460317923277cfa8af4973027afed29979dddb55336d08dfd656326810ce8439

Analysis

user interaction
yes
max time kernel
150s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/10/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jac-Code-Setup.exe
Size 5.4MB
Sample261027-kbddfacw3p
SHA256 460317923277cfa8af4973027afed29979dddb55336d08dfd656326810ce8439
MD5 46751cf1c7500c3826dcc7b278290cf8
SHA1 58dff9c9c3489457270bc443fe8868e94eec8240
SHA512 4e8735f0a45de087b7b0b32962f46fac62ac48b65c5ccf19277d357d1e81cfec5558e7e8dcd9099321b3ecd3a1c12e6ff0e54b192906e8570c0a397d24b43711
SSDEEP 98304:oagzHLAR2PDSo1BBAThFJjA2gD7uEoyeVCb4MABph:iNPDSEBAThFJjin0CFAPh
TLSH
T16F468C1933FC6E27D56FE776D1B095126BF5F86AB363EB0B2182D2A54C12B105C423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	4992	Jac-Code-Setup.exe

Executes dropped EXE 22 IoCs

pid	Process
4708	verified-installer.exe
1628	jac.exe
3860	jac.exe
2328	Jac Code.exe
4396	Jac Code.exe
2404	Jac Code.exe
3480	Jac Code.exe
3752	Jac Code.exe
4444	Jac Code.exe
3492	jac.exe
4456	Jac Code.exe
1724	Jac Code.exe
1816	Jac Code.exe
2560	Jac Code.exe
2112	jac-engine.exe
4952	JacDesktopLock.exe
2148	JacAuth.exe
4800	JacAuth.exe
4708	JacDesktopUpdate.exe
4748	JacAuth.exe
4732	JacAuth.exe
2936	JacAuth.exe

Loads dropped DLL 7 IoCs

pid	Process
3480	Jac Code.exe
3480	Jac Code.exe
3480	Jac Code.exe
3480	Jac Code.exe
3480	Jac Code.exe
3480	Jac Code.exe
2560	Jac Code.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000\Software\Microsoft\Windows\CurrentVersion\Run\JacCode_F9078B62610FCF91A3F6 = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Jac Code\\jac.exe\" --startup"	verified-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	JacAuth.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	JacAuth.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac-Code-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac-Code-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	Jac-Code-Setup.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe
Token: SeCreatePagefilePrivilege	4396	Jac Code.exe
Token: SeShutdownPrivilege	4396	Jac Code.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4396	Jac Code.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4708	4992	Jac-Code-Setup.exe	81
PID 4992 wrote to memory of 3860	4992	Jac-Code-Setup.exe	84
PID 1628 wrote to memory of 2328	1628	jac.exe	85
PID 3860 wrote to memory of 4396	3860	jac.exe	86
PID 4396 wrote to memory of 3480	4396	Jac Code.exe	88
PID 4396 wrote to memory of 2404	4396	Jac Code.exe	89
PID 2328 wrote to memory of 4444	2328	Jac Code.exe	91
PID 2328 wrote to memory of 3752	2328	Jac Code.exe	90
PID 3492 wrote to memory of 4456	3492	jac.exe	94
PID 4456 wrote to memory of 1816	4456	Jac Code.exe	95
PID 4456 wrote to memory of 1724	4456	Jac Code.exe	96
PID 4396 wrote to memory of 2560	4396	Jac Code.exe	97
PID 4396 wrote to memory of 2112	4396	Jac Code.exe	98
PID 2112 wrote to memory of 4952	2112	jac-engine.exe	100
PID 2112 wrote to memory of 2148	2112	jac-engine.exe	102
PID 2112 wrote to memory of 4800	2112	jac-engine.exe	104
PID 4396 wrote to memory of 4708	4396	Jac Code.exe	106
PID 2112 wrote to memory of 4748	2112	jac-engine.exe	107
PID 2112 wrote to memory of 4732	2112	jac-engine.exe	110
PID 2112 wrote to memory of 2936	2112	jac-engine.exe	112

C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Temp\jac-bootstrap-4652d945e0ad44f38fdb101cbff66283\verified-installer.exe
  "C:\Users\Admin\AppData\Local\Temp\jac-bootstrap-4652d945e0ad44f38fdb101cbff66283\verified-installer.exe" /S /DIR="C:\Users\Admin\AppData\Local\Programs\Jac Code" /DESKTOP=1 /STARTUP=1
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4708
- C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" "--home"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,14700117376542076345,8700480598588871766,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1700,i,16026663675000079878,2835349239415263178,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1692 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3480
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1696,i,14700117376542076345,8700480598588871766,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1700,i,16026663675000079878,2835349239415263178,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1808 /prefetch:11
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:2404
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --app-user-model-id=JacCode.Desktop --app-path="C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1696,i,14700117376542076345,8700480598588871766,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1700,i,16026663675000079878,2835349239415263178,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2560
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\jac-engine.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\jac-engine.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopLock.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopLock.exe" transaction C:\Users\Admin\.local\share\jaccode
        5⤵
        Executes dropped EXE
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe" mcp-config
        5⤵
        Executes dropped EXE
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe" device
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:2936
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopUpdate.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopUpdate.exe" startup "C:\Users\Admin\AppData\Local\Programs\Jac Code" status
      4⤵
      Executes dropped EXE
      PID:4708

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --startup
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" "--startup"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1836,i,5237030853906861975,13855859247366185897,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1864,i,16887839577289489189,13534672957871863137,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1944 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:3752
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,5237030853906861975,13855859247366185897,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1864,i,16887839577289489189,13534672957871863137,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1832 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:4444

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" "--home"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1656,i,2857464628393337418,15234333676250611181,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1660,i,8010613377782218541,6416221989076933823,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1652 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:1816
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1656,i,2857464628393337418,15234333676250611181,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1660,i,8010613377782218541,6416221989076933823,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1772 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opencode.db

Path C:\Users\Admin\.local\share\jaccode\opencode.db
Size 4KB
SHA256 97e8d54f8a7255106f66cf1b213c4a4d7b558d21310b1c2bfedc3d0d526dddda
MD5 7521076b0e620fab0a1c8064e30a53bc
SHA1 c3ed68e93b0aa7d81e3118e0724fcbbc0203df42
SHA512 3f57dfd9d6d8e9b8a1d06db976a0ce10b8cd94b6cfce7656e92343e4b9514ee145673f8dc531060e2cc24f08bcd2c62c05b4e803b4a810d91d78d5d82304a8df
TLSH
T16A810440D34000F1D45507F354D1131C0F07F3D4D5410F0315010443CC415444C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

opencode.db-wal

Path C:\Users\Admin\.local\share\jaccode\opencode.db-wal
Size 253KB
SHA256 68022bda3ce7aa7b27ccf4fcd788dd16756675c02783c0ab6512bc592e3bef60
MD5 625e1328a3ca75641203140caa9bf8a4
SHA1 73cbae265df0d11f15efc92c6551465e8b71c5f1
SHA512 64c05154ec91dd69d4146cba1725dc8a6284d9f7f5ca2a8854eb21609972ef743eb4ab263eadb7bbe8e265674e83d78451521a01b9a708aeaed06b7f2ba4e702
SSDEEP 192:UzPKzMAulPHL+vMrjRncK0lBrjuHhs8jo1tOQ:UL9kMrNilBrCJoD
TLSH
T185440F4D3D22EB32D5E7D830A5F2A9525674038B7FC0BD5232FCB968AF99EC4503A509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\jac.exe.log
Size 1KB
SHA256 49a3acf6e903ba12893f37a076a40b5a8311a577eb01b66f2d61e99617afc793
MD5 c565ada6ec39f3c2b24db4c3b1963503
SHA1 bab4221466b51fe13b47d9fd9d5524af80fe71f9
SHA512 65bb20c3844983037ecc4a4e52aeb2ed13a3a7d57d570fad137f0fbe0c56e9de371c4a3ee1712b842c0eebe98531df403e1e90159b0df44943318151b627c6b8
TLSH
T1401178713376A1D889163F821C1E578423FF832AB550AD08B998635EDD3701B6B213F7
MD5 SHA1 SHA512 TLSH

Submit Download

.jac-current.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-current.xml
Size 34B
SHA256 bdb23f925aef44c422bfe9ae6d792c786ddca999db15bde5c342a7ee50778744
MD5 32ab1cfc4a515b27c6c52b5d2a61c326
SHA1 79e6fecc46b95f14525a4f6748af032d5241a537
SHA512 41fc1d1413a3df130ab36383c8a4d283650e448e75f0d3e318d03d0bd5452a40a0dfcf27f6b35bb11c5d64f66ff3da9ac2f6ec4e182fe2bf1cb3af4a72d4103d
MD5 SHA1 SHA512

Submit Download

.jac-install.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-install.xml
Size 2KB
SHA256 f7ab74a4bbbd3dc2604efdf57165748b1dd833cb3812dc77441967e9851c4214
MD5 d6b2f453e70c3948092d0d89447335f0
SHA1 add5d9f90152014e92eeb233f15977498e512db8
SHA512 9e859f49cb4981ce2dfc625c29dec8d3a05c2e074dd96b393f6557bce7cd9c482540701ff9740de6e0beaeb176e3997586f2cac9d5cc6cbb03587fdf738d4292
TLSH
T11A4178BA48D4F32E5030AEFB6B09B578B329C821325D2945BCC9058B53B516973CB5EF
MD5 SHA1 SHA512 TLSH

Submit Download

.jac-transaction.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-transaction.json
Size 2KB
SHA256 ca52f5bacf035c53c4c1eeb4cb8bf7552619d4d9d124c4fd11cd631840a7ae60
MD5 b14f73a29e854ca6280420d094f8a7ce
SHA1 3a8596e05ce49413c9edc8fcd4902c1c3a4474cc
SHA512 204aadbe14b1a4c86d70372e9a38df235795580d0784dbda46ee761e8a860a38bd1cdd79bf831f2ad01b6d0be1f82ae000ddd703267e30678250ee7f02d7df81
TLSH
T144511E6D1525ED6E53C21AEC42038B9EE376DC36E0DDB18FD88B0B8272F705A5654453
MD5 SHA1 SHA512 TLSH

Submit Download

GETTING-STARTED.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\GETTING-STARTED.txt
Size 2KB
SHA256 98ad68f94aca24ca7c68274952f24c22456603e00480a6d2c46c5a4301b3c0f4
MD5 6ac9bab1aeb1c5be451e515fd586ff12
SHA1 9b5a84ce8c0201646b5635882dcb2f9f6591484e
SHA512 649b59ba6381f4b9633ebd9f841da54c18279c9be00ec5da7a3b262703ce404cbd9bb4ea3ec75fd375ce3ca812d1e560fd21ba9c1cf3b48e13adac3a9dca6f76
TLSH
T16351C97B7BCB368C36530385BE0183D1AF38A1683B990961F85E549C425A15897B3736
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\Uninstall.exe
Size 49KB
SHA256 10b3c1981b6d33e77ce8cebe98dfe27af2a714d3db72d95ce493576276b9289e
MD5 f0cde3ad25849dbcd8628f89ffa27225
SHA1 0c097fddd2a433562f21e65fb8a6a734b70be0b0
SHA512 f40f27c0be7a66d05fa5390ee7944737824f70b20dec9d5a984efb1e91590ec1ccce5001d3cbc1c87cbd2e6ef44c4ac0e132915762d7f1c02861fc1d679c79c5
SSDEEP 768:0k+d0gKB7FKB1z+dlvqom14tEo9r9jLrAkpxy:0keUuwlvqomatB/XA
TLSH
T1D333D64977E84B24E6BF2B78A87152548E71FC57DD32EB5D1A8140AD0D3AF80CDA0B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
Size 29KB
SHA256 e8e31d120fc43e285c0e26476c401f5b7583b954727ca9d16aa6fb62611bdf76
MD5 04378fe2f273319a172a3a0c88e40a3b
SHA1 d6404a20e59391e858e368f6b97fea054adf06de
SHA512 4e0fc9b073ffb14dbc334916e4c201e10c971af49d1077469747ff0c74b14916e7270a645bb7ecabc1eb1dfdd208394bdb4b5450f7ba3fa5b8b30e3bd941ee51
SSDEEP 384:2nKEgDTKk+aCJJ0cxXDXn5DAhiC+4yTjV1StYg12+UAdYaKUlkNpjRpmK6xyWR:tTKk+N0cxzn5DAhiCOPStI3rjRpmpxy
TLSH
T1CAD21B496BE88B74D5FE0B38A93121559E71FC5AA832FB1D1F88507C4C3BB848D91B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.ico

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.ico
Size 3KB
SHA256 0aa6b0cd0fc67bbbd3575af1409cd4e824c52d6c2f36ea7af5640582035c1629
MD5 68e740ddb6f215c4dfbbb372c7944b4a
SHA1 0155f1f29940701bfdbffdbded519c70f339f2a3
SHA512 f770dd9b66f90d9818e3459eb64ccbdd814adc667cde9270fcfe49f3cc4776df75024a801c164dcd164d35e114cb0716133cebd99fedeee18f53f7580d1ec7cd
TLSH
T1BE8163CD1B8C4EF8C65944214B6B31B2FE75ACDE247D39167B74B4748E1E58025836C2
MD5 SHA1 SHA512 TLSH

Submit Download

DEPENDENCIES.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\DEPENDENCIES.json
Size 197KB
SHA256 31bc7b101cb4af57a0a6c94cc809dbf4cb9b40930a40c259100db3993e3567bd
MD5 a77b47e13b7e64238fd46db726f2894b
SHA1 94ca4efd9fe92fd5c947e3ba650870cc9219d701
SHA512 7d9b30c2eca62327d342e97b93d2a91fc017e736420207e0048110bee43daf3710eb845256afbedcce56f69c4ebe7e007cf61a3f6aa020910cd9a854b58ca31d
SSDEEP 1536:GYW8PltFxCbAQ6mpoNFyNIcfWgD3s/Tto1lx:GslrxCbL6mpEFyNtDr6o1v
TLSH
T10F14FF61C6706CB7288C8BB4092A564A762400471D6D7D0E33AE9A7C5FBDDBF28F171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\NOTICE.txt
Size 222B
SHA256 4b92f3c799b77b10104227f9e778063558cafcafd883d57de058b1a00d95b0d5
MD5 4919bea71ad9b72c7d6c6d7c6fc6d821
SHA1 449a00908cdfc9c17acf0a7fa4c5101fbd1ccf8e
SHA512 a786e10b92f8d9ad67aa5e4587242aae3665469ac7a4f88f8941febe3f50af4623db1762e8bff2b7f8424fc912928ba8e54c90713c6f6c6107395df1eb2bc06e
TLSH
T12CD0231E618A17D586310386F55BB3DFDB158D0803E04297A0B5410E01DB1B89367FBE
MD5 SHA1 SHA512 TLSH

Submit Download

OpenCode-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\OpenCode-LICENSE.txt
Size 1KB
SHA256 b5c625d157735f04e1b2b7ceccee849130b554bdb23cd58db55a38a257efbbdd
MD5 943d7c4c5077c4cbf3fe540cbbde6ce1
SHA1 a6b66f875a6b320a472c667c0675ca0ceab1b89c
SHA512 8de19a86a32572202c2d102f82626999e9f42cbd8654a9f73092d9e09db8a1f18a1e7d74c77532a7eb9d1770854f152204e15a0c6bd0bca97d877065bc52c013
TLSH
T14911B52F72960373189657A055B9ECC5F22BB14A7FAF1A84346EF2091326058C9FFC68
MD5 SHA1 SHA512 TLSH

Submit Download

THIRD-PARTY-NOTICES.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\THIRD-PARTY-NOTICES.txt
Size 5.3MB
SHA256 e9eee1733aadc53787e0f4c8e4c3a40b80b09b8513251a15b7b8d93e8151ce24
MD5 57c065c3fa0c3160e9db4866ef46465c
SHA1 665f042c52129cb5cc09291fc56da4e0b40ebaca
SHA512 4afdb92e7083b0bfb5f44ac77453f01ae378eb925f69ba40e6e0aea1905c5102dcf74b735c4d01518ded48fc50ac901fb51e03ca4b3356c5a0581edcd5d7e06a
SSDEEP 24576:6Orh0I+sE1KBf9beApGk/CzvTCKo9CzWhCt0Lo1YzgBTEDBxPLlj6ulj6J:6OrhAP9
TLSH
T17246C72F7B48037319D343616A6668CAF21EB03F3B5B2644345DE258273B76982FF598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FFLATE-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\FFLATE-LICENSE.txt
Size 1KB
SHA256 0a1df3a083d0c010560aa342e87959c8c1070e6fd54545741f083f22d0c8b551
MD5 b44ae31f7482d1a8d2f9bce6cc409db5
SHA1 e8f37052323f71060dab76883ed691cf95c0cd69
SHA512 5d5eb9ccf01a5be79b40f0cd157cbc6e2c20d88c3d499422026fbff7aeda999fee25fd52fa6bc5b202e2aaa7de3602be005c65235cb1f2e59f2737854ca17da8
TLSH
T1CB11791E72510772189B176055746CD5F13BB25F7E5F2A84246DF345233A06CC9FF840
MD5 SHA1 SHA512 TLSH

Submit Download

PDFJS-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\PDFJS-LICENSE.txt
Size 9KB
SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
MD5 2ee41112a44fe7014dce33e26468ba93
SHA1 598f87f072f66e2269dd6919292b2934dbb20492
SHA512 27b8c0252eae50ca3ce02ab7c5670664c0c824e03eb3da1089f3f0a00d23e648a956bcb9f53645c6d79674a87c4cc86d1085dc335911be0210d691336b121857
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
TLSH
T18822512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\LICENSE
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\LICENSES.chromium.html
Size 19.4MB
SHA256 5d545ce8065079f38a82472ab93bd62fcdf73cd319f0771ef51c45c7e243f1d4
MD5 a1ee17d90caa1bf1f3726ec03842f18b
SHA1 27a94b164c4255ce0dcab5c020f335a9cd3f8c60
SHA512 d9f7448213a449535f1ff43090c08f0e2388af4e72ce2f59e0b1b457a831f76c0d7d69d88cd435b1682479d31d480b19a5488dc3ef6c133c974557d5bdbcf446
SSDEEP 49152:52SFkMZThUZLQTYp281vCmR3r8xsJQfiFTuoYQdVi2Hxj37D4h:f
TLSH
T11827B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\dxcompiler.dll
Size 24.5MB
SHA256 b25b6c8bc64c9ff17ed16e0d272bf0bd7b305f3e19f792a72c8145a6bf624584
MD5 d1b78f795d632caf74e3f6e6aa09f770
SHA1 4f91847c6924c50868fa961973526327c13945c9
SHA512 95edb7b4c761a0feb19e6b348f706e38bd2a9a8dd674474271f6cc23de8b92b99ccbe80bc48e2bf6c9381242db94fb77ab0e22b2b0a2ba0d1a30d9a7c865fd1c
SSDEEP 393216:XClYzmZHZRxtwnLsde/Vuyjw4O+qZG/+V:tORi57JaZGW
TLSH
T167473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\ffmpeg.dll
Size 2.9MB
SHA256 1b9d751721a40fc8fba2355172382d0e0c210e54c7f2862ebd8a6b6a093f832f
MD5 475107b162007199044cee83e815f771
SHA1 d3ef20d40f696710164994cfbb55edc4e0ccda07
SHA512 8d81ecd673d59a773d18369849a11878a41a5c92be6c4ee7dbf951070bb833e604a357d6a0e9a58d070df484069fb4c923a9e3c7b1802e0ea5d9062258f4fa46
SSDEEP 49152:odfREhAZtlrINr/T6XF2i81IQbx6i1N2A0hGR9/HvaLukwhBuO1i:o9ZtormXFgLaLukwh3
TLSH
T197E59E02F6D251EDD029C03497ABE213F271780A4F205AEF17A05A253F66FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\libEGL.dll
Size 467KB
SHA256 fa8cf715db0e2a7a0f20a2b583221e439c484390b400ec70ff5956ea70d55aae
MD5 dfafc7b1b6948618c9d49f471b389456
SHA1 e4588df2cec79e131cf96d1e2e437691b9bc13ba
SHA512 aa391adb7af700e4304fa1bcbd0ff62fb63d3cd2d9603739487a537b45c25e45b2f9e79dbe79fb3354e6c14561d9b46907d136fd35880968f7df69d979a52b59
SSDEEP 12288:NGxGyTj2M2uuMlptOdxncCjfsLFm5kQDhfl1:NGxGyTjT2tMluQLIk0hd
TLSH
T1F3A47D15B3E949A9E07BC138CA538643EB71B8560B21F6DF02A0D2793F77BE45A39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\libGLESv2.dll
Size 7.7MB
SHA256 b6548524109b605155fcccccac8836c3d29dde3f1f6337f67a2bfb7931b9e0a0
MD5 0cb591214b989bcafd178c5337095edd
SHA1 0cf018723bdcc568e3a666004e34f1e66c97d45f
SHA512 4dd7b6ba31511160d447138c628a713e529fe494fc58e1a28f69dc80c51a41a96774805858a1555026b7f90a545743a9617e9e4b0172d3faff03f9aee48b74d5
SSDEEP 49152:a4AMBWsanmFGBeBMb0y/tQOZcS4vl7s7EGt6j9pH2Isk2MKWcL0LM0k7bzsKVkqC:xMR/ldEzKNtLsKK4X6F0HO
TLSH
T1F9866C03F69681D9C05DE2788757A223FB34B8850724F6CF2B9457152F6ABE0AB3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\locales\en-GB.pak
Size 552KB
SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
MD5 121461689d08e6e0d1e0ad4e6c695f7e
SHA1 113ec35be3b54ebf9e2b064181475bb82dda2670
SHA512 69b0d1d401aafd2fac6ed86f3c51de4889ebda123c6cfbe6267e83cd9271dccf7db2627cfaf31bf5713efad48845662763106ef26da09803a1580fa04c7416c5
SSDEEP 6144:D1Zf+l9GJBIvNBlxIxhb5E43FzcieMaMP9zQ49lfaYHEJjXCYDcBcnR7K:D1ZfqsJavNBPIxhbQvMNQ49UhDc
TLSH
T13AC43D1FF784126A05A311A2BB0AA5A2FF23D07CB35112667CBD811C33B676583777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources.pak
Size 6.6MB
SHA256 b92a3508c9631066b013adb736684e63e7b9e82e5f4c8a005b243e8e6b2bb5d2
MD5 d36dc817d163729acb7886ef14673881
SHA1 cb7f36e1ba0f649bed5f4c34510eed1e0e2018bf
SHA512 2e81faf0b555818ed61a4906226fae8a2d79f51216c67fece11bd9a6eaa7a784f88b333b6df1813d62c023874b49a8e8a9c1288ffda489c943b7c87a5cebb6ab
SSDEEP 196608:plsBRHPfIXoDTz9uTjTMkriACmZnC3gEL34tVrW:8Tvr/ztkrDntEoVrW
TLSH
T16A6633D266E3A80BCE9063B98984CF39199CAF2572D4B093489D5119ED9CF5C0BC4B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAttachmentGuard.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAttachmentGuard.exe
Size 6KB
SHA256 5c305dbe31ffeeeea321bc3ae6870a70662227ca477324ffa349dcc9eb6712c8
MD5 a8b1d38e270c90ecf7b2e4151aff1626
SHA1 e0eb85040ecd449f22c52e0a34dab0e4d566a61b
SHA512 afdb6c6a2a0227d96d91c47a25ac1c9c0a052d4a3bfba8a0eb246bed33f63f464f45ee598bbd3199153467a476046db83d03d70750e86bff341bcf75504e0942
SSDEEP 96:UdyoeMd+7C14+rdQiPDYik+VcoVQ3Dlk6zQp:Udyoe8XrEgQO6
TLSH
T15CC11A49E7CC44A1E96B037C5AF293011BF4FA5CCA6787BF24E08279BD117440B82391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAuth.exe.1bd69db91d23405084d5fe8415cbdb55.tmp

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacAuth.exe.1bd69db91d23405084d5fe8415cbdb55.tmp
Size 19KB
SHA256 8ef75c1d35ed40fc1f8e13ccb48c41d3390e5d13cc2a44561887d7149d0d61f9
MD5 aa09e63f8b24a2901b95845445811523
SHA1 000e894ecf32e4852a137d5f225db521e2194a3a
SHA512 35ae84f772f36cc794fe90cead9727a1fc19f96ec40098a4ae5332d4cd3489471db5d8ded32ecbb7c93d5f85df028e6292c748acf4eddb64cb24e2f14f6d51b3
SSDEEP 384:hs092bZdfy6aspecyrUzfHjEWxX+69AYfx57cc1GnDrCs:hD2Vdf10cyrUz/jEWE6Jx4C
TLSH
T15A922904B7E8C712EAFF4679A87247400E72AA975D66CB4D0CC5A8BF0D73B508D94FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacDesktopLock.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopLock.exe
Size 5KB
SHA256 06c826472913e12aace76ee1229b1b1243854734dabc80a8ee1719dd6f88ba78
MD5 36c83fc472cb35e367d804153b1193ed
SHA1 625c1545259e35fdd62f9391b075ddbcefe633b9
SHA512 9856b7020b7ea2282a066564e1d76b609d030e1d120a7a8a9997462f24993fa8370d9a9d682e6b646e76072125bf63d21f6fdfcc9702e23fa1e6ecd8a3315ed8
SSDEEP 96:UrzZaM3C5ZCW/X67Omvr3uPsD3Dlk6zQp:UrzZaM3C50W/q7Omvr3ZDO6
TLSH
T1D0C1FB46B3D44522E57F477459F3430527F4FAAA4D6AC7AF9CC4851D6C1238C8B607E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacDesktopUpdate.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacDesktopUpdate.exe
Size 43KB
SHA256 901ece9b4d4c6bb1dfb1e116af8805c39de86a49787e44c22e0560729ee25e76
MD5 132133c7229ec44ff8c8c1019755e8b6
SHA1 4280906104db6430d0796fdedf4626f66929123d
SHA512 61df81026bf9b73a1d2d36fdeaed429529bd1b3c480d1b31b148e24f55e8f0564937e3899ea9a913f3952f4e5fdab1534aeb7718dd1cf66997c83673f2e76388
SSDEEP 768:7RcCU8p2qeJxCgbAQWF2EtB5MRd1AIpxy:7RTsqssQWF2EtPUA
TLSH
T164131B4937D84A74D6BE5B38A5722220DE72FC5AA536FB0D1F84547C0D3AB808D92F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacProjectRun.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\JacProjectRun.exe
Size 15KB
SHA256 b84796bb3d1b3417d3a28d1676e96c11ba3ffc6060ddffc6795c6e3b88bd17e9
MD5 a3b7aebfddbc9aa22d553210f8cde576
SHA1 885bb14d4d8a1857853d03be8057fc0acb02b519
SHA512 fa7396fa46f981c63d1a71b2b5664c2da27082cda38ea47f642202a0f6164c8b6d2417adf9a8003b474b2eb70e997b3e2bf55077f8f0915f82580392e2adf77e
SSDEEP 192:U62UM5nMaUElpOsT8Fz6TqnN06ufQtoojDV+Kk8KE/HggMi8rgbwh8I/26D+QO6:jM54Ex8FznGfMUZ4/HgG8GY8s+Q
TLSH
T14A622A8FCF1802B3EA8D42BC58770B0057B041ADAD93EB96ADE5E1B72D25BC50752387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\app.asar
Size 3.1MB
SHA256 e3229e3e8ce7f00d12b2f29514def40726b275888c08b491eef6b54b160e3ff6
MD5 4113b8ac2146b751fa28ded719bd1c04
SHA1 dd3c33cc77c38b840cea869cde3c9f2535b7df83
SHA512 8a22c038b44dfaca853211065a9689bd8e520e2adf7732a8b1246a2b3b3c53bd554d81670a3692ea993849f3da54936dbfbafb3b338bcf6685991dcf6ce405db
SSDEEP 49152:Nv0EtKhL9RcwUMjmasACRF8LHFKo8oiceJhJZ6aLNgZWsuigKXuMBlRwudx/fff+:LqkJoW
TLSH
T16AE52A5923F714219663B0B91F1B0102B636A417380DCD5DBE9CCBD06F4A86992F6FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-integrity.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\resources\client-integrity.json
Size 6KB
SHA256 7a8eb4e57b869a0e0ebb687cd757aaf41be7e95a0c46d22743f4ab759c60577c
MD5 b8053b8d276ecca91a119a5f89421e3c
SHA1 a0f00504a3af4b01b159fabaa3ececf7de3b58d5
SHA512 e016377500faec456f26db65366ea194e7e92f45760d83aa6f6778227698d1beb42c7882f1fbcb5e2d6bd2a0bd25547570ec175540b6e602ae2991640d876608
SSDEEP 96:AaJLoOO5xfVqmDB/S8urSpIUn+7QWpQjulK+Trwe9QfkranfF8ZWTe547MjPOyv1:A+fIx9lDB6RlpQRy/wkCF+Wz7orvZD
TLSH
T153E1C8E251A5F25D7C04733E57D9BE424B89D0850AD36F98A0D94AC4203BB87ADF24BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\snapshot_blob.bin
Size 338KB
SHA256 074571140666f561594889ccb6439bc30d21935f0c7157c0edd118223950bd7d
MD5 5986c77ce1030ed104ba7e3c914f8bcb
SHA1 f9b13bb6fabcae89187e13e2f8bf3be1ed282b4e
SHA512 cd0326d6d6f55e0aec95d93f8dd829269dc7803beb192cae744b7a3dd1b12316619996611c209d8dcc23a54f0a2912928724c6258e1ef7ab1e834fb7a563354c
SSDEEP 3072:r/OiXK+Ot+xbRt2FURJPGKKPipcCN7HON4Od1sTChznKBwdCqg1:r/5Xgt+HlqKKlu7uN4udhb3gT
TLSH
T1FD74E012F749CA26C8B639745EE58B942E24B2CD9DC9AF173060437DB4796640E2F38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\v8_context_snapshot.bin
Size 704KB
SHA256 b0874ba2f21ccf59f8a3086168ad782834aeeabb4acb644a20744a1cbeb5bf59
MD5 8499aa219e4679efd7df4b5e0d767fe1
SHA1 3ccbe3967272f758fbf7d217fd6e40894e670053
SHA512 c6ea72fc00de1aa7a29a83d2d503a061d49f3d629bf1421731d5a9cd2e3e7ee310f581e465a1f440c43cf2bd7a1cdad4ae9cb9f41f8ecb8e00bb095096193dd7
SSDEEP 6144:jBrQKX5Xst+HlXawuu7uN4udhbM2Ndgp2BsaXgHkmybvAdEpjyHZdhU4iPWlan:mW5XhubLjbM2NdOeH4dEUlURWYn
TLSH
T1EFE48666FB06CE26C8657A7D8DD74B063A30B2DD9EC6EB077021937CB8786544D2E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\version
Size 8B
SHA256 6fad46276bd050e3ddbd7d6a667f72755cccd29ce87b714c1d0e73f3fb6a0206
MD5 08a8ded3dee574d7fa288c14592cbd62
SHA1 598bf61cd0e401d81347c045ae6afea2b2fd8cd1
SHA512 4fcd355c63af0a5e76dd0b3bb283784d840105b6b9afb74d5ac1a040c8d7372bc3b8206e8e80da04a103d36ad89bc37dfdda25993b8e152d580cf1e210016941
MD5 SHA1 SHA512

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\vk_swiftshader.dll
Size 5.3MB
SHA256 4bd642ea08bd933014cd5c44911c4422bd6f69c8569f494de79054536a6469e0
MD5 d37818372f78d8474170cd97e89727e8
SHA1 259deaebb92eb3b7f8ce5bae70a8b26831459fbb
SHA512 9d2593c075ea2c44760656b131c571fa0ece1fcbbb9df86c8616493588e90bd4ef69dd48adbe7a214a89d0fa2d1884cbac134a8d2a2a6b3fdbd8f83b3c708175
SSDEEP 49152:xVfzRLVriek3jvuhmV9lbL0aLgztfbkiNSYoCESb+ngPskvIC6C2Qf+d+0C8m8KZ:xVfz2pFxbkkm5X
TLSH
T106464903F29681D9C06DE679875FA623F631F8800B2276DF56A00F192E69FE06B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.7\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Jac Code\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 0eaa11100ce75bd6f45c09f89c4f04792cd11d49bf9431a3d64e69c8e975aa07
MD5 83a1cdc277d743474a5b4f2e772b661f
SHA1 a83f3fb3597f6fc6647399dc5bec2c0753d1e301
SHA512 c6114aa61d981bcb872bba69e5cb5e9a238a713b43573006af743489d847f489d698b76717b7be87eb800ff9533347e360fc80f28c7876529b410dcf6bce58ee
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Jac Code\DawnWebGPUCache\index
Size 256KB
SHA256 45c4c608c0c2678855b0766e2d4536bdb96536606c62df7e7f23358f17d54ae9
MD5 9aed8ec29ab2d5eca57310fab5fd5943
SHA1 d5892618133ff7b2a02e2ac44b56e14703eba3c6
SHA512 1320d9693e7dd319ae4f5d1cdb5caac03802aa7eb05d072a189e8bcf0e3f835f56098850ccc6cfddbb18ede1b03c6ed217b4e3c92c4ae7568fb3a3566abf88b0
SSDEEP 3:LstlNllkll/lX/:LsX3lEtX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local State
Size 490B
SHA256 df9ade01f801377cb819cd8eb2b047439907e17d047459c3fd4eab0e2a5ca315
MD5 32837bfe52bb0dda0d80e1aa967e6aa2
SHA1 f6f430d4569c769ced9e86c77d5708163fea577a
SHA512 ec13307faacd17f7cffcbfa3b901a8ff92997db1f25993adae2b382766c3671ed5633ee68daff90d1cbeef6c30b76b6a1761febf3fecf497663e541fccaf0e9e
TLSH
T191F054B5AD10EB10F322CD1909FBBA520C3FBAA38912E3109CDF112282E39898143C30
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

7f5ec279-99f8-43f3-b103-2acd95dcd86a.tmp

Path C:\Users\Admin\AppData\Roaming\Jac Code\Network\7f5ec279-99f8-43f3-b103-2acd95dcd86a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Jac Code\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Jac Code\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a5723e7f-9b55-4ce1-99e4-4f2d9f2d15c6.tmp

Path C:\Users\Admin\AppData\Roaming\Jac Code\a5723e7f-9b55-4ce1-99e4-4f2d9f2d15c6.tmp
Size 490B
SHA256 08529ec89ae32fe6d182aca17c817064b00a000f3763d0fb0823b56590e6a92b
MD5 3e2ddf67b81ad17a3c283e0554f67a54
SHA1 f4fcfbf9492bbcd6dcd82b22956f328b160ad0de
SHA512 92cb653c9697b9945b41747175652259e06203d259c48bc48375f7261807ac2aa27b570c269024b706a042531b7221611df84cc93403c705da0272e34455c1eb
TLSH
T16AF09E7468A29BA37B554F608413F0070E34686B994AE340B69F120A51E2D89928FD75
MD5 SHA1 SHA512 TLSH

Submit Download

.integrity-v6.key

Path C:\Users\Admin\AppData\Roaming\Jac Code\backups-v6\.integrity-v6.key
Size 32B
SHA256 cb67ae53a4eac885fdf6ee348624971da284e6883f600f11ab28ccfee19f6b6e
MD5 e1cda315b595b8749a0ff353d548f7f0
SHA1 b66f7e12e38854e9cdd22e97e6ec5ff351a4642e
SHA512 7a5cd788a3b0edb2b32e98d05985bbcc6dd028c5536b5295028a03ec2c70c1eee07fc0888438d621e9bb1046433d3c629b01ab309d2bf4484c35b4303d0fbdcf
MD5 SHA1 SHA512

Submit Download

database.sqlite

Path C:\Users\Admin\AppData\Roaming\Jac Code\backups-v6\.pending-6a5c3d0e-fbf1-429a-8c71-468ca0ea23f2\database.sqlite
Size 192KB
SHA256 3af7c5c3c9c28ef118541dde7aaf70f58c0fbd3a9728dc1c8ee987b682e6d493
MD5 a2d003ed18790bbff1afaffe14335e9d
SHA1 f92d2d9e3b657153498aa7ba73e62e4f016d75d6
SHA512 b6fe4e3182ec9288642b62d9777cde0a7e6c4a929a3c68e6bb8b1c4fbbb8ade6a58f50c9b2c8a3318acef67fd84bffbd442eb343b42307101738b6377b48d54e
SSDEEP 96:2ndlIwGjS4r34+/nJq8sJSrs1m/ooriS7nIl8IKSqAqdlInGjS4r34+/0UybvHpx:2cJtvHhs8oo1tfnJtLi8TLU
TLSH
T12B14204D7D22EB26D1D7D43095F2A8626B79138B6F807C1233FCB960AFE9EC5513A409
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Jac Code\backups-v6\.pending-6a5c3d0e-fbf1-429a-8c71-468ca0ea23f2\manifest.json
Size 1KB
SHA256 cf960aeda4eb3ceed33e2d5937e6a079b9556fc6ed9927186ba9bd1d05759152
MD5 d6bd679fac88de5d8b2c61c1b4b3761c
SHA1 cb4e1cb0b24b9f88452207ac64930106e1b6fb24
SHA512 53ac889f4606e6f4ecf262c8a85c1447fda872f4ef70b7eb01d9f134663ef578625938eade5e9721c15efbc6a37e6d4035c0063356f9b1009eebda80d8926d36
TLSH
T12E316226E20C70B9874B24A9DF071AE3A27978183BA04D606CD9C0C6929001CD3F7BFA
MD5 SHA1 SHA512 TLSH

Submit Download

queue.json

Path C:\Users\Admin\AppData\Roaming\Jac Code\queue-v6\queue.json
Size 38B
SHA256 6b6401b3841d14091235e8e71a5f7e767b3198be6f3662576a618cd4d296f732
MD5 ef2682934d7f3705011fa867628f2bf5
SHA1 2ed7634c7711fb62c7404aabe9727a5f7a38d4fb
SHA512 789d7b39a52f16278e8b3ecbded4622f9f32ce46f3d7877925632d40f1865ef08920261a9cb6d532e96d48c95cfe1fa1d876fc6ed3773e0f0bb260b71fa98108
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Jac Code F9078B.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jac Code F9078B.lnk
Size 2KB
SHA256 84f40c2b7ce7ff7e1e399a515a3bfa5369300caa3d02e4a8bacf47cbffa1eb66
MD5 50d50c47b39e29cd948c3411dc6c66a7
SHA1 685b3ebc78ea8af54577a5aa56207df44355eb17
SHA512 4d5d1a472689e0c583e59c270f01db0d4792fb85039ece04a58e1b5dc0f98f6e71d1159f4b7f9d14c61115f89347566d4da9f4f9bbcc4563b201bbbf5a48cd00
TLSH
T15141F1195AE56F20D377457E18A626229F36F815BB420E0E1045839B1E26B419D5CF1F
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\~ac Code F9078B.tmp
Size 2KB
SHA256 bf67f5c67ff4080082840a7651a9f0f01b2afe38295b3bb13d3308c2e05c8021
MD5 05e97868f21670b2f74da38a5cbfe450
SHA1 e6592df0d4f62cfd432810a5fcfb94447b10fd91
SHA512 a9e9efedd194b6dfae3cc8ca90670b65638efb2190340a08140e8fa98983f58dd76a270348510de5ba7414f9dd98c04ecc1c00fcb9cbf4ffd08e72172a7c5cfe
TLSH
T1C651CF1497F87B20D37B4A7A19B666265F36F425BF460A0E1005838B1D26F809E6CF1B
MD5 SHA1 SHA512 TLSH

Submit Download

Jac Code F9078B.lnk

Path C:\Users\Admin\Desktop\Jac Code F9078B.lnk
Size 2KB
SHA256 ef5863160d3ed586707129e19a3e86fba83a5f5d48f48cd765499bd3cf496313
MD5 4f68d9b5f62a6c54dd7b933506297b1b
SHA1 76e40b4b83e64cd8f745abf0461fb6ec2d3ef60b
SHA512 ff774427a2e83fd22ef5936299146529a3ebebe60281b554ec4381a520e6ac1ec6b65b6bf050dde7650ba9b837086d6223f05a9f88c4284ea43da16c0f41a5af
TLSH
T1C641FE155AE55B30D277467E18A626229F36F8256B02090E204AC79B1E27B41AE5CB1E
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\Desktop\~ac Code F9078B.tmp
Size 2KB
SHA256 070ba8e0b2117e6c1c455886e11a988f6e11ab1c77c14c8a96d70622db67a2cf
MD5 1495fede734a89816268ad32f64e036e
SHA1 53b906ddb7baa168a88dba5fda7d7baa44e03fd0
SHA512 dabc4e826e31652e625449789b10ba8be40889147e53c31e5b6250c06aaced20bf9959821814f5b49d13489aeb83140c621cc22c5848b6594247277992f7d9be
TLSH
T10751D010ABF86B20D37B4A7E19B666265F35F4356F06090E1009C79B1E36F909E6CB1F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1628-328-0x0000000000F00000-0x0000000000F0A000-memory.dmp

Download

memory/2148-510-0x00000000028D0000-0x0000000002920000-memory.dmp

Download

memory/2148-506-0x00000000002A0000-0x00000000002AA000-memory.dmp

Download

memory/2560-468-0x00007FFFC41D0000-0x00007FFFC41D1000-memory.dmp

Download

memory/2560-469-0x00007FFFC3E80000-0x00007FFFC3E81000-memory.dmp

Download

memory/2560-572-0x0000020EB5BB0000-0x0000020EB5C5E000-memory.dmp

Download

memory/3480-561-0x000002130CFC0000-0x000002130E83F000-memory.dmp

Download

memory/3480-391-0x000002130CFC0000-0x000002130E83F000-memory.dmp

Download

memory/3480-579-0x000002130CFC0000-0x000002130E83F000-memory.dmp

Download

memory/4708-30-0x0000000029450000-0x0000000029460000-memory.dmp

Download

memory/4708-29-0x00000000004A0000-0x00000000014A0000-memory.dmp

Download

memory/4708-33-0x000000006BCF0000-0x000000006C218000-memory.dmp

Download

memory/4708-32-0x00000000293A0000-0x00000000293B2000-memory.dmp

Download

memory/4708-31-0x000000002A230000-0x000000002A3F2000-memory.dmp

Download

memory/4708-516-0x00000000001A0000-0x00000000001AE000-memory.dmp

Download

memory/4952-503-0x0000000000C40000-0x0000000000C46000-memory.dmp

Download

memory/4992-2-0x000000001DB10000-0x000000001DFBC000-memory.dmp

Download

memory/4992-1-0x000000001DB00000-0x000000001DB10000-memory.dmp

Download

memory/4992-0-0x00000000003B0000-0x000000000091C000-memory.dmp

Download

memory/4992-24-0x000000001DB00000-0x000000001DB10000-memory.dmp

Download

memory/4992-23-0x000000001DB00000-0x000000001DB10000-memory.dmp

Download

memory/4992-3-0x000000001D950000-0x000000001DA04000-memory.dmp

Download

memory/4992-4-0x000000001DB00000-0x000000001DB10000-memory.dmp

Download

memory/4992-5-0x000000001DB00000-0x000000001DB10000-memory.dmp

Download

memory/4992-20-0x00000000206F0000-0x0000000020712000-memory.dmp

Download

memory/4992-22-0x000000001DB00000-0x000000001DB10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads