EE15DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 536KB
SHA256 b0867f72f0d049b2690ecb545c786c1510f72cf8f6203ca437d3d1214893f069
MD5 fb8a31c03f0bca13f618b50ab75d02e9
SHA1 41d1cfa6805b83015906b98b07a5e2167be5a802
SHA512 3cbbddba38651c15bec6433e1992230fb160acd29350bac1256abf635e76b78e914bb19e33584fcb9bd300e8f865054f39eafb20a5d1d2c368128988ddcd835c
SSDEEP 6144:kxS6C032eXnov1ePr+t/L8FefSjZZwh6GYOxdcG1ocX96tiMUltre2:kxS6cejKp8FefSFK4Gt+cX9Ogl1F
TLSH
T17BC4CF0271C1E1B1D6928532B31E8BB3DF7EE1A11725C1C357F059A99E392D29B3B389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2212-1027-0x0000000000A70000-0x0000000000A71000-memory.dmp

Download

memory/2212-977-0x00000000047D0000-0x00000000047F8000-memory.dmp

Download

memory/2212-994-0x0000000000A70000-0x0000000000A71000-memory.dmp

Download

memory/2676-1162-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1136-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1320-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1314-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1313-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1311-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1309-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1303-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1291-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1285-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1272-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1267-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1263-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1234-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1233-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1053-0x0000000018200000-0x0000000018228000-memory.dmp

Download

memory/2676-1056-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1060-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1061-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1073-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1084-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1094-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1093-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1098-0x0000000018240000-0x0000000018268000-memory.dmp

Download

memory/2676-1125-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1131-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1130-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1127-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1126-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1232-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1153-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1163-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1224-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1166-0x0000000018AF0000-0x0000000018B2F000-memory.dmp

Download

memory/2676-1177-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1186-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1187-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1194-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1198-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1200-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1199-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1206-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1204-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2676-1223-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/2876-942-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-943-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-761-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-810-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-745-0x0000000004200000-0x0000000004228000-memory.dmp

Download

memory/2876-814-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-813-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-959-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-757-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-947-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-882-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-897-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-915-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/2876-849-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/6480-848-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/6480-843-0x0000000019200000-0x0000000019228000-memory.dmp

Download