460317923277cfa8af4973027afed29979dddb55336d08dfd656326810ce8439

Analysis

user interaction
yes
max time kernel
95s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jac-Code-Setup.exe
Size 5.4MB
Sample261027-xt1b5sec93
SHA256 460317923277cfa8af4973027afed29979dddb55336d08dfd656326810ce8439
MD5 46751cf1c7500c3826dcc7b278290cf8
SHA1 58dff9c9c3489457270bc443fe8868e94eec8240
SHA512 4e8735f0a45de087b7b0b32962f46fac62ac48b65c5ccf19277d357d1e81cfec5558e7e8dcd9099321b3ecd3a1c12e6ff0e54b192906e8570c0a397d24b43711
SSDEEP 98304:oagzHLAR2PDSo1BBAThFJjA2gD7uEoyeVCb4MABph:iNPDSEBAThFJjin0CFAPh
TLSH
T16F468C1933FC6E27D56FE776D1B095126BF5F86AB363EB0B2182D2A54C12B105C423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	4264	Jac-Code-Setup.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Jac Code.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	jac-engine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Jac Code.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Jac Code.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Jac Code.exe

Executes dropped EXE 21 IoCs

pid	Process
4124	verified-installer.exe
3668	jac.exe
2164	Jac Code.exe
1596	Jac Code.exe
1176	Jac Code.exe
4336	jac.exe
3156	Jac Code.exe
3312	Jac Code.exe
4036	Jac Code.exe
4544	jac.exe
3056	Jac Code.exe
116	Jac Code.exe
3712	Jac Code.exe
4516	Jac Code.exe
4812	jac-engine.exe
1708	JacDesktopLock.exe
2288	JacAuth.exe
3316	JacAuth.exe
3176	JacDesktopUpdate.exe
5056	JacAuth.exe
5028	JacAuth.exe

Loads dropped DLL 13 IoCs

pid	Process
1176	Jac Code.exe
1176	Jac Code.exe
1176	Jac Code.exe
1176	Jac Code.exe
1176	Jac Code.exe
1176	Jac Code.exe
3312	Jac Code.exe
3312	Jac Code.exe
3312	Jac Code.exe
3312	Jac Code.exe
3312	Jac Code.exe
3312	Jac Code.exe
4516	Jac Code.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac-Code-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac-Code-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	Jac-Code-Setup.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	3156	Jac Code.exe
Token: SeCreatePagefilePrivilege	3156	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe
Token: SeCreatePagefilePrivilege	2164	Jac Code.exe
Token: SeShutdownPrivilege	2164	Jac Code.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	Jac Code.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4124	4264	Jac-Code-Setup.exe	94
PID 4264 wrote to memory of 3668	4264	Jac-Code-Setup.exe	95
PID 3668 wrote to memory of 2164	3668	jac.exe	96
PID 2164 wrote to memory of 1596	2164	Jac Code.exe	98
PID 2164 wrote to memory of 1176	2164	Jac Code.exe	99
PID 4336 wrote to memory of 3156	4336	jac.exe	102
PID 3156 wrote to memory of 3312	3156	Jac Code.exe	103
PID 3156 wrote to memory of 4036	3156	Jac Code.exe	104
PID 4544 wrote to memory of 3056	4544	jac.exe	107
PID 3056 wrote to memory of 116	3056	Jac Code.exe	108
PID 3056 wrote to memory of 3712	3056	Jac Code.exe	109
PID 2164 wrote to memory of 4516	2164	Jac Code.exe	110
PID 2164 wrote to memory of 4812	2164	Jac Code.exe	111
PID 4812 wrote to memory of 1708	4812	jac-engine.exe	113
PID 4812 wrote to memory of 2288	4812	jac-engine.exe	115
PID 4812 wrote to memory of 3316	4812	jac-engine.exe	117
PID 2164 wrote to memory of 3176	2164	Jac Code.exe	119
PID 4812 wrote to memory of 5056	4812	jac-engine.exe	120
PID 4812 wrote to memory of 5028	4812	jac-engine.exe	123

C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\jac-bootstrap-59fa62e73fda4ef3a398ad3e653703b7\verified-installer.exe
  "C:\Users\Admin\AppData\Local\Temp\jac-bootstrap-59fa62e73fda4ef3a398ad3e653703b7\verified-installer.exe" /S /DIR="C:\Users\Admin\AppData\Local\Programs\Jac Code" /DESKTOP=1 /STARTUP=0
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" "--home"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1680,i,8534497978863671695,6867492546033486124,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1684,i,18147257250346345300,8057105744966629619,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1772 /prefetch:3
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:1596
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1680,i,8534497978863671695,6867492546033486124,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1684,i,18147257250346345300,8057105744966629619,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1676 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1176
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --app-user-model-id=JacCode.Desktop --app-path="C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1680,i,8534497978863671695,6867492546033486124,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1684,i,18147257250346345300,8057105744966629619,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3132 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4516
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\jac-engine.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\jac-engine.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:4812
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopLock.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopLock.exe" transaction C:\Users\Admin\.local\share\jaccode
        5⤵
        Executes dropped EXE
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe" mcp-config
        5⤵
        Executes dropped EXE
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopUpdate.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopUpdate.exe" startup "C:\Users\Admin\AppData\Local\Programs\Jac Code" status
      4⤵
      Executes dropped EXE
      PID:3176

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" "--home"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1704,i,13990321612511770528,10881445784650699147,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1708,i,17765532061260084023,7024019989235053540,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1700 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3312
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1704,i,13990321612511770528,10881445784650699147,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1708,i,17765532061260084023,7024019989235053540,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1756 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:4036

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" "--home"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1696,i,14826568785671244975,12848241447638562679,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,1767133630351594912,18404835557770666168,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1748 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:116
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\Jac Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,14826568785671244975,12848241447638562679,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,1767133630351594912,18404835557770666168,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1692 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

opencode.db

Path C:\Users\Admin\.local\share\jaccode\opencode.db
Size 4KB
SHA256 97e8d54f8a7255106f66cf1b213c4a4d7b558d21310b1c2bfedc3d0d526dddda
MD5 7521076b0e620fab0a1c8064e30a53bc
SHA1 c3ed68e93b0aa7d81e3118e0724fcbbc0203df42
SHA512 3f57dfd9d6d8e9b8a1d06db976a0ce10b8cd94b6cfce7656e92343e4b9514ee145673f8dc531060e2cc24f08bcd2c62c05b4e803b4a810d91d78d5d82304a8df
TLSH
T16A810440D34000F1D45507F354D1131C0F07F3D4D5410F0315010443CC415444C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

opencode.db-wal

Path C:\Users\Admin\.local\share\jaccode\opencode.db-wal
Size 253KB
SHA256 f6fd6354db2490b35d36dec860d50804858888839a65c315b20fae2289e6c9d4
MD5 feb3b9664ca3d14d405601adb3d184a5
SHA1 fe71b65875323fefa2a9b189869249ce62e7871b
SHA512 d62e67bfb650e7edd34f64d04896b2f46c2cd1d5a537c9eeab3ef62de0b7e03b1a75f5ef2ce5b31b78bae825d4021d16bc231a64192936c240aa6ba9ea8ab89c
SSDEEP 192:vzP8ulPS8L+argrjRnSP4vlBrjwFXHq3o1tT:vZ7RMrNlvlBrUFX2oH
TLSH
T16144FE0D7D22E632D49BD931AAF2A85256B5038B6FC0BC5237FCB564AF9CFC4507A409
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\jac.exe.log
Size 1KB
SHA256 28da357194e6cf73ced8ba39459786048059a8866cc7977667e6af6a5cd5cf46
MD5 950b6b92d53c9720105be3cbc6a7e5b0
SHA1 3812717dad7db163c39802221a5cf4d842edfbc2
SHA512 54dc7e4b00b29963d9f7e6ac60799795996f11ea0446d9691c3dd5f1716e588db24f55953c8aa0a7e4df34efe30d095fcb98a79cd4cd9ed032fbd6c3fa72f05f
TLSH
T113117B71227AA1D88D163F952D1D2BC403BF4339B6509E187998729EDD360175F212F7
MD5 SHA1 SHA512 TLSH

Submit Download

.jac-current.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-current.xml
Size 34B
SHA256 9f895c8533531d15db7d0decc14bb67a332b709f69bebf46c7901931a9983dfb
MD5 0d96bd4fa3589580a45ccf9a08354d37
SHA1 d114c3e70c12b31fe41574f50e8f0062d06c66c9
SHA512 dbb0dad40a0dbecb350641eb71bd694545b4fee12e6bc321ccc554148a4888b1e2c53ca50b53ebe51771ab1f8b379dbe3e9f055c52673d0b228973da32c31fb9
MD5 SHA1 SHA512

Submit Download

.jac-install.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-install.xml
Size 2KB
SHA256 18b683e5ab6a2f7b365355f62d15f3239f731fdde603dfa78a16d21846a10e75
MD5 0d60820fc6d5691d3cf791363e2367d0
SHA1 ba2c1ca37646b675d26d63b65e74775091128ce8
SHA512 2d5fa7e37cc4545a10b3c887bf7c74ac9eb32d6d70d7b6abb28fdf4dc092c2f0602a2d0f10376f5e0dfd5090a4a5b012d014c6ba760efc0352c4ff047d22d42d
TLSH
T106416DF608D4B32E9470AEF76B19B538B329D8203A5D2941BC89058B53B513973CB5EF
MD5 SHA1 SHA512 TLSH

Submit Download

.jac-transaction.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-transaction.json
Size 2KB
SHA256 46b7b702e43a6cbc1bb928a13e7c27d2b7d1485269a24210bb7f20f61cc8de3c
MD5 a14752a8aca8aa3849a99d86686e4cbc
SHA1 8f97851fb1811e21780b3d44936ea1e7c8ba4d23
SHA512 0ed09fd15214f096bb5fcf296821f3efc8ed9bbb50b771a0493e07a7f02f6a3c99401cbb0b9f313b6fb81d6c22ea0660ff87e9d358ec90acfef26281a8db0812
TLSH
T1D15135AC1525ED6E93C219DC42039BDEE371EC32E8D9B08FE48B0B8273F706A5654053
MD5 SHA1 SHA512 TLSH

Submit Download

GETTING-STARTED.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\GETTING-STARTED.txt
Size 2KB
SHA256 82949ab8e04160277b51c241b7459cfaeaf3d26d41c82740167ed3ff1cd164f0
MD5 8dcc5a2069ffe7f8dd719fdc2311822d
SHA1 99b2a165ee0074aa8617569370643f403b3d3e8b
SHA512 1af854bc9ed39a279b6991db39c0d29708773f6ca5f63896015b02b849d6bf97bb4b5724f5a0e15c150cfc109a49a56de62a3a433c527d3e9a6d29e008be161b
TLSH
T1BB51C9777BCB368C36530395BE0183D1BF34A1683B990961F85E549C425A15897B3B36
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\Uninstall.exe
Size 49KB
SHA256 222d1070259bb6d4e771e853ca95038cf5347d40690cfda2514692618ad110fc
MD5 7907ea1a368097d2f795aadd15b09b05
SHA1 90385749c5334ac647126ef5ee485f2000cc041b
SHA512 7871c082300696eabaac27324b544c8489056695a04cbccb7e5f1669f18b7fae603b7544ade0ff8b6e152ce7f5a2458cf5a2248e971b2d9c6344dc654d02db01
SSDEEP 768:Xk+d0gKB7FKB1z+dlvqom14t+owm9jLrAkpxy:XkeUuwlvqomatPbXA
TLSH
T10C33D54977E84B24E6BF2B78A87152548E71FC57ED32EB5D1A8140AD0D3AF80CD60B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
Size 29KB
SHA256 158fca0ac4e4abccf79bb6c42f42fde25efedc33a8e10166883df854f0212b63
MD5 89e32b530eef987074ecf8fef21daf2f
SHA1 136757c300b0bdbd5e0087e2d4875ca92ec0a27a
SHA512 63c4233a133d9986b0de986184622c23c1e6790b1ade7a98b070092aa8dcf3553b4a403ffa9e4d82eb4a30153cd93c99d04e6e517f7c16da5cb370b5bd888503
SSDEEP 384:WnKEgDTKk+aCJJ0cxXDXn5DAhiC+4yT2V1StYg12+UAdYa5UlIIpjRx2K6xyWR:NTKk+N0cxzn5DAhiCOkStzvmjRx2pxy
TLSH
T1CAD20B486BE88B74D1FE0B78A93121559E71FC5AA832FB1D1F88507C4C3BB848D91B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.ico

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.ico
Size 3KB
SHA256 0aa6b0cd0fc67bbbd3575af1409cd4e824c52d6c2f36ea7af5640582035c1629
MD5 68e740ddb6f215c4dfbbb372c7944b4a
SHA1 0155f1f29940701bfdbffdbded519c70f339f2a3
SHA512 f770dd9b66f90d9818e3459eb64ccbdd814adc667cde9270fcfe49f3cc4776df75024a801c164dcd164d35e114cb0716133cebd99fedeee18f53f7580d1ec7cd
TLSH
T1BE8163CD1B8C4EF8C65944214B6B31B2FE75ACDE247D39167B74B4748E1E58025836C2
MD5 SHA1 SHA512 TLSH

Submit Download

DEPENDENCIES.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\DEPENDENCIES.json
Size 197KB
SHA256 31bc7b101cb4af57a0a6c94cc809dbf4cb9b40930a40c259100db3993e3567bd
MD5 a77b47e13b7e64238fd46db726f2894b
SHA1 94ca4efd9fe92fd5c947e3ba650870cc9219d701
SHA512 7d9b30c2eca62327d342e97b93d2a91fc017e736420207e0048110bee43daf3710eb845256afbedcce56f69c4ebe7e007cf61a3f6aa020910cd9a854b58ca31d
SSDEEP 1536:GYW8PltFxCbAQ6mpoNFyNIcfWgD3s/Tto1lx:GslrxCbL6mpEFyNtDr6o1v
TLSH
T10F14FF61C6706CB7288C8BB4092A564A762400471D6D7D0E33AE9A7C5FBDDBF28F171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\NOTICE.txt
Size 222B
SHA256 4b92f3c799b77b10104227f9e778063558cafcafd883d57de058b1a00d95b0d5
MD5 4919bea71ad9b72c7d6c6d7c6fc6d821
SHA1 449a00908cdfc9c17acf0a7fa4c5101fbd1ccf8e
SHA512 a786e10b92f8d9ad67aa5e4587242aae3665469ac7a4f88f8941febe3f50af4623db1762e8bff2b7f8424fc912928ba8e54c90713c6f6c6107395df1eb2bc06e
TLSH
T12CD0231E618A17D586310386F55BB3DFDB158D0803E04297A0B5410E01DB1B89367FBE
MD5 SHA1 SHA512 TLSH

Submit Download

OpenCode-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\OpenCode-LICENSE.txt
Size 1KB
SHA256 b5c625d157735f04e1b2b7ceccee849130b554bdb23cd58db55a38a257efbbdd
MD5 943d7c4c5077c4cbf3fe540cbbde6ce1
SHA1 a6b66f875a6b320a472c667c0675ca0ceab1b89c
SHA512 8de19a86a32572202c2d102f82626999e9f42cbd8654a9f73092d9e09db8a1f18a1e7d74c77532a7eb9d1770854f152204e15a0c6bd0bca97d877065bc52c013
TLSH
T14911B52F72960373189657A055B9ECC5F22BB14A7FAF1A84346EF2091326058C9FFC68
MD5 SHA1 SHA512 TLSH

Submit Download

THIRD-PARTY-NOTICES.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\THIRD-PARTY-NOTICES.txt
Size 5.3MB
SHA256 e9eee1733aadc53787e0f4c8e4c3a40b80b09b8513251a15b7b8d93e8151ce24
MD5 57c065c3fa0c3160e9db4866ef46465c
SHA1 665f042c52129cb5cc09291fc56da4e0b40ebaca
SHA512 4afdb92e7083b0bfb5f44ac77453f01ae378eb925f69ba40e6e0aea1905c5102dcf74b735c4d01518ded48fc50ac901fb51e03ca4b3356c5a0581edcd5d7e06a
SSDEEP 24576:6Orh0I+sE1KBf9beApGk/CzvTCKo9CzWhCt0Lo1YzgBTEDBxPLlj6ulj6J:6OrhAP9
TLSH
T17246C72F7B48037319D343616A6668CAF21EB03F3B5B2644345DE258273B76982FF598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FFLATE-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\FFLATE-LICENSE.txt
Size 1KB
SHA256 0a1df3a083d0c010560aa342e87959c8c1070e6fd54545741f083f22d0c8b551
MD5 b44ae31f7482d1a8d2f9bce6cc409db5
SHA1 e8f37052323f71060dab76883ed691cf95c0cd69
SHA512 5d5eb9ccf01a5be79b40f0cd157cbc6e2c20d88c3d499422026fbff7aeda999fee25fd52fa6bc5b202e2aaa7de3602be005c65235cb1f2e59f2737854ca17da8
TLSH
T1CB11791E72510772189B176055746CD5F13BB25F7E5F2A84246DF345233A06CC9FF840
MD5 SHA1 SHA512 TLSH

Submit Download

PDFJS-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\PDFJS-LICENSE.txt
Size 9KB
SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
MD5 2ee41112a44fe7014dce33e26468ba93
SHA1 598f87f072f66e2269dd6919292b2934dbb20492
SHA512 27b8c0252eae50ca3ce02ab7c5670664c0c824e03eb3da1089f3f0a00d23e648a956bcb9f53645c6d79674a87c4cc86d1085dc335911be0210d691336b121857
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
TLSH
T18822512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\LICENSE
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\LICENSES.chromium.html
Size 19.4MB
SHA256 5d545ce8065079f38a82472ab93bd62fcdf73cd319f0771ef51c45c7e243f1d4
MD5 a1ee17d90caa1bf1f3726ec03842f18b
SHA1 27a94b164c4255ce0dcab5c020f335a9cd3f8c60
SHA512 d9f7448213a449535f1ff43090c08f0e2388af4e72ce2f59e0b1b457a831f76c0d7d69d88cd435b1682479d31d480b19a5488dc3ef6c133c974557d5bdbcf446
SSDEEP 49152:52SFkMZThUZLQTYp281vCmR3r8xsJQfiFTuoYQdVi2Hxj37D4h:f
TLSH
T11827B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\dxcompiler.dll
Size 24.5MB
SHA256 b25b6c8bc64c9ff17ed16e0d272bf0bd7b305f3e19f792a72c8145a6bf624584
MD5 d1b78f795d632caf74e3f6e6aa09f770
SHA1 4f91847c6924c50868fa961973526327c13945c9
SHA512 95edb7b4c761a0feb19e6b348f706e38bd2a9a8dd674474271f6cc23de8b92b99ccbe80bc48e2bf6c9381242db94fb77ab0e22b2b0a2ba0d1a30d9a7c865fd1c
SSDEEP 393216:XClYzmZHZRxtwnLsde/Vuyjw4O+qZG/+V:tORi57JaZGW
TLSH
T167473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\ffmpeg.dll
Size 2.9MB
SHA256 1b9d751721a40fc8fba2355172382d0e0c210e54c7f2862ebd8a6b6a093f832f
MD5 475107b162007199044cee83e815f771
SHA1 d3ef20d40f696710164994cfbb55edc4e0ccda07
SHA512 8d81ecd673d59a773d18369849a11878a41a5c92be6c4ee7dbf951070bb833e604a357d6a0e9a58d070df484069fb4c923a9e3c7b1802e0ea5d9062258f4fa46
SSDEEP 49152:odfREhAZtlrINr/T6XF2i81IQbx6i1N2A0hGR9/HvaLukwhBuO1i:o9ZtormXFgLaLukwh3
TLSH
T197E59E02F6D251EDD029C03497ABE213F271780A4F205AEF17A05A253F66FD86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\libEGL.dll
Size 467KB
SHA256 fa8cf715db0e2a7a0f20a2b583221e439c484390b400ec70ff5956ea70d55aae
MD5 dfafc7b1b6948618c9d49f471b389456
SHA1 e4588df2cec79e131cf96d1e2e437691b9bc13ba
SHA512 aa391adb7af700e4304fa1bcbd0ff62fb63d3cd2d9603739487a537b45c25e45b2f9e79dbe79fb3354e6c14561d9b46907d136fd35880968f7df69d979a52b59
SSDEEP 12288:NGxGyTj2M2uuMlptOdxncCjfsLFm5kQDhfl1:NGxGyTjT2tMluQLIk0hd
TLSH
T1F3A47D15B3E949A9E07BC138CA538643EB71B8560B21F6DF02A0D2793F77BE45A39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\libGLESv2.dll
Size 7.7MB
SHA256 b6548524109b605155fcccccac8836c3d29dde3f1f6337f67a2bfb7931b9e0a0
MD5 0cb591214b989bcafd178c5337095edd
SHA1 0cf018723bdcc568e3a666004e34f1e66c97d45f
SHA512 4dd7b6ba31511160d447138c628a713e529fe494fc58e1a28f69dc80c51a41a96774805858a1555026b7f90a545743a9617e9e4b0172d3faff03f9aee48b74d5
SSDEEP 49152:a4AMBWsanmFGBeBMb0y/tQOZcS4vl7s7EGt6j9pH2Isk2MKWcL0LM0k7bzsKVkqC:xMR/ldEzKNtLsKK4X6F0HO
TLSH
T1F9866C03F69681D9C05DE2788757A223FB34B8850724F6CF2B9457152F6ABE0AB3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\locales\en-GB.pak
Size 552KB
SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
MD5 121461689d08e6e0d1e0ad4e6c695f7e
SHA1 113ec35be3b54ebf9e2b064181475bb82dda2670
SHA512 69b0d1d401aafd2fac6ed86f3c51de4889ebda123c6cfbe6267e83cd9271dccf7db2627cfaf31bf5713efad48845662763106ef26da09803a1580fa04c7416c5
SSDEEP 6144:D1Zf+l9GJBIvNBlxIxhb5E43FzcieMaMP9zQ49lfaYHEJjXCYDcBcnR7K:D1ZfqsJavNBPIxhbQvMNQ49UhDc
TLSH
T13AC43D1FF784126A05A311A2BB0AA5A2FF23D07CB35112667CBD811C33B676583777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources.pak
Size 6.6MB
SHA256 b92a3508c9631066b013adb736684e63e7b9e82e5f4c8a005b243e8e6b2bb5d2
MD5 d36dc817d163729acb7886ef14673881
SHA1 cb7f36e1ba0f649bed5f4c34510eed1e0e2018bf
SHA512 2e81faf0b555818ed61a4906226fae8a2d79f51216c67fece11bd9a6eaa7a784f88b333b6df1813d62c023874b49a8e8a9c1288ffda489c943b7c87a5cebb6ab
SSDEEP 196608:plsBRHPfIXoDTz9uTjTMkriACmZnC3gEL34tVrW:8Tvr/ztkrDntEoVrW
TLSH
T16A6633D266E3A80BCE9063B98984CF39199CAF2572D4B093489D5119ED9CF5C0BC4B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAttachmentGuard.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAttachmentGuard.exe
Size 6KB
SHA256 a17b3cae4866fe8710011e58fff941c10be32bf606c30d6a9c5236e35a6e6127
MD5 451d7f091fa0d7ef91fb7717e1d885d7
SHA1 b8d3c8d6356763d1ce2a86945468d1e6e6ae1810
SHA512 4b39d4e88ded245b3f2730d0162a486d6b51a6b36111fbff55916c82ad0d49503e48d94e4db0eef94071630a7c9bf18561d6783c13b9e23baf1fc03023e4d7ce
SSDEEP 96:ByoeMd+7C14+rdQiPDYikPVcoVQ3Dlk6zQp:Byoe8XrEHQO6
TLSH
T111C10A49E7CC45A1E96B037C5AF293011BF4FA5CCEAB87BF24E18279BD117444B92391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAuth.exe.1cf8e2b7cb9f453c89323b3b948dd3ac.tmp

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacAuth.exe.1cf8e2b7cb9f453c89323b3b948dd3ac.tmp
Size 19KB
SHA256 cd672da3646a563b4ebb8cc522473557d728fd7237f5355842572ba6456adf74
MD5 fd0bb6b85ec2683a2c55dd1bbf91dfa9
SHA1 e66027300f15c7a613ab26782c28067718ffa2cd
SHA512 88ab84fefacdd673559083a41ea6fa214bc48918d13a86750b0cf1cf172dd4dcf0fe75035d934b63391c0aaded32c1c71548228477e974627b74461056bd3cc4
SSDEEP 384:as092bZdfy6aspecyrUzfHjEWxX+69AYfx57cc1GyrCs:aD2Vdf10cyrUz/jEWE6JxdC
TLSH
T1BF922804B7E8C712EAFF4679A87207400E72AA975D62CB4D0CC5A8BF0D73B508D94FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacDesktopLock.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\JacDesktopLock.exe
Size 5KB
SHA256 d0f940d5f1d95a78489423ff2128f5f9dbf510fb06c2c38523cd50e5633944c4
MD5 f850191983962f15ee0d5b7b9bd9e0b9
SHA1 38fae484f32d7e05be1fe0955047729750973cb3
SHA512 42bffda55257b0a17f4ddf680932f976251e0ac9fd31fb059d922d241408c2bbab637002d27f3d3199721c95fa29b88a39da993378e47f2b054dad2f019fc686
SSDEEP 96:HzZaM3C5ZCW/X67OmTr3uPsD3Dlk6zQp:HzZaM3C50W/q7OmTr3ZDO6
TLSH
T1E7C1EA42B3D44512E57F477869F3430527F4FAA94D2AC3AF9CC4851D6C1138C9B607E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\app.asar
Size 3.1MB
SHA256 118cc0680cfedec54264e713f7c565c206b3421929945e61503f6a9294624e10
MD5 086a84dec05acebdf760bbbf027a19b9
SHA1 9bc8cf1c6871413652a79907ce0c6039bdb5dc21
SHA512 e5b6894e5534287c2ce39b00653ba84a0f78b880f42f756935f65c61c4063ce3ee4e89906dbd07f9a12017a6a1442145178952dda6dde00654e3af522a5ac067
SSDEEP 49152:lv0EtKhL9RcwUMjmasACRF8LHFKo8oiceJhJZ6aLNgZWsuigKXuMBlRwudx/fffI:zqkJoQ
TLSH
T1ABE52A5923F714219653B0B91F1B0102B636A417380DCD5DBEACCBD06F4A86992F6FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-integrity.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\resources\client-integrity.json
Size 6KB
SHA256 9550eb68ec3e16ffa115b82a7ada13baeb899068c46b89795694257f1ab8b7d3
MD5 652737232d3fc88ecbb237977440c7fe
SHA1 ca291cb1c0c6a2a72869a953d2175ddfaf454030
SHA512 2b29abd8070c254854990a60cfffb8af6ff558dbdbd98605166ceeb9005ad87bced1fae8a6484d2c41a28bae567289d4a33a2439738a31be8c1a1729c3e631bc
SSDEEP 96:AatSGf5xfVqmDB/S8ur3pJnlSQWpQcUilr+Wrge8vfxuna+b557zjPOyvUJ4B:AgVhx9lDB6R4QRov+xfG73rvUM
TLSH
T18DE1DAE255B6F25D7C04733D47D9BD460B85D0850A926F98E0DB46C82027AC7B9B60BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\v8_context_snapshot.bin
Size 704KB
SHA256 b0874ba2f21ccf59f8a3086168ad782834aeeabb4acb644a20744a1cbeb5bf59
MD5 8499aa219e4679efd7df4b5e0d767fe1
SHA1 3ccbe3967272f758fbf7d217fd6e40894e670053
SHA512 c6ea72fc00de1aa7a29a83d2d503a061d49f3d629bf1421731d5a9cd2e3e7ee310f581e465a1f440c43cf2bd7a1cdad4ae9cb9f41f8ecb8e00bb095096193dd7
SSDEEP 6144:jBrQKX5Xst+HlXawuu7uN4udhbM2Ndgp2BsaXgHkmybvAdEpjyHZdhU4iPWlan:mW5XhubLjbM2NdOeH4dEUlURWYn
TLSH
T1EFE48666FB06CE26C8657A7D8DD74B063A30B2DD9EC6EB077021937CB8786544D2E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.2.8\vk_swiftshader.dll
Size 5.3MB
SHA256 4bd642ea08bd933014cd5c44911c4422bd6f69c8569f494de79054536a6469e0
MD5 d37818372f78d8474170cd97e89727e8
SHA1 259deaebb92eb3b7f8ce5bae70a8b26831459fbb
SHA512 9d2593c075ea2c44760656b131c571fa0ece1fcbbb9df86c8616493588e90bd4ef69dd48adbe7a214a89d0fa2d1884cbac134a8d2a2a6b3fdbd8f83b3c708175
SSDEEP 49152:xVfzRLVriek3jvuhmV9lbL0aLgztfbkiNSYoCESb+ngPskvIC6C2Qf+d+0C8m8KZ:xVfz2pFxbkkm5X
TLSH
T106464903F29681D9C06DE679875FA623F631F8800B2276DF56A00F192E69FE06B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Jac Code\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 0b10da26f3ffe54a51f43d61afc400725c92d33e3c67a8739a1bc147523a014f
MD5 6bfc9cf7a5c679adf700fd444df2a860
SHA1 7f2ca731673711652b8ea44e28c90b6597127f50
SHA512 dcf6b20918cd64ac749dc403a9317eef92760aaba2c523b555af7fff78bf7dfae8efb98737f8c1bdb99b594aed6c5d676fbc4e31379c5297dba05faa52914302
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Jac Code\DawnWebGPUCache\index
Size 256KB
SHA256 4db5d2a9c50f9bf1762792c01a73b3d843284f828e7acbf4126ded5899144ee3
MD5 f75123401d136187b94f846c197743ad
SHA1 3afe8ff5b9ec0b94c708f8a7d024113af50bc093
SHA512 020a9495c73a3405e665e3cafaa9a472037c50cdef215e21844903587f7347130723ada6f5ede165851633e863f5da3b3b2329241038384af26e17359f8bd002
SSDEEP 3:LstlNllkll/lO2l/:LsX3lEtO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local State
Size 490B
SHA256 ee9498fac77f832a2f765f933efee8b6912b0dba5b806e9b4e05b202687568dd
MD5 ad43343581a7c2bd90b945a83d201fd8
SHA1 bc7b9f3787081c65a63c93ca4509dfe03a767fcf
SHA512 2273724441874f6c7467515b37b80e0a7bdfd07f4c3768668cab30863afdcecd98abd83bc1530f9338c222111f26fd4eed9d0cd0aec90fa603c00cccc692ad2e
TLSH
T144F00EF3D5219E752BF44A28882211030F0211B309488F006986411216F3AA4418BD34
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

.integrity-v6.key

Path C:\Users\Admin\AppData\Roaming\Jac Code\backups-v6\.integrity-v6.key
Size 32B
SHA256 7daf1e19675ce84e2398670d34d703115df3e47416abf1a91979911b856f6828
MD5 0435d5ccaa4e9e72da9b66af107d4b22
SHA1 02405b6f4357179a8c3cf9fc916e35c5f3e8e37f
SHA512 1d9cde02bd1571ab1101d80ab91e6195125e7ff6e07bf097451edb5c80001d6c2df54c43783162e1a62d1a8f33b41ca630060263d417726eec837107adcb2f3e
MD5 SHA1 SHA512

Submit Download

database.sqlite

Path C:\Users\Admin\AppData\Roaming\Jac Code\backups-v6\.pending-1628b99e-e8fa-4645-b828-52140bd77377\database.sqlite
Size 192KB
SHA256 3d7cf90aff64bdae1f1903f204e850fde4b0a16fe19ff70d719879ccaf9d666b
MD5 a3f2a48be14e6f3fc0c51e3a95a2c91a
SHA1 6e80e23505a5b92b6e74075d4a5db2f490a7e610
SHA512 8f1f670cc98547c9feb536bb8c2d54f703fbd7c76efe0e80c9139bfe83c827b8ed8263c59b60d91628c5941089bae3f34a596539e06c2f09e183f25ebcdcbb58
SSDEEP 96:2ndlIwGjS4r34+/bFCMdwSZmc+woriS7nIl8IKSqRdlInGjS4r34+/0UybvHpepc:2cJtjFXHqwo1t/nJtLi8TLU
TLSH
T17614110D7D22EB22E5D7D43096F2A8526775138B6F807C1237FCBA60AFE9EC1513A449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Jac Code\backups-v6\.pending-1628b99e-e8fa-4645-b828-52140bd77377\manifest.json
Size 1KB
SHA256 98e5a9b6e8eb2096269c823a4dde1e5a00adb126bc84752101fc627992e54114
MD5 2a8c25eaccce118cd6b6b97694c2c239
SHA1 abcb576958d3537d045e5c51d4aa426931febe1e
SHA512 be46243a3b31001e31d6cf426d2dcf039045829c145e38249c3d22078cd23f06d7b6b26805d7e0e6052d06e3f95ffd4eff81cb427026ff4ac1ed0415c752473e
TLSH
T1AA316026921D70B89B4F64AEDF432A93A77578013BA50D6098EDC0C6534001CE2F3BF9
MD5 SHA1 SHA512 TLSH

Submit Download

e099c7c9-e573-406e-805f-e742fc4407ae.tmp

Path C:\Users\Admin\AppData\Roaming\Jac Code\e099c7c9-e573-406e-805f-e742fc4407ae.tmp
Size 490B
SHA256 bc931405e527b66ecf0866b8733c4a7ca410258bd68d85dc39d4262d8aec0665
MD5 c8c8cffcf84a17003657907b81dbce97
SHA1 1885fa099bacf65ff354f6891d02a4409b8ff889
SHA512 8ac7fa4e9c7f0033286d092b23c8be0f4bab309157a505e3c91438d6db04da64a1a8b13df672286b766d7095bfc264eb04f12ba6336af1165509f5de07e21288
TLSH
T17BF0D4F469F87EA83E606211061779120E14B6D7D5AF365DBF4A11110193CDD520BC75
MD5 SHA1 SHA512 TLSH

Submit Download

queue.json

Path C:\Users\Admin\AppData\Roaming\Jac Code\queue-v6\queue.json
Size 38B
SHA256 6b6401b3841d14091235e8e71a5f7e767b3198be6f3662576a618cd4d296f732
MD5 ef2682934d7f3705011fa867628f2bf5
SHA1 2ed7634c7711fb62c7404aabe9727a5f7a38d4fb
SHA512 789d7b39a52f16278e8b3ecbded4622f9f32ce46f3d7877925632d40f1865ef08920261a9cb6d532e96d48c95cfe1fa1d876fc6ed3773e0f0bb260b71fa98108
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Jac Code F9078B.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jac Code F9078B.lnk
Size 2KB
SHA256 1662e520c57c6449dd8a4afcc64972976269f1b601f58f0d8663707c72476af6
MD5 de30ae34e914603d9ed50bb7c8a57a79
SHA1 558770edc27edf4633d07d8e0aaa4295c6875621
SHA512 511059dc7546dec80887b9b1d311d1e4d110e7259b6884d9d85e6fbbe60fbb694c713f3c1e2dbb8f264eb8f4a6c34844be28410655b7ad64c2fc0515612bc26c
TLSH
T1CE41FE0847E11710D3B7197948E67A22CB37F861AB560F1A1085C38B1D36E80DE15F4B
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\~ac Code F9078B.tmp
Size 2KB
SHA256 f556e806cca1ef187d607919e33742068ab01dad0ea6abcbf2a3f087953e7973
MD5 3484491547832b8f987155f0a68825ff
SHA1 f83da1d00df7969cdb1b0725a12297e42bb49214
SHA512 aaf408c3a77358576344f900489c067ec585f0be4c06c9d5b65a80f3d853035a69586bcce0f55558bf7b6895f9160342be9936a8801f4b2413772c6c5c05a6b1
TLSH
T12851A80897E52710E3BB197909F676228F3AF861AF5A0B0E5085C38B1D36E80CE15F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Jac Code F9078B.lnk~RFe596269.TMP

Path C:\Users\Admin\Desktop\Jac Code F9078B.lnk~RFe596269.TMP
Size 2KB
SHA256 f3089b604feef2eb840b2ffcaec82c653efafaa690f37673c763837bc125176b
MD5 b69dda5f260821bfda7ae6ad185a03a7
SHA1 786fe398314082c681c622e2c3c3f1ab881eb8d9
SHA512 e509766996413ab68535bfcc0f1bd5a8cb194389fe6f02230afa97365ca9da6b7de355537c3edde51da9891d8a6df2301e282c2ac082a8f5b9520ac5cefbc160
TLSH
T1AB410E099BE11610E3B7597D09E77A22CB3AF8605B460E1B20C1C34B2E33E80DE55B4B
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\Desktop\~ac Code F9078B.tmp
Size 2KB
SHA256 4d6608283c89561b60f09aad2f283c28705d4835fdca598d8066741e1c4f828a
MD5 486e644ab5ab41b447113463dbb384cb
SHA1 a5d2e0de55d23388d7f805bf3664f6c1a61023d3
SHA512 1f518919d2ebcaf2f337b129d68c27674bc89b3aba27b2a8cdaa140bddb667eec7db6f5f545aecd1570f8e40fbc945eb219d377337bb04f8851a678febc7689c
TLSH
T11051BA0997E52610E3BB5A7D19F6B6228F3AF4715F0A0A1E5085C38B2D36E80CE55B0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1708-500-0x0000000000320000-0x0000000000326000-memory.dmp

Download

memory/2288-503-0x0000000000260000-0x000000000026A000-memory.dmp

Download

memory/2288-507-0x0000000002D70000-0x0000000002DC0000-memory.dmp

Download

memory/3176-513-0x0000000000880000-0x000000000088E000-memory.dmp

Download

memory/3668-328-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

Download

memory/4124-31-0x000000006B6A0000-0x000000006BBC8000-memory.dmp

Download

memory/4124-27-0x0000000000650000-0x0000000001650000-memory.dmp

Download

memory/4124-322-0x0000000027060000-0x0000000027108000-memory.dmp

Download

memory/4124-119-0x0000000027060000-0x0000000027108000-memory.dmp

Download

memory/4124-30-0x000000000D310000-0x000000000D322000-memory.dmp

Download

memory/4124-29-0x0000000029BE0000-0x0000000029DA2000-memory.dmp

Download

memory/4124-28-0x0000000028E00000-0x0000000028E10000-memory.dmp

Download

memory/4264-5-0x000000001C870000-0x000000001C880000-memory.dmp

Download

memory/4264-20-0x0000000023E30000-0x0000000023E52000-memory.dmp

Download

memory/4264-22-0x000000001C870000-0x000000001C880000-memory.dmp

Download

memory/4264-7-0x000000001C870000-0x000000001C880000-memory.dmp

Download

memory/4264-6-0x000000001C870000-0x000000001C880000-memory.dmp

Download

memory/4264-0-0x0000000000890000-0x0000000000DFC000-memory.dmp

Download

memory/4264-2-0x000000001C880000-0x000000001CD2C000-memory.dmp

Download

memory/4264-1-0x000000001C870000-0x000000001C880000-memory.dmp

Download

memory/4264-4-0x000000001C870000-0x000000001C880000-memory.dmp

Download

memory/4264-3-0x000000001D130000-0x000000001D1E4000-memory.dmp

Download

memory/4516-465-0x00007FF864A70000-0x00007FF864A71000-memory.dmp

Download

memory/4516-466-0x00007FF865B20000-0x00007FF865B21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads