460317923277cfa8af4973027afed29979dddb55336d08dfd656326810ce8439

Analysis

user interaction
yes
max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jac-Code-Setup.exe
Size 5.4MB
Sample261027-p7jmjsds2s
SHA256 460317923277cfa8af4973027afed29979dddb55336d08dfd656326810ce8439
MD5 46751cf1c7500c3826dcc7b278290cf8
SHA1 58dff9c9c3489457270bc443fe8868e94eec8240
SHA512 4e8735f0a45de087b7b0b32962f46fac62ac48b65c5ccf19277d357d1e81cfec5558e7e8dcd9099321b3ecd3a1c12e6ff0e54b192906e8570c0a397d24b43711
SSDEEP 98304:oagzHLAR2PDSo1BBAThFJjA2gD7uEoyeVCb4MABph:iNPDSEBAThFJjin0CFAPh
TLSH
T16F468C1933FC6E27D56FE776D1B095126BF5F86AB363EB0B2182D2A54C12B105C423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	4912	Jac-Code-Setup.exe

Executes dropped EXE 26 IoCs

pid	Process
5612	verified-installer.exe
4820	jac.exe
4964	jac.exe
4308	Jac Code.exe
5688	Jac Code.exe
4548	Jac Code.exe
5948	Jac Code.exe
5752	Jac Code.exe
1980	Jac Code.exe
5480	jac.exe
5744	Jac Code.exe
6000	Jac Code.exe
1468	Jac Code.exe
5896	jac.exe
4852	Jac Code.exe
5488	Jac Code.exe
1056	Jac Code.exe
5216	Jac Code.exe
932	jac-engine.exe
3844	JacDesktopLock.exe
1164	JacAuth.exe
4032	JacAuth.exe
4612	JacAuth.exe
4040	JacDesktopUpdate.exe
6068	JacAuth.exe
4052	JacAuth.exe

Loads dropped DLL 7 IoCs

pid	Process
5948	Jac Code.exe
5948	Jac Code.exe
5948	Jac Code.exe
5948	Jac Code.exe
5948	Jac Code.exe
5948	Jac Code.exe
5216	Jac Code.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\JacCode_F9078B62610FCF91A3F6 = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Jac Code\\jac.exe\" --startup"	verified-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac-Code-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac-Code-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	verified-installer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	Jac-Code-Setup.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe
Token: SeCreatePagefilePrivilege	5688	Jac Code.exe
Token: SeShutdownPrivilege	5688	Jac Code.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5688	Jac Code.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 5612	4912	Jac-Code-Setup.exe	90
PID 4912 wrote to memory of 4964	4912	Jac-Code-Setup.exe	94
PID 4820 wrote to memory of 4308	4820	jac.exe	95
PID 4964 wrote to memory of 5688	4964	jac.exe	96
PID 5688 wrote to memory of 4548	5688	Jac Code.exe	97
PID 5688 wrote to memory of 5948	5688	Jac Code.exe	98
PID 4308 wrote to memory of 1980	4308	Jac Code.exe	99
PID 4308 wrote to memory of 5752	4308	Jac Code.exe	100
PID 5480 wrote to memory of 5744	5480	jac.exe	102
PID 5744 wrote to memory of 1468	5744	Jac Code.exe	103
PID 5744 wrote to memory of 6000	5744	Jac Code.exe	104
PID 5896 wrote to memory of 4852	5896	jac.exe	106
PID 4852 wrote to memory of 5488	4852	Jac Code.exe	107
PID 4852 wrote to memory of 1056	4852	Jac Code.exe	108
PID 5688 wrote to memory of 5216	5688	Jac Code.exe	109
PID 5688 wrote to memory of 932	5688	Jac Code.exe	110
PID 932 wrote to memory of 3844	932	jac-engine.exe	112
PID 932 wrote to memory of 1164	932	jac-engine.exe	114
PID 932 wrote to memory of 4032	932	jac-engine.exe	116
PID 932 wrote to memory of 4612	932	jac-engine.exe	118
PID 5688 wrote to memory of 4040	5688	Jac Code.exe	120
PID 932 wrote to memory of 6068	932	jac-engine.exe	122
PID 932 wrote to memory of 4052	932	jac-engine.exe	124

C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\jac-bootstrap-7d28c7a8afec46df930f7892212c139d\verified-installer.exe
  "C:\Users\Admin\AppData\Local\Temp\jac-bootstrap-7d28c7a8afec46df930f7892212c139d\verified-installer.exe" /S /DIR="C:\Users\Admin\AppData\Local\Programs\Jac Code" /DESKTOP=1 /STARTUP=1
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  PID:5612
- C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" "--home"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1756,i,7945369763083826424,1270788565256250716,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1760,i,9415743920987843520,9397806879967800194,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1796 /prefetch:11
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:4548
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,7945369763083826424,1270788565256250716,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1760,i,9415743920987843520,9397806879967800194,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1752 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5948
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --app-user-model-id=JacCode.Desktop --app-path="C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1756,i,7945369763083826424,1270788565256250716,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1760,i,9415743920987843520,9397806879967800194,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5216
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\jac-engine.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\jac-engine.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopLock.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopLock.exe" transaction C:\Users\Admin\.local\share\jaccode
        5⤵
        Executes dropped EXE
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:1164
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe" mcp-config
        5⤵
        Executes dropped EXE
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:4052
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopUpdate.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopUpdate.exe" startup "C:\Users\Admin\AppData\Local\Programs\Jac Code" status
      4⤵
      Executes dropped EXE
      PID:4040

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --startup
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" "--startup"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1672,i,2507804547967581836,8437894936455573963,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1676,i,3026878158363997478,838906835735320657,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1668 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:1980
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1672,i,2507804547967581836,8437894936455573963,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1676,i,3026878158363997478,838906835735320657,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1704 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:5752

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" "--home"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1644,i,6669113147346805827,635633253590294903,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1648,i,10419125121541870841,10261904792678999285,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1640 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:1468
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1644,i,6669113147346805827,635633253590294903,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1648,i,10419125121541870841,10261904792678999285,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1676 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:6000

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" "--home"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1652,i,2585448194454785093,17009872837044842430,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1656,i,10352117691986867149,10614938968130632501,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1716 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:5488
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1652,i,2585448194454785093,17009872837044842430,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1656,i,10352117691986867149,10614938968130632501,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1648 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.jac-current.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-current.xml
Size 34B
SHA256 9f895c8533531d15db7d0decc14bb67a332b709f69bebf46c7901931a9983dfb
MD5 0d96bd4fa3589580a45ccf9a08354d37
SHA1 d114c3e70c12b31fe41574f50e8f0062d06c66c9
SHA512 dbb0dad40a0dbecb350641eb71bd694545b4fee12e6bc321ccc554148a4888b1e2c53ca50b53ebe51771ab1f8b379dbe3e9f055c52673d0b228973da32c31fb9
MD5 SHA1 SHA512

Submit Download

.jac-install.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-install.xml
Size 2KB
SHA256 9465eab7a1af2a031eedef2b49781bb2fa58b9bbf7992540ebed27746ed97165
MD5 fc1eaa99fc2d0c5371a8105cf48c899b
SHA1 4dd8e6824b5b191988f53548aa68ffa16a1765a9
SHA512 518c829bd71507f713fc384f41e52027da9f234951ff6d4b92e3234a78923c2cef6ebc2ab8c1832a4abeb55fd462529c56dba01b17df638f42dfce460d783738
TLSH
T1CA417DF608D4B32E9470AEF76B19B538B329D8103A5D2941BC89058B53B513973CB5EF
MD5 SHA1 SHA512 TLSH

Submit Download

.jac-transaction.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-transaction.json
Size 2KB
SHA256 529c8e51a8ce870a8136ec997201e1db1a29f5a0d599edd3976c57a355de1f64
MD5 818cb69c7439ef896483669cdf033f74
SHA1 0175f967dcdcd2944e5de8f40451d7cbeef83d0d
SHA512 3d8dadf06169fe12309e83a45e6caf1367c1945cd4909d3828b6ffc0db3d949b5647134b5fe27b224853d3fa2e43467774392b1b94535df7fd01925cf9b0c130
TLSH
T1D95124AD1525DD6E93C21AEC42038BDEE375EC36E8D9B08FE48B0B8273F706A5654453
MD5 SHA1 SHA512 TLSH

Submit Download

GETTING-STARTED.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\GETTING-STARTED.txt
Size 2KB
SHA256 82949ab8e04160277b51c241b7459cfaeaf3d26d41c82740167ed3ff1cd164f0
MD5 8dcc5a2069ffe7f8dd719fdc2311822d
SHA1 99b2a165ee0074aa8617569370643f403b3d3e8b
SHA512 1af854bc9ed39a279b6991db39c0d29708773f6ca5f63896015b02b849d6bf97bb4b5724f5a0e15c150cfc109a49a56de62a3a433c527d3e9a6d29e008be161b
TLSH
T1BB51C9777BCB368C36530395BE0183D1BF34A1683B990961F85E549C425A15897B3B36
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\Uninstall.exe
Size 49KB
SHA256 222d1070259bb6d4e771e853ca95038cf5347d40690cfda2514692618ad110fc
MD5 7907ea1a368097d2f795aadd15b09b05
SHA1 90385749c5334ac647126ef5ee485f2000cc041b
SHA512 7871c082300696eabaac27324b544c8489056695a04cbccb7e5f1669f18b7fae603b7544ade0ff8b6e152ce7f5a2458cf5a2248e971b2d9c6344dc654d02db01
SSDEEP 768:Xk+d0gKB7FKB1z+dlvqom14t+owm9jLrAkpxy:XkeUuwlvqomatPbXA
TLSH
T10C33D54977E84B24E6BF2B78A87152548E71FC57ED32EB5D1A8140AD0D3AF80CD60B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
Size 29KB
SHA256 158fca0ac4e4abccf79bb6c42f42fde25efedc33a8e10166883df854f0212b63
MD5 89e32b530eef987074ecf8fef21daf2f
SHA1 136757c300b0bdbd5e0087e2d4875ca92ec0a27a
SHA512 63c4233a133d9986b0de986184622c23c1e6790b1ade7a98b070092aa8dcf3553b4a403ffa9e4d82eb4a30153cd93c99d04e6e517f7c16da5cb370b5bd888503
SSDEEP 384:WnKEgDTKk+aCJJ0cxXDXn5DAhiC+4yT2V1StYg12+UAdYa5UlIIpjRx2K6xyWR:NTKk+N0cxzn5DAhiCOkStzvmjRx2pxy
TLSH
T1CAD20B486BE88B74D1FE0B78A93121559E71FC5AA832FB1D1F88507C4C3BB848D91B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.ico

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.ico
Size 3KB
SHA256 0aa6b0cd0fc67bbbd3575af1409cd4e824c52d6c2f36ea7af5640582035c1629
MD5 68e740ddb6f215c4dfbbb372c7944b4a
SHA1 0155f1f29940701bfdbffdbded519c70f339f2a3
SHA512 f770dd9b66f90d9818e3459eb64ccbdd814adc667cde9270fcfe49f3cc4776df75024a801c164dcd164d35e114cb0716133cebd99fedeee18f53f7580d1ec7cd
TLSH
T1BE8163CD1B8C4EF8C65944214B6B31B2FE75ACDE247D39167B74B4748E1E58025836C2
MD5 SHA1 SHA512 TLSH

Submit Download

DEPENDENCIES.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\DEPENDENCIES.json
Size 197KB
SHA256 31bc7b101cb4af57a0a6c94cc809dbf4cb9b40930a40c259100db3993e3567bd
MD5 a77b47e13b7e64238fd46db726f2894b
SHA1 94ca4efd9fe92fd5c947e3ba650870cc9219d701
SHA512 7d9b30c2eca62327d342e97b93d2a91fc017e736420207e0048110bee43daf3710eb845256afbedcce56f69c4ebe7e007cf61a3f6aa020910cd9a854b58ca31d
SSDEEP 1536:GYW8PltFxCbAQ6mpoNFyNIcfWgD3s/Tto1lx:GslrxCbL6mpEFyNtDr6o1v
TLSH
T10F14FF61C6706CB7288C8BB4092A564A762400471D6D7D0E33AE9A7C5FBDDBF28F171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\NOTICE.txt
Size 222B
SHA256 4b92f3c799b77b10104227f9e778063558cafcafd883d57de058b1a00d95b0d5
MD5 4919bea71ad9b72c7d6c6d7c6fc6d821
SHA1 449a00908cdfc9c17acf0a7fa4c5101fbd1ccf8e
SHA512 a786e10b92f8d9ad67aa5e4587242aae3665469ac7a4f88f8941febe3f50af4623db1762e8bff2b7f8424fc912928ba8e54c90713c6f6c6107395df1eb2bc06e
TLSH
T12CD0231E618A17D586310386F55BB3DFDB158D0803E04297A0B5410E01DB1B89367FBE
MD5 SHA1 SHA512 TLSH

Submit Download

OpenCode-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\OpenCode-LICENSE.txt
Size 1KB
SHA256 b5c625d157735f04e1b2b7ceccee849130b554bdb23cd58db55a38a257efbbdd
MD5 943d7c4c5077c4cbf3fe540cbbde6ce1
SHA1 a6b66f875a6b320a472c667c0675ca0ceab1b89c
SHA512 8de19a86a32572202c2d102f82626999e9f42cbd8654a9f73092d9e09db8a1f18a1e7d74c77532a7eb9d1770854f152204e15a0c6bd0bca97d877065bc52c013
TLSH
T14911B52F72960373189657A055B9ECC5F22BB14A7FAF1A84346EF2091326058C9FFC68
MD5 SHA1 SHA512 TLSH

Submit Download

THIRD-PARTY-NOTICES.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\THIRD-PARTY-NOTICES.txt
Size 5.3MB
SHA256 e9eee1733aadc53787e0f4c8e4c3a40b80b09b8513251a15b7b8d93e8151ce24
MD5 57c065c3fa0c3160e9db4866ef46465c
SHA1 665f042c52129cb5cc09291fc56da4e0b40ebaca
SHA512 4afdb92e7083b0bfb5f44ac77453f01ae378eb925f69ba40e6e0aea1905c5102dcf74b735c4d01518ded48fc50ac901fb51e03ca4b3356c5a0581edcd5d7e06a
SSDEEP 24576:6Orh0I+sE1KBf9beApGk/CzvTCKo9CzWhCt0Lo1YzgBTEDBxPLlj6ulj6J:6OrhAP9
TLSH
T17246C72F7B48037319D343616A6668CAF21EB03F3B5B2644345DE258273B76982FF598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FFLATE-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\FFLATE-LICENSE.txt
Size 1KB
SHA256 0a1df3a083d0c010560aa342e87959c8c1070e6fd54545741f083f22d0c8b551
MD5 b44ae31f7482d1a8d2f9bce6cc409db5
SHA1 e8f37052323f71060dab76883ed691cf95c0cd69
SHA512 5d5eb9ccf01a5be79b40f0cd157cbc6e2c20d88c3d499422026fbff7aeda999fee25fd52fa6bc5b202e2aaa7de3602be005c65235cb1f2e59f2737854ca17da8
TLSH
T1CB11791E72510772189B176055746CD5F13BB25F7E5F2A84246DF345233A06CC9FF840
MD5 SHA1 SHA512 TLSH

Submit Download

PDFJS-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\PDFJS-LICENSE.txt
Size 9KB
SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
MD5 2ee41112a44fe7014dce33e26468ba93
SHA1 598f87f072f66e2269dd6919292b2934dbb20492
SHA512 27b8c0252eae50ca3ce02ab7c5670664c0c824e03eb3da1089f3f0a00d23e648a956bcb9f53645c6d79674a87c4cc86d1085dc335911be0210d691336b121857
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
TLSH
T18822512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\LICENSE
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\LICENSES.chromium.html
Size 19.4MB
SHA256 5d545ce8065079f38a82472ab93bd62fcdf73cd319f0771ef51c45c7e243f1d4
MD5 a1ee17d90caa1bf1f3726ec03842f18b
SHA1 27a94b164c4255ce0dcab5c020f335a9cd3f8c60
SHA512 d9f7448213a449535f1ff43090c08f0e2388af4e72ce2f59e0b1b457a831f76c0d7d69d88cd435b1682479d31d480b19a5488dc3ef6c133c974557d5bdbcf446
SSDEEP 49152:52SFkMZThUZLQTYp281vCmR3r8xsJQfiFTuoYQdVi2Hxj37D4h:f
TLSH
T11827B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\dxcompiler.dll
Size 24.5MB
SHA256 b25b6c8bc64c9ff17ed16e0d272bf0bd7b305f3e19f792a72c8145a6bf624584
MD5 d1b78f795d632caf74e3f6e6aa09f770
SHA1 4f91847c6924c50868fa961973526327c13945c9
SHA512 95edb7b4c761a0feb19e6b348f706e38bd2a9a8dd674474271f6cc23de8b92b99ccbe80bc48e2bf6c9381242db94fb77ab0e22b2b0a2ba0d1a30d9a7c865fd1c
SSDEEP 393216:XClYzmZHZRxtwnLsde/Vuyjw4O+qZG/+V:tORi57JaZGW
TLSH
T167473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\ffmpeg.dll
Size 2.9MB
SHA256 1b9d751721a40fc8fba2355172382d0e0c210e54c7f2862ebd8a6b6a093f832f
MD5 475107b162007199044cee83e815f771
SHA1 d3ef20d40f696710164994cfbb55edc4e0ccda07
SHA512 8d81ecd673d59a773d18369849a11878a41a5c92be6c4ee7dbf951070bb833e604a357d6a0e9a58d070df484069fb4c923a9e3c7b1802e0ea5d9062258f4fa46
SSDEEP 49152:odfREhAZtlrINr/T6XF2i81IQbx6i1N2A0hGR9/HvaLukwhBuO1i:o9ZtormXFgLaLukwh3
TLSH
T197E59E02F6D251EDD029C03497ABE213F271780A4F205AEF17A05A253F66FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\libegl.dll
Size 467KB
SHA256 fa8cf715db0e2a7a0f20a2b583221e439c484390b400ec70ff5956ea70d55aae
MD5 dfafc7b1b6948618c9d49f471b389456
SHA1 e4588df2cec79e131cf96d1e2e437691b9bc13ba
SHA512 aa391adb7af700e4304fa1bcbd0ff62fb63d3cd2d9603739487a537b45c25e45b2f9e79dbe79fb3354e6c14561d9b46907d136fd35880968f7df69d979a52b59
SSDEEP 12288:NGxGyTj2M2uuMlptOdxncCjfsLFm5kQDhfl1:NGxGyTjT2tMluQLIk0hd
TLSH
T1F3A47D15B3E949A9E07BC138CA538643EB71B8560B21F6DF02A0D2793F77BE45A39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\libglesv2.dll
Size 7.7MB
SHA256 b6548524109b605155fcccccac8836c3d29dde3f1f6337f67a2bfb7931b9e0a0
MD5 0cb591214b989bcafd178c5337095edd
SHA1 0cf018723bdcc568e3a666004e34f1e66c97d45f
SHA512 4dd7b6ba31511160d447138c628a713e529fe494fc58e1a28f69dc80c51a41a96774805858a1555026b7f90a545743a9617e9e4b0172d3faff03f9aee48b74d5
SSDEEP 49152:a4AMBWsanmFGBeBMb0y/tQOZcS4vl7s7EGt6j9pH2Isk2MKWcL0LM0k7bzsKVkqC:xMR/ldEzKNtLsKK4X6F0HO
TLSH
T1F9866C03F69681D9C05DE2788757A223FB34B8850724F6CF2B9457152F6ABE0AB3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\locales\en-GB.pak
Size 552KB
SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
MD5 121461689d08e6e0d1e0ad4e6c695f7e
SHA1 113ec35be3b54ebf9e2b064181475bb82dda2670
SHA512 69b0d1d401aafd2fac6ed86f3c51de4889ebda123c6cfbe6267e83cd9271dccf7db2627cfaf31bf5713efad48845662763106ef26da09803a1580fa04c7416c5
SSDEEP 6144:D1Zf+l9GJBIvNBlxIxhb5E43FzcieMaMP9zQ49lfaYHEJjXCYDcBcnR7K:D1ZfqsJavNBPIxhbQvMNQ49UhDc
TLSH
T13AC43D1FF784126A05A311A2BB0AA5A2FF23D07CB35112667CBD811C33B676583777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources.pak
Size 6.6MB
SHA256 b92a3508c9631066b013adb736684e63e7b9e82e5f4c8a005b243e8e6b2bb5d2
MD5 d36dc817d163729acb7886ef14673881
SHA1 cb7f36e1ba0f649bed5f4c34510eed1e0e2018bf
SHA512 2e81faf0b555818ed61a4906226fae8a2d79f51216c67fece11bd9a6eaa7a784f88b333b6df1813d62c023874b49a8e8a9c1288ffda489c943b7c87a5cebb6ab
SSDEEP 196608:plsBRHPfIXoDTz9uTjTMkriACmZnC3gEL34tVrW:8Tvr/ztkrDntEoVrW
TLSH
T16A6633D266E3A80BCE9063B98984CF39199CAF2572D4B093489D5119ED9CF5C0BC4B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAttachmentGuard.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAttachmentGuard.exe
Size 6KB
SHA256 a17b3cae4866fe8710011e58fff941c10be32bf606c30d6a9c5236e35a6e6127
MD5 451d7f091fa0d7ef91fb7717e1d885d7
SHA1 b8d3c8d6356763d1ce2a86945468d1e6e6ae1810
SHA512 4b39d4e88ded245b3f2730d0162a486d6b51a6b36111fbff55916c82ad0d49503e48d94e4db0eef94071630a7c9bf18561d6783c13b9e23baf1fc03023e4d7ce
SSDEEP 96:ByoeMd+7C14+rdQiPDYikPVcoVQ3Dlk6zQp:Byoe8XrEHQO6
TLSH
T111C10A49E7CC45A1E96B037C5AF293011BF4FA5CCEAB87BF24E18279BD117444B92391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAuth.exe.56cd55b5c3f34bd09c2624e91b6c7478.tmp

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe.56cd55b5c3f34bd09c2624e91b6c7478.tmp
Size 19KB
SHA256 cd672da3646a563b4ebb8cc522473557d728fd7237f5355842572ba6456adf74
MD5 fd0bb6b85ec2683a2c55dd1bbf91dfa9
SHA1 e66027300f15c7a613ab26782c28067718ffa2cd
SHA512 88ab84fefacdd673559083a41ea6fa214bc48918d13a86750b0cf1cf172dd4dcf0fe75035d934b63391c0aaded32c1c71548228477e974627b74461056bd3cc4
SSDEEP 384:as092bZdfy6aspecyrUzfHjEWxX+69AYfx57cc1GyrCs:aD2Vdf10cyrUz/jEWE6JxdC
TLSH
T1BF922804B7E8C712EAFF4679A87207400E72AA975D62CB4D0CC5A8BF0D73B508D94FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacDesktopLock.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopLock.exe
Size 5KB
SHA256 d0f940d5f1d95a78489423ff2128f5f9dbf510fb06c2c38523cd50e5633944c4
MD5 f850191983962f15ee0d5b7b9bd9e0b9
SHA1 38fae484f32d7e05be1fe0955047729750973cb3
SHA512 42bffda55257b0a17f4ddf680932f976251e0ac9fd31fb059d922d241408c2bbab637002d27f3d3199721c95fa29b88a39da993378e47f2b054dad2f019fc686
SSDEEP 96:HzZaM3C5ZCW/X67OmTr3uPsD3Dlk6zQp:HzZaM3C50W/q7OmTr3ZDO6
TLSH
T1E7C1EA42B3D44512E57F477869F3430527F4FAA94D2AC3AF9CC4851D6C1138C9B607E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacDesktopUpdate.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopUpdate.exe
Size 43KB
SHA256 3d4762cf77473b87c07d169044b5802b7ebb32b47116638a46e9198b0c29a0be
MD5 61c91883eb421ee3a6bb9d07be4e6297
SHA1 0c7439a56a513f0489a22c0b0a0d0b1a07de9fbb
SHA512 9bdb32adbb48d1f433f42d5ec66e2276dc140bc6b298d9cd6a4b5dd6182b699aed6a2c74858419ca0a266f8a8e24d20166a8d08266dcd16124bedf408ba50149
SSDEEP 768:gRcCU8p2qeJxCgbAQWF2Eti5IBad1AIpxy:gRTsqssQWF2EteIIA
TLSH
T1AB130B4937D84A74D6BE5B38A5722220DE72FC5AA536FB0D1F84547C0D3AB808D92F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacProjectRun.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacProjectRun.exe
Size 15KB
SHA256 c9a15bd168482f8a1b0ef765837b2ae8b37b270c7c9b82ac053bc4b863ad9b3d
MD5 a906c924684ca1d47508cba6f6b8d007
SHA1 f2157e12c04e3d9693f8a7cc6c91942ac8908add
SHA512 fe425b8b513c178519f35eec1bf022926a1c5e3e2087231e0186ab37cd416abee5e81c2777f49caa495e70ddad8d4cbdf0c6ffd5d8ac00856a87ecd44a36c1d7
SSDEEP 192:m2UM5nMaUElpOsT8Fz6TqnN06ufQtoojDV+Kk8KE/HggMi8rgbwh8I126D+QO6:IM54Ex8FznGfMUZ4/HgG8GY8a+Q
TLSH
T139623A8FCF1802B3EA8D42BC58770B0057B0419DAD93EB96AEE5E1B72D25BC54752387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\app.asar
Size 3.1MB
SHA256 118cc0680cfedec54264e713f7c565c206b3421929945e61503f6a9294624e10
MD5 086a84dec05acebdf760bbbf027a19b9
SHA1 9bc8cf1c6871413652a79907ce0c6039bdb5dc21
SHA512 e5b6894e5534287c2ce39b00653ba84a0f78b880f42f756935f65c61c4063ce3ee4e89906dbd07f9a12017a6a1442145178952dda6dde00654e3af522a5ac067
SSDEEP 49152:lv0EtKhL9RcwUMjmasACRF8LHFKo8oiceJhJZ6aLNgZWsuigKXuMBlRwudx/fffI:zqkJoQ
TLSH
T1ABE52A5923F714219653B0B91F1B0102B636A417380DCD5DBEACCBD06F4A86992F6FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-integrity.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\client-integrity.json
Size 6KB
SHA256 9550eb68ec3e16ffa115b82a7ada13baeb899068c46b89795694257f1ab8b7d3
MD5 652737232d3fc88ecbb237977440c7fe
SHA1 ca291cb1c0c6a2a72869a953d2175ddfaf454030
SHA512 2b29abd8070c254854990a60cfffb8af6ff558dbdbd98605166ceeb9005ad87bced1fae8a6484d2c41a28bae567289d4a33a2439738a31be8c1a1729c3e631bc
SSDEEP 96:AatSGf5xfVqmDB/S8ur3pJnlSQWpQcUilr+Wrge8vfxuna+b557zjPOyvUJ4B:AgVhx9lDB6R4QRov+xfG73rvUM
TLSH
T18DE1DAE255B6F25D7C04733D47D9BD460B85D0850A926F98E0DB46C82027AC7B9B60BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\v8_context_snapshot.bin
Size 704KB
SHA256 b0874ba2f21ccf59f8a3086168ad782834aeeabb4acb644a20744a1cbeb5bf59
MD5 8499aa219e4679efd7df4b5e0d767fe1
SHA1 3ccbe3967272f758fbf7d217fd6e40894e670053
SHA512 c6ea72fc00de1aa7a29a83d2d503a061d49f3d629bf1421731d5a9cd2e3e7ee310f581e465a1f440c43cf2bd7a1cdad4ae9cb9f41f8ecb8e00bb095096193dd7
SSDEEP 6144:jBrQKX5Xst+HlXawuu7uN4udhbM2Ndgp2BsaXgHkmybvAdEpjyHZdhU4iPWlan:mW5XhubLjbM2NdOeH4dEUlURWYn
TLSH
T1EFE48666FB06CE26C8657A7D8DD74B063A30B2DD9EC6EB077021937CB8786544D2E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\vk_swiftshader.dll
Size 5.3MB
SHA256 4bd642ea08bd933014cd5c44911c4422bd6f69c8569f494de79054536a6469e0
MD5 d37818372f78d8474170cd97e89727e8
SHA1 259deaebb92eb3b7f8ce5bae70a8b26831459fbb
SHA512 9d2593c075ea2c44760656b131c571fa0ece1fcbbb9df86c8616493588e90bd4ef69dd48adbe7a214a89d0fa2d1884cbac134a8d2a2a6b3fdbd8f83b3c708175
SSDEEP 49152:xVfzRLVriek3jvuhmV9lbL0aLgztfbkiNSYoCESb+ngPskvIC6C2Qf+d+0C8m8KZ:xVfz2pFxbkkm5X
TLSH
T106464903F29681D9C06DE679875FA623F631F8800B2276DF56A00F192E69FE06B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01499718-1429-41ec-839e-59ed2339ac1e.tmp

Path C:\Users\Admin\AppData\Roaming\Jac Code\01499718-1429-41ec-839e-59ed2339ac1e.tmp
Size 490B
SHA256 7a5da575339aeb4b3a499d3cfe6e3f9dfd287d6fa37e9f774a25975b300b0bdb
MD5 d3a67e05b32aaf004e9a89d0ae9fe65a
SHA1 d335b29e6c22767c07cd09f096af7e4771cbee22
SHA512 52144f823050cf4a4cc0065d67442d36f52eafb3aa17a41a04b69f704e310879c4ae5e74d1ae7b027b2defcdd99a31edf5fb9143418fa1f1542a6c56385ec309
TLSH
T189F00EF1AF642F6AE5204514421379431D383AF30C456710304C420521A76AA924FE7C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local State
Size 490B
SHA256 41640326ae7b9b321f597bd14aca27be71df0f17c2916b21f0714871f7f2e673
MD5 d03931de61e9f2849e960ff594313b81
SHA1 7a8c1731b8a013dfe2c96e4be765d66c840f993c
SHA512 0faa1beb59d0521ed7ce2e9566a56bdaaeca5799c700b74ab1db6ebcc69e076bea137557b06f03f31c1c4b3a80e4fc58a2ce011ab1be7f17e6b352a69d13cb19
TLSH
T15FF054F22EF11A789C604B64020734032E6142A786465B082E6C475003F74CDA307C32
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

queue.json

Path C:\Users\Admin\AppData\Roaming\Jac Code\queue-v6\queue.json
Size 38B
SHA256 6b6401b3841d14091235e8e71a5f7e767b3198be6f3662576a618cd4d296f732
MD5 ef2682934d7f3705011fa867628f2bf5
SHA1 2ed7634c7711fb62c7404aabe9727a5f7a38d4fb
SHA512 789d7b39a52f16278e8b3ecbded4622f9f32ce46f3d7877925632d40f1865ef08920261a9cb6d532e96d48c95cfe1fa1d876fc6ed3773e0f0bb260b71fa98108
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Jac Code F9078B.lnk~RFe59b627.TMP

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jac Code F9078B.lnk~RFe59b627.TMP
Size 2KB
SHA256 b2c6372185f1e8c63999e54c5c62caf126b4ef7a60d964e7d1d85a55d2d3b33d
MD5 02efbf67871312b3b9988dc287f63dac
SHA1 87aea685ba6502ab4753eff6b0cf137f967be494
SHA512 b6bd7161bdcad6ef1ffbd7c8c977130349dd6d8a471b951d28f291b714cee87d8eb701e9a51c310a8df6a8806ecdd89028d9d2097a95e58ff29bf90dabe45cb3
TLSH
T1E4418C0686D52714D3B746BE59BA63358A71F821DB5A1F090044928A1E7AF42ED14F4F
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\~ac Code F9078B.tmp
Size 2KB
SHA256 6b484fccb21837c2f33607054dfadd6e5b1d37f0997050f6735b06729f1dc24b
MD5 b15f08d7331cd9b0e6ebcee33ec3eb00
SHA1 9a8094c5637e8c4abe2cdb12b6ae8c1c72a2b9e0
SHA512 1c9373ee812715ab4d25898d1eba542aec1f5f451f888a685d5d03856fae0bfa86f58fab736a2b0e30b0ea162ab639504cbbff8f69519d24e95c894eb12e65c4
TLSH
T108518F0596E83714E3B70ABE59B6A2358E75F8319F5A0B0D0044838F1E7AF819E14F4F
MD5 SHA1 SHA512 TLSH

Submit Download

Jac Code F9078B.lnk

Path C:\Users\Admin\Desktop\Jac Code F9078B.lnk
Size 2KB
SHA256 bbcae9c51a8c5ec84fc105672976ec6a7a61cbe8372ae460c34d927f9d111055
MD5 c39cf496f638d54c1aa1ea8c2dcdea9e
SHA1 d6583ecd967c9fe4ffdc634a44ad0e2be94e4622
SHA512 6c81e0464ea5a3d7b1b4b0b7390cd9a8bac475c553fc37295ed620058652f0584ad9982be75284fc680d56c9958f28584427a3a6ebcca18f44ee6ce0a46c7b76
TLSH
T107418C029AD52714D3B746BE59BA62398E74F8229B4A1E090040924E1E76E42AD14B4F
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\Desktop\~ac Code F9078B.tmp
Size 2KB
SHA256 2eb0fd42742d2d279fe657b87d477e3914a0181798d0fedaac770df48ce5dcd3
MD5 b66362d566cff982d7ac1b3b118f8183
SHA1 bedc37fd183acc7dc59cd1a412c20809594d74d0
SHA512 45e2745883a7f801fdf9a44e899c997c0dfa01bb77f1b0db2068278ba0ab88056fef72d432e6d00adef4e299d1fbd524b4d3b07cf877dc13d830eeeb0d86d4a5
TLSH
T1B2517E0197E83715E3BB4ABE59B6A2398E75F4365F0A1A0E0045838F1E76F819E14B4F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1164-513-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Download

memory/1164-519-0x000000001C7C0000-0x000000001C810000-memory.dmp

Download

memory/3844-510-0x00000000006D0000-0x00000000006D6000-memory.dmp

Download

memory/4040-520-0x0000000000AC0000-0x0000000000ACE000-memory.dmp

Download

memory/4820-341-0x0000000000780000-0x000000000078A000-memory.dmp

Download

memory/4912-2-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-11-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-346-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-31-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-30-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-29-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-28-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-27-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-25-0x0000000023960000-0x0000000023982000-memory.dmp

Download

memory/4912-12-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-0-0x00007FFE508EF000-0x00007FFE508F0000-memory.dmp

Download

memory/4912-1-0x0000000000500000-0x0000000000A6C000-memory.dmp

Download

memory/4912-10-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-9-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-3-0x000000001C730000-0x000000001CBDC000-memory.dmp

Download

memory/4912-4-0x000000001C5C0000-0x000000001C674000-memory.dmp

Download

memory/4912-8-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-7-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-6-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/4912-5-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5216-470-0x00007FFE71B40000-0x00007FFE71B41000-memory.dmp

Download

memory/5216-469-0x00007FFE71F40000-0x00007FFE71F41000-memory.dmp

Download

memory/5612-38-0x0000000000920000-0x0000000001920000-memory.dmp

Download

memory/5612-41-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-42-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-43-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-40-0x000000000F250000-0x000000000F262000-memory.dmp

Download

memory/5612-39-0x00000000291F0000-0x00000000293B2000-memory.dmp

Download

memory/5612-44-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-45-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-46-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-37-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-36-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-47-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-48-0x000000006ACB0000-0x000000006B1D8000-memory.dmp

Download

memory/5612-338-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

memory/5612-337-0x00007FFE50760000-0x00007FFE51104000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads