460317923277cfa8af4973027afed29979dddb55336d08dfd656326810ce8439

Analysis

user interaction
yes
max time kernel
62s
max time network
61s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/10/2026, 07:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jac-Code-Setup.exe
Size 5.4MB
Sample261027-h3bmtassft
SHA256 460317923277cfa8af4973027afed29979dddb55336d08dfd656326810ce8439
MD5 46751cf1c7500c3826dcc7b278290cf8
SHA1 58dff9c9c3489457270bc443fe8868e94eec8240
SHA512 4e8735f0a45de087b7b0b32962f46fac62ac48b65c5ccf19277d357d1e81cfec5558e7e8dcd9099321b3ecd3a1c12e6ff0e54b192906e8570c0a397d24b43711
SSDEEP 98304:oagzHLAR2PDSo1BBAThFJjA2gD7uEoyeVCb4MABph:iNPDSEBAThFJjin0CFAPh
TLSH
T16F468C1933FC6E27D56FE776D1B095126BF5F86AB363EB0B2182D2A54C12B105C423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	1764	Jac-Code-Setup.exe

Executes dropped EXE 21 IoCs

pid	Process
1932	verified-installer.exe
836	jac.exe
2484	Jac Code.exe
1036	jac.exe
2080	Jac Code.exe
1552	Jac Code.exe
4432	Jac Code.exe
4364	Jac Code.exe
2300	Jac Code.exe
3896	jac.exe
1660	Jac Code.exe
2352	Jac Code.exe
2908	Jac Code.exe
472	Jac Code.exe
5008	jac-engine.exe
4768	JacDesktopLock.exe
4500	JacAuth.exe
3400	JacAuth.exe
4560	JacDesktopUpdate.exe
2060	JacAuth.exe
1000	JacAuth.exe

Loads dropped DLL 13 IoCs

pid	Process
4432	Jac Code.exe
4432	Jac Code.exe
4432	Jac Code.exe
4432	Jac Code.exe
4432	Jac Code.exe
4432	Jac Code.exe
2300	Jac Code.exe
2300	Jac Code.exe
2300	Jac Code.exe
2300	Jac Code.exe
2300	Jac Code.exe
2300	Jac Code.exe
472	Jac Code.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Windows\CurrentVersion\Run\JacCode_F9078B62610FCF91A3F6 = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Jac Code\\jac.exe\" --startup"	verified-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac-Code-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac-Code-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jac-engine.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	Jac-Code-Setup.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe
Token: SeShutdownPrivilege	2484	Jac Code.exe
Token: SeCreatePagefilePrivilege	2484	Jac Code.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	Jac Code.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1932	1764	Jac-Code-Setup.exe	83
PID 1764 wrote to memory of 836	1764	Jac-Code-Setup.exe	84
PID 836 wrote to memory of 2484	836	jac.exe	85
PID 1036 wrote to memory of 2080	1036	jac.exe	89
PID 2484 wrote to memory of 1552	2484	Jac Code.exe	90
PID 2484 wrote to memory of 4432	2484	Jac Code.exe	91
PID 2080 wrote to memory of 4364	2080	Jac Code.exe	92
PID 2080 wrote to memory of 2300	2080	Jac Code.exe	93
PID 3896 wrote to memory of 1660	3896	jac.exe	95
PID 1660 wrote to memory of 2352	1660	Jac Code.exe	96
PID 1660 wrote to memory of 2908	1660	Jac Code.exe	97
PID 2484 wrote to memory of 472	2484	Jac Code.exe	100
PID 2484 wrote to memory of 5008	2484	Jac Code.exe	101
PID 5008 wrote to memory of 4768	5008	jac-engine.exe	103
PID 5008 wrote to memory of 4500	5008	jac-engine.exe	105
PID 5008 wrote to memory of 3400	5008	jac-engine.exe	107
PID 2484 wrote to memory of 4560	2484	Jac Code.exe	109
PID 5008 wrote to memory of 2060	5008	jac-engine.exe	111
PID 5008 wrote to memory of 1000	5008	jac-engine.exe	113

C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\jac-bootstrap-dcaa0018984847c29767861f3dd7e12a\verified-installer.exe
  "C:\Users\Admin\AppData\Local\Temp\jac-bootstrap-dcaa0018984847c29767861f3dd7e12a\verified-installer.exe" /S /DIR="C:\Users\Admin\AppData\Local\Programs\Jac Code" /DESKTOP=1 /STARTUP=1
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1932
- C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" "--home"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1648,i,15517298031181540508,533114035478651725,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1652,i,6564287703948529468,8023088807355716150,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1700 /prefetch:11
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:1552
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1648,i,15517298031181540508,533114035478651725,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1652,i,6564287703948529468,8023088807355716150,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1644 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4432
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --app-user-model-id=JacCode.Desktop --app-path="C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1793084793491198 --launch-time-ticks=587593350 --field-trial-handle=1648,i,15517298031181540508,533114035478651725,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1652,i,6564287703948529468,8023088807355716150,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3012 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:472
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\jac-engine.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\jac-engine.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopLock.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopLock.exe" transaction C:\Users\Admin\.local\share\jaccode
        5⤵
        Executes dropped EXE
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe" mcp-config
        5⤵
        Executes dropped EXE
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:1000
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopUpdate.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopUpdate.exe" startup "C:\Users\Admin\AppData\Local\Programs\Jac Code" status
      4⤵
      Executes dropped EXE
      PID:4560

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --startup
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" "--startup"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1612,i,16321021389715626305,11951886079463133317,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1616,i,10454367228384297451,14701809924322087132,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1696 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:4364
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1612,i,16321021389715626305,11951886079463133317,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1616,i,10454367228384297451,14701809924322087132,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1608 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2300

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" "--home"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=976,i,4191125604330072028,11399157114518782219,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1640,i,5181251029216198090,16179740922456183611,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1668 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:2352
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=976,i,4191125604330072028,11399157114518782219,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1640,i,5181251029216198090,16179740922456183611,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=972 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opencode.db

Path C:\Users\Admin\.local\share\jaccode\opencode.db
Size 4KB
SHA256 97e8d54f8a7255106f66cf1b213c4a4d7b558d21310b1c2bfedc3d0d526dddda
MD5 7521076b0e620fab0a1c8064e30a53bc
SHA1 c3ed68e93b0aa7d81e3118e0724fcbbc0203df42
SHA512 3f57dfd9d6d8e9b8a1d06db976a0ce10b8cd94b6cfce7656e92343e4b9514ee145673f8dc531060e2cc24f08bcd2c62c05b4e803b4a810d91d78d5d82304a8df
TLSH
T16A810440D34000F1D45507F354D1131C0F07F3D4D5410F0315010443CC415444C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

opencode.db-wal

Path C:\Users\Admin\.local\share\jaccode\opencode.db-wal
Size 253KB
SHA256 76d11d3291d5a117eeb59f9bb19b657f431754377178c91290aa025954166b9c
MD5 fccd022a0f6db8d2d166f9184f574569
SHA1 242b9b40f16919f021f2b9180e263a9c8f30da69
SHA512 b6e46d42fcaff8b270adc61eec03ff818271434c926a85e825906931538bb825569b6092ca4e62e923e597db38a07be808a0145cf450dea0facda7345480a1ce
SSDEEP 192:NzPOKulPm6L+8GtrjRnYlBrjcvxFXno1td:Nsb1GtrNYlBrYvHoB
TLSH
T13D44000D7D22E732D5EBD830A5F6B9515675038BAFC0BD5232FCB860AFA8EC4543A419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\jac.exe.log
Size 1KB
SHA256 49a3acf6e903ba12893f37a076a40b5a8311a577eb01b66f2d61e99617afc793
MD5 c565ada6ec39f3c2b24db4c3b1963503
SHA1 bab4221466b51fe13b47d9fd9d5524af80fe71f9
SHA512 65bb20c3844983037ecc4a4e52aeb2ed13a3a7d57d570fad137f0fbe0c56e9de371c4a3ee1712b842c0eebe98531df403e1e90159b0df44943318151b627c6b8
TLSH
T1401178713376A1D889163F821C1E578423FF832AB550AD08B998635EDD3701B6B213F7
MD5 SHA1 SHA512 TLSH

Submit Download

.jac-current.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-current.xml
Size 34B
SHA256 bdb23f925aef44c422bfe9ae6d792c786ddca999db15bde5c342a7ee50778744
MD5 32ab1cfc4a515b27c6c52b5d2a61c326
SHA1 79e6fecc46b95f14525a4f6748af032d5241a537
SHA512 41fc1d1413a3df130ab36383c8a4d283650e448e75f0d3e318d03d0bd5452a40a0dfcf27f6b35bb11c5d64f66ff3da9ac2f6ec4e182fe2bf1cb3af4a72d4103d
MD5 SHA1 SHA512

Submit Download

.jac-install.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-install.xml
Size 2KB
SHA256 f7ab74a4bbbd3dc2604efdf57165748b1dd833cb3812dc77441967e9851c4214
MD5 d6b2f453e70c3948092d0d89447335f0
SHA1 add5d9f90152014e92eeb233f15977498e512db8
SHA512 9e859f49cb4981ce2dfc625c29dec8d3a05c2e074dd96b393f6557bce7cd9c482540701ff9740de6e0beaeb176e3997586f2cac9d5cc6cbb03587fdf738d4292
TLSH
T11A4178BA48D4F32E5030AEFB6B09B578B329C821325D2945BCC9058B53B516973CB5EF
MD5 SHA1 SHA512 TLSH

Submit Download

.jac-transaction.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-transaction.json
Size 2KB
SHA256 d9ac7e3abd0d3736e09f9f45e1422125e4a2b2151e37f97b29fd3bdef961839b
MD5 076cc4f4a509f1dab96382c5f1d0dfee
SHA1 d9066242689045f622c7ed35cfa7b242a74664f7
SHA512 0b18d7f9b4cc4003cb2a3d6ef65a45d78d8fcc355a11db97811b8750980a78b575ef624b45917fbeb0804e34f3b5286999728fc151f138a5a3c5f0dae2358dc1
TLSH
T13B511F6D1525EDAE53821AEC42038B9EE376DC36E0DDB08FD88B0B8273F705A5654453
MD5 SHA1 SHA512 TLSH

Submit Download

GETTING-STARTED.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\GETTING-STARTED.txt
Size 2KB
SHA256 98ad68f94aca24ca7c68274952f24c22456603e00480a6d2c46c5a4301b3c0f4
MD5 6ac9bab1aeb1c5be451e515fd586ff12
SHA1 9b5a84ce8c0201646b5635882dcb2f9f6591484e
SHA512 649b59ba6381f4b9633ebd9f841da54c18279c9be00ec5da7a3b262703ce404cbd9bb4ea3ec75fd375ce3ca812d1e560fd21ba9c1cf3b48e13adac3a9dca6f76
TLSH
T16351C97B7BCB368C36530385BE0183D1AF38A1683B990961F85E549C425A15897B3736
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\Uninstall.exe
Size 49KB
SHA256 10b3c1981b6d33e77ce8cebe98dfe27af2a714d3db72d95ce493576276b9289e
MD5 f0cde3ad25849dbcd8628f89ffa27225
SHA1 0c097fddd2a433562f21e65fb8a6a734b70be0b0
SHA512 f40f27c0be7a66d05fa5390ee7944737824f70b20dec9d5a984efb1e91590ec1ccce5001d3cbc1c87cbd2e6ef44c4ac0e132915762d7f1c02861fc1d679c79c5
SSDEEP 768:0k+d0gKB7FKB1z+dlvqom14tEo9r9jLrAkpxy:0keUuwlvqomatB/XA
TLSH
T1D333D64977E84B24E6BF2B78A87152548E71FC57DD32EB5D1A8140AD0D3AF80CDA0B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
Size 29KB
SHA256 e8e31d120fc43e285c0e26476c401f5b7583b954727ca9d16aa6fb62611bdf76
MD5 04378fe2f273319a172a3a0c88e40a3b
SHA1 d6404a20e59391e858e368f6b97fea054adf06de
SHA512 4e0fc9b073ffb14dbc334916e4c201e10c971af49d1077469747ff0c74b14916e7270a645bb7ecabc1eb1dfdd208394bdb4b5450f7ba3fa5b8b30e3bd941ee51
SSDEEP 384:2nKEgDTKk+aCJJ0cxXDXn5DAhiC+4yTjV1StYg12+UAdYaKUlkNpjRpmK6xyWR:tTKk+N0cxzn5DAhiCOPStI3rjRpmpxy
TLSH
T1CAD21B496BE88B74D5FE0B38A93121559E71FC5AA832FB1D1F88507C4C3BB848D91B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.ico

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.ico
Size 3KB
SHA256 0aa6b0cd0fc67bbbd3575af1409cd4e824c52d6c2f36ea7af5640582035c1629
MD5 68e740ddb6f215c4dfbbb372c7944b4a
SHA1 0155f1f29940701bfdbffdbded519c70f339f2a3
SHA512 f770dd9b66f90d9818e3459eb64ccbdd814adc667cde9270fcfe49f3cc4776df75024a801c164dcd164d35e114cb0716133cebd99fedeee18f53f7580d1ec7cd
TLSH
T1BE8163CD1B8C4EF8C65944214B6B31B2FE75ACDE247D39167B74B4748E1E58025836C2
MD5 SHA1 SHA512 TLSH

Submit Download

DEPENDENCIES.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\DEPENDENCIES.json
Size 197KB
SHA256 31bc7b101cb4af57a0a6c94cc809dbf4cb9b40930a40c259100db3993e3567bd
MD5 a77b47e13b7e64238fd46db726f2894b
SHA1 94ca4efd9fe92fd5c947e3ba650870cc9219d701
SHA512 7d9b30c2eca62327d342e97b93d2a91fc017e736420207e0048110bee43daf3710eb845256afbedcce56f69c4ebe7e007cf61a3f6aa020910cd9a854b58ca31d
SSDEEP 1536:GYW8PltFxCbAQ6mpoNFyNIcfWgD3s/Tto1lx:GslrxCbL6mpEFyNtDr6o1v
TLSH
T10F14FF61C6706CB7288C8BB4092A564A762400471D6D7D0E33AE9A7C5FBDDBF28F171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\NOTICE.txt
Size 222B
SHA256 4b92f3c799b77b10104227f9e778063558cafcafd883d57de058b1a00d95b0d5
MD5 4919bea71ad9b72c7d6c6d7c6fc6d821
SHA1 449a00908cdfc9c17acf0a7fa4c5101fbd1ccf8e
SHA512 a786e10b92f8d9ad67aa5e4587242aae3665469ac7a4f88f8941febe3f50af4623db1762e8bff2b7f8424fc912928ba8e54c90713c6f6c6107395df1eb2bc06e
TLSH
T12CD0231E618A17D586310386F55BB3DFDB158D0803E04297A0B5410E01DB1B89367FBE
MD5 SHA1 SHA512 TLSH

Submit Download

OpenCode-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\OpenCode-LICENSE.txt
Size 1KB
SHA256 b5c625d157735f04e1b2b7ceccee849130b554bdb23cd58db55a38a257efbbdd
MD5 943d7c4c5077c4cbf3fe540cbbde6ce1
SHA1 a6b66f875a6b320a472c667c0675ca0ceab1b89c
SHA512 8de19a86a32572202c2d102f82626999e9f42cbd8654a9f73092d9e09db8a1f18a1e7d74c77532a7eb9d1770854f152204e15a0c6bd0bca97d877065bc52c013
TLSH
T14911B52F72960373189657A055B9ECC5F22BB14A7FAF1A84346EF2091326058C9FFC68
MD5 SHA1 SHA512 TLSH

Submit Download

THIRD-PARTY-NOTICES.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\THIRD-PARTY-NOTICES.txt
Size 5.3MB
SHA256 e9eee1733aadc53787e0f4c8e4c3a40b80b09b8513251a15b7b8d93e8151ce24
MD5 57c065c3fa0c3160e9db4866ef46465c
SHA1 665f042c52129cb5cc09291fc56da4e0b40ebaca
SHA512 4afdb92e7083b0bfb5f44ac77453f01ae378eb925f69ba40e6e0aea1905c5102dcf74b735c4d01518ded48fc50ac901fb51e03ca4b3356c5a0581edcd5d7e06a
SSDEEP 24576:6Orh0I+sE1KBf9beApGk/CzvTCKo9CzWhCt0Lo1YzgBTEDBxPLlj6ulj6J:6OrhAP9
TLSH
T17246C72F7B48037319D343616A6668CAF21EB03F3B5B2644345DE258273B76982FF598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FFLATE-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\FFLATE-LICENSE.txt
Size 1KB
SHA256 0a1df3a083d0c010560aa342e87959c8c1070e6fd54545741f083f22d0c8b551
MD5 b44ae31f7482d1a8d2f9bce6cc409db5
SHA1 e8f37052323f71060dab76883ed691cf95c0cd69
SHA512 5d5eb9ccf01a5be79b40f0cd157cbc6e2c20d88c3d499422026fbff7aeda999fee25fd52fa6bc5b202e2aaa7de3602be005c65235cb1f2e59f2737854ca17da8
TLSH
T1CB11791E72510772189B176055746CD5F13BB25F7E5F2A84246DF345233A06CC9FF840
MD5 SHA1 SHA512 TLSH

Submit Download

PDFJS-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\PDFJS-LICENSE.txt
Size 9KB
SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
MD5 2ee41112a44fe7014dce33e26468ba93
SHA1 598f87f072f66e2269dd6919292b2934dbb20492
SHA512 27b8c0252eae50ca3ce02ab7c5670664c0c824e03eb3da1089f3f0a00d23e648a956bcb9f53645c6d79674a87c4cc86d1085dc335911be0210d691336b121857
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
TLSH
T18822512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\LICENSE
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\LICENSES.chromium.html
Size 19.4MB
SHA256 5d545ce8065079f38a82472ab93bd62fcdf73cd319f0771ef51c45c7e243f1d4
MD5 a1ee17d90caa1bf1f3726ec03842f18b
SHA1 27a94b164c4255ce0dcab5c020f335a9cd3f8c60
SHA512 d9f7448213a449535f1ff43090c08f0e2388af4e72ce2f59e0b1b457a831f76c0d7d69d88cd435b1682479d31d480b19a5488dc3ef6c133c974557d5bdbcf446
SSDEEP 49152:52SFkMZThUZLQTYp281vCmR3r8xsJQfiFTuoYQdVi2Hxj37D4h:f
TLSH
T11827B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\dxcompiler.dll
Size 24.5MB
SHA256 b25b6c8bc64c9ff17ed16e0d272bf0bd7b305f3e19f792a72c8145a6bf624584
MD5 d1b78f795d632caf74e3f6e6aa09f770
SHA1 4f91847c6924c50868fa961973526327c13945c9
SHA512 95edb7b4c761a0feb19e6b348f706e38bd2a9a8dd674474271f6cc23de8b92b99ccbe80bc48e2bf6c9381242db94fb77ab0e22b2b0a2ba0d1a30d9a7c865fd1c
SSDEEP 393216:XClYzmZHZRxtwnLsde/Vuyjw4O+qZG/+V:tORi57JaZGW
TLSH
T167473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\ffmpeg.dll
Size 2.9MB
SHA256 1b9d751721a40fc8fba2355172382d0e0c210e54c7f2862ebd8a6b6a093f832f
MD5 475107b162007199044cee83e815f771
SHA1 d3ef20d40f696710164994cfbb55edc4e0ccda07
SHA512 8d81ecd673d59a773d18369849a11878a41a5c92be6c4ee7dbf951070bb833e604a357d6a0e9a58d070df484069fb4c923a9e3c7b1802e0ea5d9062258f4fa46
SSDEEP 49152:odfREhAZtlrINr/T6XF2i81IQbx6i1N2A0hGR9/HvaLukwhBuO1i:o9ZtormXFgLaLukwh3
TLSH
T197E59E02F6D251EDD029C03497ABE213F271780A4F205AEF17A05A253F66FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\libEGL.dll
Size 467KB
SHA256 fa8cf715db0e2a7a0f20a2b583221e439c484390b400ec70ff5956ea70d55aae
MD5 dfafc7b1b6948618c9d49f471b389456
SHA1 e4588df2cec79e131cf96d1e2e437691b9bc13ba
SHA512 aa391adb7af700e4304fa1bcbd0ff62fb63d3cd2d9603739487a537b45c25e45b2f9e79dbe79fb3354e6c14561d9b46907d136fd35880968f7df69d979a52b59
SSDEEP 12288:NGxGyTj2M2uuMlptOdxncCjfsLFm5kQDhfl1:NGxGyTjT2tMluQLIk0hd
TLSH
T1F3A47D15B3E949A9E07BC138CA538643EB71B8560B21F6DF02A0D2793F77BE45A39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\libGLESv2.dll
Size 7.7MB
SHA256 b6548524109b605155fcccccac8836c3d29dde3f1f6337f67a2bfb7931b9e0a0
MD5 0cb591214b989bcafd178c5337095edd
SHA1 0cf018723bdcc568e3a666004e34f1e66c97d45f
SHA512 4dd7b6ba31511160d447138c628a713e529fe494fc58e1a28f69dc80c51a41a96774805858a1555026b7f90a545743a9617e9e4b0172d3faff03f9aee48b74d5
SSDEEP 49152:a4AMBWsanmFGBeBMb0y/tQOZcS4vl7s7EGt6j9pH2Isk2MKWcL0LM0k7bzsKVkqC:xMR/ldEzKNtLsKK4X6F0HO
TLSH
T1F9866C03F69681D9C05DE2788757A223FB34B8850724F6CF2B9457152F6ABE0AB3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\locales\en-GB.pak
Size 552KB
SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
MD5 121461689d08e6e0d1e0ad4e6c695f7e
SHA1 113ec35be3b54ebf9e2b064181475bb82dda2670
SHA512 69b0d1d401aafd2fac6ed86f3c51de4889ebda123c6cfbe6267e83cd9271dccf7db2627cfaf31bf5713efad48845662763106ef26da09803a1580fa04c7416c5
SSDEEP 6144:D1Zf+l9GJBIvNBlxIxhb5E43FzcieMaMP9zQ49lfaYHEJjXCYDcBcnR7K:D1ZfqsJavNBPIxhbQvMNQ49UhDc
TLSH
T13AC43D1FF784126A05A311A2BB0AA5A2FF23D07CB35112667CBD811C33B676583777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources.pak
Size 6.6MB
SHA256 b92a3508c9631066b013adb736684e63e7b9e82e5f4c8a005b243e8e6b2bb5d2
MD5 d36dc817d163729acb7886ef14673881
SHA1 cb7f36e1ba0f649bed5f4c34510eed1e0e2018bf
SHA512 2e81faf0b555818ed61a4906226fae8a2d79f51216c67fece11bd9a6eaa7a784f88b333b6df1813d62c023874b49a8e8a9c1288ffda489c943b7c87a5cebb6ab
SSDEEP 196608:plsBRHPfIXoDTz9uTjTMkriACmZnC3gEL34tVrW:8Tvr/ztkrDntEoVrW
TLSH
T16A6633D266E3A80BCE9063B98984CF39199CAF2572D4B093489D5119ED9CF5C0BC4B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAttachmentGuard.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAttachmentGuard.exe
Size 6KB
SHA256 5c305dbe31ffeeeea321bc3ae6870a70662227ca477324ffa349dcc9eb6712c8
MD5 a8b1d38e270c90ecf7b2e4151aff1626
SHA1 e0eb85040ecd449f22c52e0a34dab0e4d566a61b
SHA512 afdb6c6a2a0227d96d91c47a25ac1c9c0a052d4a3bfba8a0eb246bed33f63f464f45ee598bbd3199153467a476046db83d03d70750e86bff341bcf75504e0942
SSDEEP 96:UdyoeMd+7C14+rdQiPDYik+VcoVQ3Dlk6zQp:Udyoe8XrEgQO6
TLSH
T15CC11A49E7CC44A1E96B037C5AF293011BF4FA5CCA6787BF24E08279BD117440B82391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAuth.exe.e03b5016b90440ea9eb8fd5e01ca1af0.tmp

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe.e03b5016b90440ea9eb8fd5e01ca1af0.tmp
Size 19KB
SHA256 8ef75c1d35ed40fc1f8e13ccb48c41d3390e5d13cc2a44561887d7149d0d61f9
MD5 aa09e63f8b24a2901b95845445811523
SHA1 000e894ecf32e4852a137d5f225db521e2194a3a
SHA512 35ae84f772f36cc794fe90cead9727a1fc19f96ec40098a4ae5332d4cd3489471db5d8ded32ecbb7c93d5f85df028e6292c748acf4eddb64cb24e2f14f6d51b3
SSDEEP 384:hs092bZdfy6aspecyrUzfHjEWxX+69AYfx57cc1GnDrCs:hD2Vdf10cyrUz/jEWE6Jx4C
TLSH
T15A922904B7E8C712EAFF4679A87247400E72AA975D66CB4D0CC5A8BF0D73B508D94FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacDesktopLock.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopLock.exe
Size 5KB
SHA256 06c826472913e12aace76ee1229b1b1243854734dabc80a8ee1719dd6f88ba78
MD5 36c83fc472cb35e367d804153b1193ed
SHA1 625c1545259e35fdd62f9391b075ddbcefe633b9
SHA512 9856b7020b7ea2282a066564e1d76b609d030e1d120a7a8a9997462f24993fa8370d9a9d682e6b646e76072125bf63d21f6fdfcc9702e23fa1e6ecd8a3315ed8
SSDEEP 96:UrzZaM3C5ZCW/X67Omvr3uPsD3Dlk6zQp:UrzZaM3C50W/q7Omvr3ZDO6
TLSH
T1D0C1FB46B3D44522E57F477459F3430527F4FAAA4D6AC7AF9CC4851D6C1238C8B607E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacDesktopUpdate.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopUpdate.exe
Size 43KB
SHA256 901ece9b4d4c6bb1dfb1e116af8805c39de86a49787e44c22e0560729ee25e76
MD5 132133c7229ec44ff8c8c1019755e8b6
SHA1 4280906104db6430d0796fdedf4626f66929123d
SHA512 61df81026bf9b73a1d2d36fdeaed429529bd1b3c480d1b31b148e24f55e8f0564937e3899ea9a913f3952f4e5fdab1534aeb7718dd1cf66997c83673f2e76388
SSDEEP 768:7RcCU8p2qeJxCgbAQWF2EtB5MRd1AIpxy:7RTsqssQWF2EtPUA
TLSH
T164131B4937D84A74D6BE5B38A5722220DE72FC5AA536FB0D1F84547C0D3AB808D92F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\app.asar
Size 3.1MB
SHA256 e3229e3e8ce7f00d12b2f29514def40726b275888c08b491eef6b54b160e3ff6
MD5 4113b8ac2146b751fa28ded719bd1c04
SHA1 dd3c33cc77c38b840cea869cde3c9f2535b7df83
SHA512 8a22c038b44dfaca853211065a9689bd8e520e2adf7732a8b1246a2b3b3c53bd554d81670a3692ea993849f3da54936dbfbafb3b338bcf6685991dcf6ce405db
SSDEEP 49152:Nv0EtKhL9RcwUMjmasACRF8LHFKo8oiceJhJZ6aLNgZWsuigKXuMBlRwudx/fff+:LqkJoW
TLSH
T16AE52A5923F714219663B0B91F1B0102B636A417380DCD5DBE9CCBD06F4A86992F6FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-integrity.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\client-integrity.json
Size 6KB
SHA256 7a8eb4e57b869a0e0ebb687cd757aaf41be7e95a0c46d22743f4ab759c60577c
MD5 b8053b8d276ecca91a119a5f89421e3c
SHA1 a0f00504a3af4b01b159fabaa3ececf7de3b58d5
SHA512 e016377500faec456f26db65366ea194e7e92f45760d83aa6f6778227698d1beb42c7882f1fbcb5e2d6bd2a0bd25547570ec175540b6e602ae2991640d876608
SSDEEP 96:AaJLoOO5xfVqmDB/S8urSpIUn+7QWpQjulK+Trwe9QfkranfF8ZWTe547MjPOyv1:A+fIx9lDB6RlpQRy/wkCF+Wz7orvZD
TLSH
T153E1C8E251A5F25D7C04733E57D9BE424B89D0850AD36F98A0D94AC4203BB87ADF24BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\v8_context_snapshot.bin
Size 704KB
SHA256 b0874ba2f21ccf59f8a3086168ad782834aeeabb4acb644a20744a1cbeb5bf59
MD5 8499aa219e4679efd7df4b5e0d767fe1
SHA1 3ccbe3967272f758fbf7d217fd6e40894e670053
SHA512 c6ea72fc00de1aa7a29a83d2d503a061d49f3d629bf1421731d5a9cd2e3e7ee310f581e465a1f440c43cf2bd7a1cdad4ae9cb9f41f8ecb8e00bb095096193dd7
SSDEEP 6144:jBrQKX5Xst+HlXawuu7uN4udhbM2Ndgp2BsaXgHkmybvAdEpjyHZdhU4iPWlan:mW5XhubLjbM2NdOeH4dEUlURWYn
TLSH
T1EFE48666FB06CE26C8657A7D8DD74B063A30B2DD9EC6EB077021937CB8786544D2E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\vk_swiftshader.dll
Size 5.3MB
SHA256 4bd642ea08bd933014cd5c44911c4422bd6f69c8569f494de79054536a6469e0
MD5 d37818372f78d8474170cd97e89727e8
SHA1 259deaebb92eb3b7f8ce5bae70a8b26831459fbb
SHA512 9d2593c075ea2c44760656b131c571fa0ece1fcbbb9df86c8616493588e90bd4ef69dd48adbe7a214a89d0fa2d1884cbac134a8d2a2a6b3fdbd8f83b3c708175
SSDEEP 49152:xVfzRLVriek3jvuhmV9lbL0aLgztfbkiNSYoCESb+ngPskvIC6C2Qf+d+0C8m8KZ:xVfz2pFxbkkm5X
TLSH
T106464903F29681D9C06DE679875FA623F631F8800B2276DF56A00F192E69FE06B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42fad6b2-7eb5-427b-8193-5891b18b9164.tmp

Path C:\Users\Admin\AppData\Roaming\Jac Code\42fad6b2-7eb5-427b-8193-5891b18b9164.tmp
Size 490B
SHA256 db3a3de3166206d2460dd66c0bf5e39f10ec83228f0be761a8e57a579a176d1d
MD5 688c59f009cff849f5ed08c0293d4927
SHA1 8e74f4c0ac82e5fad80d703377ad4d5a78fd35fb
SHA512 5d3bc28bd0a1f3f26227596f67c19702f112acd3beb1e82d579bf77f59853e3fa62f1a894973d033dc182dc8c1d1cbc12b38207bd82e9a88b892e5dda0252819
TLSH
T187F00E70A8219AB63AA24A28401622030E3823578B4B5358B969811F51A6D06820AD30
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local State
Size 490B
SHA256 deed2993333acb923deecd45e3fd86cb5b42b4c98d70cde12defc4d370eec07a
MD5 8cc9969e94d20f907c77596b47d93f05
SHA1 0f635d83b27d215fbdda51ff0c6454928d89711e
SHA512 074dae57e08026c17d50b06b9f0380670aa88805dcaa092570a868f6d0d8c04156ab5ca822dc00aa8e644ba75d4a668f442beae3505b10114e8fb2f7285d730f
TLSH
T194F0DCF39470CDF52B71AA256837E7130D7825878E0E13549A4D462206E3A55A30FA74
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

.integrity-v6.key

Path C:\Users\Admin\AppData\Roaming\Jac Code\backups-v6\.integrity-v6.key
Size 32B
SHA256 7732e50027447255001b9e0a19b982683bc41217d8e7feb69978ecf9cf70487a
MD5 116295cff0c031ac18228fc3bf5c97ad
SHA1 287aa0168050a7489b5de616ca671942278a7554
SHA512 c5def72fe3cf54729e5ef68cbd09bfeba618682ba34e9ab0b0ad655642014b7132e2165cb860f7e37d2cb7065986e3c25a19710554ba713aef037066ea7c8710
MD5 SHA1 SHA512

Submit Download

database.sqlite

Path C:\Users\Admin\AppData\Roaming\Jac Code\backups-v6\.pending-f7a2580d-b25c-40e6-8c30-274118bbd038\database.sqlite
Size 192KB
SHA256 b5f5b1844506ece8c4b1eeee0293b319dbc30f18d2b1caaed9096aa8a74f6651
MD5 a3c058955aa29e8fb7b8df491f8ef2e6
SHA1 2200f88c5aee58cbc362e13bcb7ccd4f1aba836d
SHA512 f3a82480450623e546adad3090d8df90a7476bc1b1a3389cd62e5d76966db173d31635d4d636df1f9bbd1a68a5b7bdf624c1109c329aad3890533c2518651566
SSDEEP 96:2ndlIwGjS4r34+/U1j6FStAaTsoriS7nIl8IKSqNdlInGjS4r34+/0UybvHpep9+:2cJtMxFXso1tDnJtLi8TLU
TLSH
T10014004D7D22EB22E5DBD43095F2A8626775138B6F807C1233FCB960AFE9EC1513A449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Jac Code\backups-v6\.pending-f7a2580d-b25c-40e6-8c30-274118bbd038\manifest.json
Size 1KB
SHA256 bc74f3a0a7d053523f267b8e20d3229dd21f3255fdbf03e4d340a4ea83f5cd50
MD5 c81630a13e552ca04aa001ee4eadcd4a
SHA1 b5f466edcd3bbee694af6b678e5209f74c664b3c
SHA512 931398192903c282e7a805917b37aa95d8f173aded224024ba72f6db7a773094888345a25960b368830171eae25cbf4cd4f89848375c1882a55b86de42cd49a4
TLSH
T10E314026D35D70B9974E24AADF070E93A7B5B8013A910C6049DAC085528011CE2F7BFE
MD5 SHA1 SHA512 TLSH

Submit Download

queue.json

Path C:\Users\Admin\AppData\Roaming\Jac Code\queue-v6\queue.json
Size 38B
SHA256 6b6401b3841d14091235e8e71a5f7e767b3198be6f3662576a618cd4d296f732
MD5 ef2682934d7f3705011fa867628f2bf5
SHA1 2ed7634c7711fb62c7404aabe9727a5f7a38d4fb
SHA512 789d7b39a52f16278e8b3ecbded4622f9f32ce46f3d7877925632d40f1865ef08920261a9cb6d532e96d48c95cfe1fa1d876fc6ed3773e0f0bb260b71fa98108
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Jac Code F9078B.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jac Code F9078B.lnk
Size 2KB
SHA256 8f280d9db7a0ee8e9d54969cd87fc4dbf674e5710abcf0c4149fdb5ff2e202be
MD5 6f9423dd79728326bd19697d119bf924
SHA1 dce051bb0b057505cdf7229f8aa57a3cf4b06cab
SHA512 259c00b43eb245209a131385f7892fd7a28624c8738df5cf7158df5c4eba6f78b792f30b228c5e50b06eec96e1742e1f7d5ba2d485726ccd97f30178b5f70da0
TLSH
T12341014196E62B60D3B7083D08AA57354F3AF431DB9A0F0E1046938B4F29F809D04F0F
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\~ac Code F9078B.tmp
Size 2KB
SHA256 924e2d2884ab6af9aa6f212e5b5c20c10a09f9526b5901f740e39be4999713f0
MD5 be1a52a2c21721600351d18800116123
SHA1 bca36305eacfe4a8d5bc04ad96311ed5e621441d
SHA512 37a1e2dcbbc2d5da1817725c434b3c0a7dde7e1454b63a709c1fbb1757767f71cf71978885a06228b316741ef25ebce27f1b13587e9bd651ccedcd0db4e35fde
TLSH
T1CC51C041E7F92B60E3BB097D19B666354F79F431AF5A0A0E5006938B5F29F809E14F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Jac Code F9078B.lnk

Path C:\Users\Admin\Desktop\Jac Code F9078B.lnk
Size 2KB
SHA256 77f76cf6c4858e85a06446ab2e3ed844f395f15df6e6fc047812c00c4dafb68d
MD5 b547c24b9a899f940ccc5bd3e7c4a3db
SHA1 cf344bde29d7f434a3bf14ae5099c9eec6e8a044
SHA512 eb951d24fad3b726a7bbe4ba96bb65aa896b91da90b46dd5904e9a50f418b484a4f387bf9e7056c757173a09e022be7a27dea737572af595436dde0725fe14ea
TLSH
T1FE41EE8196E61A70D3B7487D18B667368F79F4315B4A0D0E5156A34B4F26F809D04B0A
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\Desktop\~ac Code F9078B.tmp
Size 2KB
SHA256 a962c860c8d0079001dc3ef266317e4588538ae17ca23cb06069d0b007aec92a
MD5 0a37c5c6283f75415f9a8a03e3ac8981
SHA1 cc28e8f24c38f3b3a90171f5f93b4decaa4111e3
SHA512 d812a18cd9ef0d1c1a6acf899649df3ad2cae6bd2f4a5f13a82cc9f7ffbbd9caf6f89191bc169d20f3b6c33af7bd9cf1d7316b846ac6cae2ffcf8dd1e345ba23
TLSH
T18451CE41E7F92760E3BB497D19B6A6364F79F0315F5A0A0E5006938B5F36F809E14B0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/472-439-0x00007FFB7BC10000-0x00007FFB7BC11000-memory.dmp

Download

memory/472-440-0x00007FFB7D690000-0x00007FFB7D691000-memory.dmp

Download

memory/836-328-0x00000000005F0000-0x00000000005FA000-memory.dmp

Download

memory/1764-23-0x000000001D9E0000-0x000000001D9F0000-memory.dmp

Download

memory/1764-24-0x000000001D9E0000-0x000000001D9F0000-memory.dmp

Download

memory/1764-0-0x00000000003A0000-0x000000000090C000-memory.dmp

Download

memory/1764-1-0x000000001D9E0000-0x000000001D9F0000-memory.dmp

Download

memory/1764-22-0x000000001D9E0000-0x000000001D9F0000-memory.dmp

Download

memory/1764-3-0x000000001E2A0000-0x000000001E354000-memory.dmp

Download

memory/1764-4-0x000000001D9E0000-0x000000001D9F0000-memory.dmp

Download

memory/1764-5-0x000000001D9E0000-0x000000001D9F0000-memory.dmp

Download

memory/1764-20-0x00000000206E0000-0x0000000020702000-memory.dmp

Download

memory/1764-2-0x000000001D9F0000-0x000000001DE9C000-memory.dmp

Download

memory/1932-30-0x000000000CB30000-0x000000000CB40000-memory.dmp

Download

memory/1932-29-0x0000000000320000-0x0000000001320000-memory.dmp

Download

memory/1932-33-0x000000006BBF0000-0x000000006C118000-memory.dmp

Download

memory/1932-31-0x000000002A130000-0x000000002A2F2000-memory.dmp

Download

memory/1932-32-0x000000000CC70000-0x000000000CC82000-memory.dmp

Download

memory/2300-385-0x0000015C64A60000-0x0000015C64FC1000-memory.dmp

Download

memory/4432-400-0x0000026032EE0000-0x0000026033441000-memory.dmp

Download

memory/4500-506-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

Download

memory/4500-511-0x0000000003AF0000-0x0000000003B40000-memory.dmp

Download

memory/4560-516-0x0000000000FB0000-0x0000000000FBE000-memory.dmp

Download

memory/4768-501-0x00000000006E0000-0x00000000006E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads