a9795def24143068dc28467af69e6a75a6de9fa291cc8c7248f4e479c78a6352

Analysis

user interaction
yes
max time kernel
902s
max time network
472s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jac-Code-Setup-6.3.15.exe
Size 199.1MB
Sample261107-vjaydsfd72
SHA256 a9795def24143068dc28467af69e6a75a6de9fa291cc8c7248f4e479c78a6352
MD5 5a44e880ded478ce098db49adb2f7298
SHA1 834137b3fd0c73ab26d25999338cfabb8f18d10e
SHA512 a35daae5b3cdc29a4b668b4de51eeb5f11d3d4a990f0937acfce1ef21dca915bcf872387b57f2800063b07fedb15f55d271488847579da2b937cf2cda7dcd888
SSDEEP 6291456:Rm3mES4mwWMjfU/lupCtg2HvYwKmFfM4u14g9r:RUmAjfU/S0TC97
TLSH
T1E3A83358C5189B41FDEEC9B3DDE70A5C73B11A5BEE73A8419B4883A035033E496E2E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
4664	jac.exe
3300	Jac Code.exe
4240	Jac Code.exe
5248	Jac Code.exe
696	Jac Code.exe
4980	jac-engine.exe
4588	JacDesktopLock.exe
3668	JacAuth.exe
1240	JacDesktopUpdate.exe
3264	JacAuth.exe
6108	JacAuth.exe
3344	JacDesktopUpdate.exe
2084	JacAuth.exe
1092	JacAuth.exe
4416	JacAuth.exe
1384	jac.exe
4876	Jac Code.exe
5588	Jac Code.exe
1796	Jac Code.exe
2784	Jac Code.exe
3216	jac-engine.exe
992	JacDesktopLock.exe
1664	JacAuth.exe
2020	JacDesktopUpdate.exe

Loads dropped DLL 8 IoCs

pid	Process
5248	Jac Code.exe
5248	Jac Code.exe
5248	Jac Code.exe
696	Jac Code.exe
1796	Jac Code.exe
1796	Jac Code.exe
1796	Jac Code.exe
2784	Jac Code.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jac-engine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jac-engine.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jac Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Jac Code.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe
Token: SeShutdownPrivilege	3300	Jac Code.exe
Token: SeCreatePagefilePrivilege	3300	Jac Code.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3300	Jac Code.exe
4876	Jac Code.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4664	868	Jac-Code-Setup-6.3.15.exe	91
PID 4664 wrote to memory of 3300	4664	jac.exe	92
PID 3300 wrote to memory of 4240	3300	Jac Code.exe	93
PID 3300 wrote to memory of 5248	3300	Jac Code.exe	94
PID 3300 wrote to memory of 696	3300	Jac Code.exe	95
PID 3300 wrote to memory of 4980	3300	Jac Code.exe	96
PID 4980 wrote to memory of 4588	4980	jac-engine.exe	98
PID 4980 wrote to memory of 3668	4980	jac-engine.exe	100
PID 3300 wrote to memory of 1240	3300	Jac Code.exe	102
PID 4980 wrote to memory of 3264	4980	jac-engine.exe	104
PID 4980 wrote to memory of 6108	4980	jac-engine.exe	106
PID 3300 wrote to memory of 3344	3300	Jac Code.exe	108
PID 4980 wrote to memory of 2084	4980	jac-engine.exe	109
PID 4980 wrote to memory of 1092	4980	jac-engine.exe	112
PID 4980 wrote to memory of 4416	4980	jac-engine.exe	114
PID 1384 wrote to memory of 4876	1384	jac.exe	119
PID 4876 wrote to memory of 5588	4876	Jac Code.exe	120
PID 4876 wrote to memory of 1796	4876	Jac Code.exe	121
PID 4876 wrote to memory of 2784	4876	Jac Code.exe	122
PID 4876 wrote to memory of 3216	4876	Jac Code.exe	123
PID 3216 wrote to memory of 992	3216	jac-engine.exe	125
PID 3216 wrote to memory of 1664	3216	jac-engine.exe	127
PID 4876 wrote to memory of 2020	4876	Jac Code.exe	129

C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup-6.3.15.exe
"C:\Users\Admin\AppData\Local\Temp\Jac-Code-Setup-6.3.15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe" "--home"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1892,i,14596719408766807140,4403810767583346723,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,509935155090272846,15470755786285221108,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1924 /prefetch:11
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:4240
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe" --type=gpu-process --gpu-recent-crash-count=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1892,i,14596719408766807140,4403810767583346723,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,509935155090272846,15470755786285221108,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1888 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5248
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --app-user-model-id=JacCode.Desktop --app-path="C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\app.asar" --enable-sandbox --allow-file-access-from-files --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1892,i,14596719408766807140,4403810767583346723,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,509935155090272846,15470755786285221108,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2860 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:696
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\jac-engine.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\jac-engine.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopLock.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopLock.exe" transaction C:\Users\Admin\.local\share\jaccode
        5⤵
        Executes dropped EXE
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe" mcp-config
        5⤵
        Executes dropped EXE
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:1092
    - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe" transaction
        5⤵
        Executes dropped EXE
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopUpdate.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopUpdate.exe" startup "C:\Users\Admin\AppData\Local\Programs\Jac Code" status
      4⤵
      Executes dropped EXE
      PID:1240
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopUpdate.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopUpdate.exe" startup "C:\Users\Admin\AppData\Local\Programs\Jac Code" status
      4⤵
      Executes dropped EXE
      PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2156

C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
"C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe" --home
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe" "--home"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --field-trial-handle=1776,i,8472095617702028607,15797092569687876852,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,7291429010060580858,6144960960181668622,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1940 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:5588
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe" --type=gpu-process --gpu-recent-crash-count=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1776,i,8472095617702028607,15797092569687876852,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,7291429010060580858,6144960960181668622,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1772 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1796
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\Jac Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Jac Code" --standard-schemes=jac-preview --secure-schemes=jac-preview --app-user-model-id=JacCode.Desktop --app-path="C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\app.asar" --enable-sandbox --allow-file-access-from-files --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1776,i,8472095617702028607,15797092569687876852,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1780,i,7291429010060580858,6144960960181668622,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2892 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2784
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\jac-engine.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\jac-engine.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopLock.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopLock.exe" transaction C:\Users\Admin\.local\share\jaccode
      4⤵
      Executes dropped EXE
      PID:992
  - - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe
      "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe" transaction
      4⤵
      Executes dropped EXE
      PID:1664
- - C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopUpdate.exe
    "C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopUpdate.exe" startup "C:\Users\Admin\AppData\Local\Programs\Jac Code" status
    3⤵
    - Executes dropped EXE
    PID:2020

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.jac-current.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-current.xml
Size 35B
SHA256 82f782b1869c2700beff74427f10da979c42b1797a5155156fe48f9fbb1facfe
MD5 4dae3551837c04628b280cb9e7010c5f
SHA1 d31c6a930f3f206baa3ab6cc9d73b9dc113e7f3d
SHA512 477da5b907801eeb5e7387d0b40516eeaad5b07f357e89750461a5246a6d9787e103e7bc078a1bc60481b595c5529c602dcae1c7da4cc3312bb031a0f8a1bec6
MD5 SHA1 SHA512

Submit Download

.jac-install.xml

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-install.xml
Size 2KB
SHA256 ad15a3e9c2c623e419895f0891a10e4ce7ca536fb9372f45167ce09744779745
MD5 3e075325f2d08944b03e62e945d6cd73
SHA1 cc4f786cd56e3f50a1b7bc7c0ec1def3b7a47cb6
SHA512 a3d76ca054031ee269181ae5b07d8ce28945c51bb4f213ffd75c253344cae2c778d966cbb1b4ab9f78edafb0b850c284cd47c410cde2a7446f23cf58bf5166c6
TLSH
T1F341A5FA19D8B32E50382AFB7B09B63CBB29CC30324C19817484054BAB6512977CB5FD
MD5 SHA1 SHA512 TLSH

Submit Download

.jac-transaction.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\.jac-transaction.json
Size 2KB
SHA256 832663b8a9e6a604c6729a6f550af73dca09e4a1040d6c8e0bfc2032015fa255
MD5 e1515958129147e02484ff7cab70330e
SHA1 cfc11e2c80548e2c2e1d85c1f1f5fdaac4bd19df
SHA512 181c19faebd130e7799c69c9545ad577938c228e57e33726ce7889a69932ca2315cbae032165a7384bc9b4043b0358973a7ee7548a2550e190e4b5e700b8575b
TLSH
T19F515EBD0625ED6E53E22BEC4603879EE3719C32F0D9A0CFE88B0B4376F705A4664461
MD5 SHA1 SHA512 TLSH

Submit Download

GETTING-STARTED.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\GETTING-STARTED.txt
Size 2KB
SHA256 e0884c469603d9404ae72e53a8aa6a90c2821bd32563660573a1a36f80ed98f8
MD5 6e96258234c8d454a473e41c90e40a52
SHA1 6b48488a6f2196aeba26a0a1c024f3e38e13c355
SHA512 d7eb47d94640a3edc5c3d24b41d47a211f151cfa56ee723be932d4b08b35cf647552e2c5e129df6426a558ae6934edb2df42aaca8bfabae2b6b825ce6693b3e6
TLSH
T17051C9777BCB328D36430385BE0183C1AF34A1683B990961F85E549C425A15897B3736
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\Uninstall.exe
Size 53KB
SHA256 b33c9b1e12288deb1a320293359019b59dac82aacf7d511a191bb8014e7c51ec
MD5 a1014fe89b5a748a7100092b96dcbb29
SHA1 af8eae3284ec072209f7d8a6badfb3d1a8634fb6
SHA512 05c6582ca637c5cfb7406ba573d5ce8f1dab96221626c338b1690be243df196b06dd51555002547d6b0c5c585590c0b5e10704be68931270447bb745ed9f8d2b
SSDEEP 768:ml2CJG8efoLATL3qTwV9yUuNpEhDjuYvXMmUBCWAPKj0wkpxy:iV2W4sUPuiXXYzAPhw
TLSH
T13B33B54967E85725F2BF2F78A87152548E75BC67DC36EB0D0A8110A90936FD0CDA0BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.exe
Size 30KB
SHA256 c02a0ce108c5b9606ee173eebbb734a22ff97f22c58c366136ecf6e243921733
MD5 d1b2b6a2937f1a00c5610d01bd94f00b
SHA1 f8ee7c2a85e5d56fd54f8f8de3508442706ba276
SHA512 d2ec7682bbb9112a486474345fe53402db0e280537b101089cfcbb2d72ef64c4acc4e7004694d7eae7c836189d081595184c22139275478551b9ff66dcb6c11b
SSDEEP 384:kfPJBOeADG8AToLvV9iRtjNcR/UpPcVq1G8WW4YSXYg12+UAd8aezFloC9irOK6N:beUG8ioLt9iL5cRc9cE1ZSXEerOpxy
TLSH
T161E20C056BE88B34D5BF1B38753611549E71FC5AE836FB1D4F88916C0D3AB808DA1B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jac.ico

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\jac.ico
Size 3KB
SHA256 0aa6b0cd0fc67bbbd3575af1409cd4e824c52d6c2f36ea7af5640582035c1629
MD5 68e740ddb6f215c4dfbbb372c7944b4a
SHA1 0155f1f29940701bfdbffdbded519c70f339f2a3
SHA512 f770dd9b66f90d9818e3459eb64ccbdd814adc667cde9270fcfe49f3cc4776df75024a801c164dcd164d35e114cb0716133cebd99fedeee18f53f7580d1ec7cd
TLSH
T1BE8163CD1B8C4EF8C65944214B6B31B2FE75ACDE247D39167B74B4748E1E58025836C2
MD5 SHA1 SHA512 TLSH

Submit Download

DEPENDENCIES.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\DEPENDENCIES.json
Size 197KB
SHA256 31bc7b101cb4af57a0a6c94cc809dbf4cb9b40930a40c259100db3993e3567bd
MD5 a77b47e13b7e64238fd46db726f2894b
SHA1 94ca4efd9fe92fd5c947e3ba650870cc9219d701
SHA512 7d9b30c2eca62327d342e97b93d2a91fc017e736420207e0048110bee43daf3710eb845256afbedcce56f69c4ebe7e007cf61a3f6aa020910cd9a854b58ca31d
SSDEEP 1536:GYW8PltFxCbAQ6mpoNFyNIcfWgD3s/Tto1lx:GslrxCbL6mpEFyNtDr6o1v
TLSH
T10F14FF61C6706CB7288C8BB4092A564A762400471D6D7D0E33AE9A7C5FBDDBF28F171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\NOTICE.txt
Size 222B
SHA256 4b92f3c799b77b10104227f9e778063558cafcafd883d57de058b1a00d95b0d5
MD5 4919bea71ad9b72c7d6c6d7c6fc6d821
SHA1 449a00908cdfc9c17acf0a7fa4c5101fbd1ccf8e
SHA512 a786e10b92f8d9ad67aa5e4587242aae3665469ac7a4f88f8941febe3f50af4623db1762e8bff2b7f8424fc912928ba8e54c90713c6f6c6107395df1eb2bc06e
TLSH
T12CD0231E618A17D586310386F55BB3DFDB158D0803E04297A0B5410E01DB1B89367FBE
MD5 SHA1 SHA512 TLSH

Submit Download

OpenCode-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\OpenCode-LICENSE.txt
Size 1KB
SHA256 b5c625d157735f04e1b2b7ceccee849130b554bdb23cd58db55a38a257efbbdd
MD5 943d7c4c5077c4cbf3fe540cbbde6ce1
SHA1 a6b66f875a6b320a472c667c0675ca0ceab1b89c
SHA512 8de19a86a32572202c2d102f82626999e9f42cbd8654a9f73092d9e09db8a1f18a1e7d74c77532a7eb9d1770854f152204e15a0c6bd0bca97d877065bc52c013
TLSH
T14911B52F72960373189657A055B9ECC5F22BB14A7FAF1A84346EF2091326058C9FFC68
MD5 SHA1 SHA512 TLSH

Submit Download

THIRD-PARTY-NOTICES.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\THIRD-PARTY-NOTICES.txt
Size 5.3MB
SHA256 e9eee1733aadc53787e0f4c8e4c3a40b80b09b8513251a15b7b8d93e8151ce24
MD5 57c065c3fa0c3160e9db4866ef46465c
SHA1 665f042c52129cb5cc09291fc56da4e0b40ebaca
SHA512 4afdb92e7083b0bfb5f44ac77453f01ae378eb925f69ba40e6e0aea1905c5102dcf74b735c4d01518ded48fc50ac901fb51e03ca4b3356c5a0581edcd5d7e06a
SSDEEP 24576:6Orh0I+sE1KBf9beApGk/CzvTCKo9CzWhCt0Lo1YzgBTEDBxPLlj6ulj6J:6OrhAP9
TLSH
T17246C72F7B48037319D343616A6668CAF21EB03F3B5B2644345DE258273B76982FF598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FFLATE-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\FFLATE-LICENSE.txt
Size 1KB
SHA256 0a1df3a083d0c010560aa342e87959c8c1070e6fd54545741f083f22d0c8b551
MD5 b44ae31f7482d1a8d2f9bce6cc409db5
SHA1 e8f37052323f71060dab76883ed691cf95c0cd69
SHA512 5d5eb9ccf01a5be79b40f0cd157cbc6e2c20d88c3d499422026fbff7aeda999fee25fd52fa6bc5b202e2aaa7de3602be005c65235cb1f2e59f2737854ca17da8
TLSH
T1CB11791E72510772189B176055746CD5F13BB25F7E5F2A84246DF345233A06CC9FF840
MD5 SHA1 SHA512 TLSH

Submit Download

PDFJS-LICENSE.txt

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\legal\attachments\PDFJS-LICENSE.txt
Size 9KB
SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
MD5 2ee41112a44fe7014dce33e26468ba93
SHA1 598f87f072f66e2269dd6919292b2934dbb20492
SHA512 27b8c0252eae50ca3ce02ab7c5670664c0c824e03eb3da1089f3f0a00d23e648a956bcb9f53645c6d79674a87c4cc86d1085dc335911be0210d691336b121857
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
TLSH
T18822512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\D3DCompiler_47.dll
Size 4.5MB
SHA256 f5c95e919b4ffa1ac71049cd45b9f986d2965e6888395ca2806337985334fa56
MD5 f7b785e9d2d7a4ebd6374a555063a100
SHA1 da162478b19b05fedc9d8027bd182f6beeecdeda
SHA512 a287e97b14d1f66783e35f295dc0f355a1da1215aa514d307a01d31b12dd29cc4e9f591281ed6b4f9d8fc90fe7d647ae7d2ef0ad2c989c9dae2123462006776d
SSDEEP 49152:7MaW1H1ZcPsk9HOJLjJP73tSjPM2gjg9aIhR46LUbOWHHJdsCIdkTYoHjnTVyNMx:0cPsguxj34bwmvD3emt3Dnkr
TLSH
T148269E56B7E850E9C1BBD138C687861BE7B1B80513305BDF02908769AF73BD16A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\LICENSE
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\LICENSES.chromium.html
Size 5.4MB
SHA256 7dac8267ac6da8d959cfe88f5f055b18a397f10230380b5329125e167bf5639b
MD5 3f5d5669497c9d912e5f0412611f992c
SHA1 4294658fd6a5be492b8745b6cbfca923f7344b2d
SHA512 e2c2084a34dec1b1009852dcba37912af48140e127029e84c73021d26b724d679b58f8fba2bd9319e20d026c52798401ccbfdb883088992df0724ec82dd7b22b
SSDEEP 49152:jCrmWndoHTYp22kuCenUBFIdACi4WMEAUYw6cif:+
TLSH
T10446C66B7E49037306F282616A47A5CAF31FA03E3B5A1654309CD1182B7BD2583FF69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\chrome_100_percent.pak
Size 555KB
SHA256 576ee32df5f75b87961d553b3211002810a9f77fdf7d34d3c20d390366e317f5
MD5 6ddbdd67f950b9d3a2e8f7aa731f275b
SHA1 41ab2fb640f30f8cf77b856abad1d9953dcaed24
SHA512 447d1e8798dbfff53389aa672a75ca3188826fe39f7ce6b0ecf9b2084e8b1098d0af47cc6f84d322e084592e197feafa48e61e7cea552e269846484acdaf58d3
SSDEEP 12288:J0/HeilX3lm3I3Hwzgsz5B0GDJQrnKs8SNP+QSsfSYJblIt6YY5rC:mmg3lmY3wzEEmPLdbc6vQ
TLSH
T120C412E77370AC7DEE5B473B82660170FC7359680A92060A1BDAF8B9691774898DD3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\chrome_200_percent.pak
Size 906KB
SHA256 b193854268392f42623adde73efd8bc328ed8b159820946b5395a6223e51ae1f
MD5 d328358155f09e2a0f44a04843aa858a
SHA1 f84cb7f97770db5e59fca21d31d2fe9385c89cf5
SHA512 321830aabdc06b0084ec8a93e987d923eca2af5ce81dac3f993677f6e8aeb26d0f4fbe3fef8dc3f08aba6c213caf46a2cceaad88e4d868ec0c9add6ff1c71aa9
SSDEEP 24576:s9P2zzmecRvQt83cmmibkFR8+mZrIQwuSXAkpbaWC4:m2+P1QG3cmNbkFRJmJ8uSXAkJ
TLSH
T1351512D3D7B4ED3EDE520A73935B20E0FC75102719651D0E0B26AD7A2D13788E9DAA83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\dxcompiler.dll
Size 24.6MB
SHA256 f9423f08212401e1a8f4b3213c6ebb1b9a37e212f0533e5989d90780141aa35d
MD5 2af313296ba9326bbfd946192cbfde94
SHA1 619fd16b618b9d9428370191c5e6d894eb606bd1
SHA512 ec55890e0f159b724a2acdba9fe68fe94c2067b0a1808f7401753873799ad631dbc2383f19f690f82f56af0fe536909728c8f0146443622ab3620866f9a0022e
SSDEEP 196608:q5faNqRBapQMnU9aAzYrmcgcuYe6y6nqaESmyytjkP8Z80KFqmP9909KTAq:GamBaCMnK9krGcDy6nHESNHEe5Aq
TLSH
T1F74729122646D49CC099C879C7678B268A6C30E73FA7B9DFC0F461212B79DBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

electron_wer.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\electron_wer.dll
Size 415KB
SHA256 9ebd83426b4990f66bf2bff1537e102e6b6517cc7d08141e9cec1a411dd8af68
MD5 734a621f68e29590bda9ba98de24dc40
SHA1 4a7e8955ec360cbd80a7c92187a11a3b23461041
SHA512 0cd09795163e8d01b032aa91dde98ed806d1055f945a13136e0f83a37d43bee6954588f725893b934248b6f5dd194b44e5311483a3de591750e89bc508f2f59a
SSDEEP 6144:PPhloWDpJZ9MJAEpccKZtZ2tt4PWRHpu7AgVyPJSfUj/ajgVX1:nEWx9MJAEpcce72tt4PWRHc7tyRSf
TLSH
T11D948E04F7E448F8E07BD0388A278646EF71789A0F61E5DF03A452692F37BE45A79721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\ffmpeg.dll
Size 3.0MB
SHA256 f035e9879a6d43519467a8d761d2ea643ac63ed89d448eab9aac86bc38c4809f
MD5 4564d6c38964a21a2015b8590bfbbbad
SHA1 b9600c7b57f47bb9f107d426f790b08002df2ad5
SHA512 9717c13ee1037d10fb344d6cc9cd02df582a1cec7d4d09bca4bd82f95ff0dc2c536f2f1f73a742cf3f2aeff2206cc58a78b71a2a5431594c96437c59310d025a
SSDEEP 49152:yjIDphImac+jNpD+wZbT/UTiD7NyzuCmKgc5mar9Yhp1kY2gVek3BYYwxIS4y+jG:ZgcWd+wZbT/n2uAISf
TLSH
T151E5AD03F2E651E9D019C43497AF9323B674780A8F1099EF17905A252F67FE86D3E728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\icudtl.dat
Size 10.3MB
SHA256 e1ed8f674bb8449731b79cae956042da59f9ecbd37c8d3f86586a22b4836e5b2
MD5 b4c0dc21484123499fd1fe34df95fbc9
SHA1 c33408e8d8cf180b1f7436e30051f18e9305c708
SHA512 a13c4f5e34565e4971a59ad1fb478d8653c809124f103dfd1bee6b3556156f934e0ebb5f02d2e695813247e3227007d0509c7ffc510f7610f922f0f865941301
SSDEEP 98304:5AcBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPp8T7:5AcBhORok2HiXUxO/RJk3IWhlYntjdq7
TLSH
T1D1B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\locales\en-GB.pak
Size 571KB
SHA256 e2cf3bd4d2ec7f900c710346362b03bdedf0a46285fd32d9cf6b8fab373b2f20
MD5 ced93cd2a753589f04680b265ee99723
SHA1 a6d807f8bbb58317914758e2fda2f2915e1b2dfe
SHA512 117d4d0f853465adcb436a88c797e2d1ccd04799d80bbfc2532bb8425a43c1c3f408bcf48f72900401e53cc9904a70093c4bc6668feeb571000501a15ece4e86
SSDEEP 6144:BCl4JNb8f+mGIPEHxh5wEM3NKPqE1yRpaMP9ShVfwfaY1GsdpZq/DcQBczP:BZhxh5gNKMchVfxR/Dc/
TLSH
T110C44B1FF745122A05935162BB09A5A2FF23D07CB36112667CBD802C33B6766C37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\locales\en-US.pak
Size 578KB
SHA256 de43db43fe0072543ab225f6d762cce3656a1639bf9e25f371fe0e80d9eabba7
MD5 f37a7d8a47814398d5d09cd573b8483a
SHA1 7f7fe1844a4235809c2f7f82881dc88669c447af
SHA512 ef36c2df703f6712b4c099dee14d84f28cc5fc1a4d84459450c37b73e85e24d67d22b4b72728507cd3d44a812d1f8c3405436dded551ce42e32f019a65b5820e
SSDEEP 6144:qZKyPAbrkCPapbQRJZmJHBH39VHf1KOHhNv3Ti+UUMP9IhI/efaY+73RJnYaFjNr:Omr4FgaJ7Hf1FNjMahI/J9FjNEwT
TLSH
T1FEC43C1FF744122A05A35262BF0995B2FF32906CB36112563CBD812C3376B66D2B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources.pak
Size 12.8MB
SHA256 e76eeae66e4b4ac97f76a9a17260705f7f82d52c6bfe868dc0775cc9715d07ab
MD5 ae0b6c6f627d62d4798f7fcf844f1cff
SHA1 998471d5510748f62f4f32328df9a6fe755bf244
SHA512 b13259dd0945189f576b7930bc22d8666463eb1f3bd5a24f9b1f0f39a0e30c378c073374297000568e139884bc75de308c8f24f49c6ec486018c490cf04a13ed
SSDEEP 196608:9RR3ZeqsPzZOgYimq8oR/5e7sbacNC9Q13KqiAsnuNKpVmVRosIYVXK7KK7j9ZVk:9LZelLgg9mno8sbk9WKjBuOsIYpODVpG
TLSH
T129D6339066B86679CF92637983E80132DD4D4C2F09E592A10E5E31ADAE370DD6FDE03D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAttachmentGuard.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAttachmentGuard.exe
Size 6KB
SHA256 bba71cc03caa3aad2d3ba167ffaa66381c52eef885abc516849067a58eea081b
MD5 9f429b6e3be3fbc655197a08ae6bf882
SHA1 54d5d62291c9eba0e1840081cdb987f1a13f2828
SHA512 bfd56f3b2a174aca59867d73c7002d9c381c5d605291ca2573805e34be2d0fde57e26de5278b15768dc9262d0bc512fb6f8f9d14721b61c1b5610c67bad3904c
SSDEEP 96:TyoeMd+7C14+rdQiPDYiktVcoVQ3Dlk6zQp:Tyoe8XrEVQO6
TLSH
T1DDC10A49E7CC45A1E96B037C5AF293011BF4FA5CCEA787BF28E18279BD117440B92395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacAuth.exe.e79352feac8a4f51bd027ba61e9bc964.tmp

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacAuth.exe.e79352feac8a4f51bd027ba61e9bc964.tmp
Size 19KB
SHA256 f16c83f8211670543e93be5540f2a7805855f366cfa39c48dffaa5acb0bb4959
MD5 49645fa07968b465cb19ca609a10d37e
SHA1 5275b2aedc6cf3a48474e9b2b1a34060ce46cd14
SHA512 0d92dc32c9e5a45832e863f03101c76f8413d8e9a3f1deb48e117d31a0ffafbbfbcfab162fa317f593ff1f750b9873fc8d98af5e9e262c2f34a3e2d8f8d9827e
SSDEEP 384:xs092bZdfy6aspecyrUzfHjEWxX+69AYfx57cc1G6rCs:xD2Vdf10cyrUz/jEWE6JxRC
TLSH
T155922804B7E8C712EAFF4679A87207400E72AA975D62CB4D0CC5A8BF0D73B508D94FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacDesktopLock.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopLock.exe
Size 5KB
SHA256 10a729e21f5be2e6a0c88987c923b05562a1413b367f36652fc3326804467d0d
MD5 ff19785edad0b043f608a25fa748baef
SHA1 4c26b080fa7fb5ce0f2d57ab02bd6cb4e10fe7ed
SHA512 a6c7efaa36597810e5c465f83eb20e36359416ef70282ef5ad887291eef7d9142a78140c9c267e0cb243e8626f1263eb8e108e07a125fe71594c5344aaeb61eb
SSDEEP 96:dzZaM3C5ZCW/X67OmVr3uPsD3Dlk6zQp:dzZaM3C50W/q7OmVr3ZDO6
TLSH
T1FFC1D942B3D44522E57F477859B3430527F4FAA94D6AC3AF98C4861D6C2138C8B607E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacDesktopUpdate.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacDesktopUpdate.exe
Size 45KB
SHA256 a396c057703bb2d4d0261717f4c02c43c357111716841ed0fe459ca2955a69f8
MD5 ed47deef3e6de92fccdd5fdbfe009308
SHA1 20af7ee4c2eecf49890fee78dafd971d037d3677
SHA512 6c5211b1231b37493c0bfe93d417a834b82918da019c975642e2ec32999cef5b6233ece6f01fe22d0989f23a0af67c43c3c5f9686806e6bb7a24168811ce8d29
SSDEEP 768:8A8cnK9cEJxCkMQFtfCI+iQhffEXjXRFIpxy:8UK3DFtiVffEXTRF
TLSH
T1EB23F80977E84A74D1BF1B78A5312260DE72FC5A9836FA4D5F94507C0D2AB808D93FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JacProjectRun.exe

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\JacProjectRun.exe
Size 15KB
SHA256 e61796967e0e3dbbce06737f26fb5f15436c0f08e99e97f142ac328b681080d9
MD5 88371718a2638fab3a5b3e0218a109ef
SHA1 10794d2a5ac225d1ddd76e9ba2433b42ff4adcef
SHA512 16be3bb55b447101b214dea354c24528001859b31cf76c92b6a4c6b0ff33ee9e06802dba14615e33cea70994d921e39231c06698da5651a4ad8cdcefbd5b31ea
SSDEEP 192:h2UM5nMaUElpOsT8Fz6TqnN06ufQtoojDV+Kk8KE/HggMi8rgbwh8IbC26D+QO6:zM54Ex8FznGfMUZ4/HgG8GY800+Q
TLSH
T1D4622A8FCF1802B3EA8D42BC58770B0057B0419DAD93EB96AEE5E1B72D25BC50752387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\app.asar
Size 3.1MB
SHA256 a41f40d27e5a6cccac655c5f169191865f7ea1f43f60b550903d024d90a01e5d
MD5 9856fd6cd6ac058640c63d6ee773aa7f
SHA1 6267942cfb0059ec13c0d0c7bdb4ca081247990d
SHA512 d9297eb9918b7d07f6977576a7124aa066671429c15396f2593a91acc5191e50935903cb06b84f1fe6a4b50bc94b2ba9e3a9643ec6abf27d1d194f40eee3943d
SSDEEP 49152:ev0EtKhL9RcwUMjmasACRF8LHFKo8oiceJhJZ6aLNgZWsuigKXuMBlRwudx/fffV:gqkJoxgWgtg
TLSH
T145E52A5923F714219663B0B91F1B0102B636A417380DCD5DBE9CCBD06F4A86992F6FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-integrity.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\resources\client-integrity.json
Size 6KB
SHA256 de863f015cbae9f55eb25f5f2d33e1bcbc073c779a6f3a1b2c5f4cd5b4549b04
MD5 240b8791f39a475252e56b5723898b17
SHA1 081606c8978a79d63f27430c0b3f2f933aa31576
SHA512 99b68753190e73b96b8d24b9df05e1186dba55503bb2c159f40fda2ee84aae54bf8f6d15bc8da59f745b386f87cf2988c32ff315a31ec51b20e7dd634115fac2
SSDEEP 96:AadWpnToFSEbvlZ/nqqpEhN7YSyhy4ryY5fTmHbrgh6zpnznfTMCqCD7aBCTZR8z:AaUSHrEhaSum7rgwVTcSkCEMcSK
TLSH
T12FD1A7F15666F15E6808723D4BAE3E05438D909806E67F5CD1AA41C8602F74ADAB34FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\snapshot_blob.bin
Size 365KB
SHA256 7cbf6f6f4dacb2d7bc33fa58802586967fb1a67881ca3b4b57f035d7a4aaeb84
MD5 d4d6d150e877225ee240accf6b0bcf4a
SHA1 982f7946e4b981a67e362c026a6e342076c73119
SHA512 d4256015ccd306cbc0cb228e871fb1e6fd7ca460e440bdd64be3b0cc9db35e8cb74bc56c2ca7590d8b2617f88d1497e4b15a3d02fc3b2fa8e6e1656ef5c0411f
SSDEEP 6144:ft+HkML5GDnUMTxWRlTXKQu7eW24xqS2/Ny7I/WUX4cp:ILcU/
TLSH
T17484FF02B14ACB25CDD252344EFDCED43AB4F58DDE4E921B728083BDB4B95658EC268D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\v8_context_snapshot.bin
Size 735KB
SHA256 adce42fc0dc2dd4da6afd7aac60715764c928c8029fd3f551a71a9400f1372c0
MD5 9c02815984b596ff609f3def6a6de038
SHA1 66c595e504b600e627815618665a82248aed734e
SHA512 000f552f045d780f4c87d2b9dd38e151fd636e236af1cfe8f23db8a51994f2c982fdbc1c83b5573ef5d45bea4e894b876bd78a03c6b7aa83f7d5e3627d45cf05
SSDEEP 6144:Xt+HkIu2iqD70TxWRlTXKQu7eW24xqS2/Ny7I/WUXS2W7tfdlozz+87P5ih88lda:k7D7S2W71dezz+87PUtqw3oX
TLSH
T12BF4A772F50B8F29C9D653790DDA8E4E3A74F08DEE0A9007B20C937D74FD5A88E66119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\version
Size 6B
SHA256 5278972faf4e79e7c907e470a9cf5b96980f652070c6faafffe71d4d77392441
MD5 0807c599e556f10262b0c4afa29bebba
SHA1 e07e285d55ceed5c8642ef062d44717808c57474
SHA512 0d3f819b133c925ed14f5ec6221393cb9815416f3697e6d6690de744e0022d13b0470c55e213283362e918b4dd7a6a0ca50809b8973837f93988e2a0632d25b4
MD5 SHA1 SHA512

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\vk_swiftshader.dll
Size 5.2MB
SHA256 2601880d950b0f76d3d44b2fa23b9076b722c2be6f2d1e2972f1c1c2cf176c16
MD5 737fea1a5268641e84e8fea59eca6b65
SHA1 6c26c6481ebceab1de9c06b1944f0458958c3615
SHA512 9bf5b1e64f6c40fa85ab2fd2e25b74dd1d0af0e8b08b6b46380a3656b06f95ad42e3be5d804c880baebfa5f80288cdf2d26884b49a55274e3511f882cca19147
SSDEEP 49152:4yQV+ED3w+TN8gHV/xmBtJmG6cHExWl71PEX9KoFyUewJMGBxeKreXcdWVT90ewq:4h+ED74Qauw0dHUtDYZPF2
TLSH
T117464903F28581E9D06DD579875BA633F672F8840B22B6CF56A00F192E6AFE0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Programs\Jac Code\versions\6.3.15\vulkan-1.dll
Size 935KB
SHA256 f23002eefe4824cf6724d7ae63e9f2dd1f5119d53a64b542394ab528c64b0d2b
MD5 d3bf60343d808b223b11aeccc19c4da3
SHA1 f0641beb31fc3a3556c71488bc96db72163ed30e
SHA512 6dc99ae5fc7da3d61aa3f02106e7795ad125c13968a36b2dd33442e3eccdb6d20bb1f50c7a54c560c809a04b54ebd8da051dc542403a89b8674b5f04ada81e4d
SSDEEP 24576:/AxappHEzMkbFnWOj4nfg+K+ySUKNlC1E+Dkw7+Dv6g3v0TAE7yoeHbPez:/AkpuPbF+nfgX+ylKNlC1E+Dkw7+Dv64
TLSH
T15F157D53D5948AB9DA7B8038CCD5490389F274A11722B6CF02B817142F5BFF46BBDB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Jac Code\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Jac Code\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Jac Code\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Jac Code\Extension State\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Jac Code\GPUCache\data_1
Size 264KB
SHA256 94503fd79f991fce43473d99279d7400631e32dcbb00c37af916fc53a7f0aa22
MD5 6add31e4aea327308664a7d88ed92e42
SHA1 17003251062b384cad96d2e98e45737322b53b38
SHA512 02fd391c2ab065ec2e249aa9d9e5daae7c736c9ddc7dddac4574a60676b0a49bc07b912b95e5872f71fd8e91307060fd4ca8762608517c0f4c32e07088b31076
SSDEEP 3:MsEllllkEthXllkl2zERgl:/M/xT02z+g
TLSH
T1294404057FC40C05CD5430304017C3500371D4100D53D74334510437FCC75C00D01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local State
Size 490B
SHA256 2854be88c22dd6ed27382e4737e38efa1ded127b2cc54f3b5713647715e8f6cb
MD5 307918d208f5f346b11cd5b559ddfcce
SHA1 492bcec6d0ed1fe31ea2739c0b5ff9351e9bf58d
SHA512 5e0d6c46b2efa2ca0cc8e43c2364b5e13571810b062fc4fc567a90eaa167531658672fa6c5172a99f305029ee93a9b87e284fc3f011c99f347afe627f633e505
TLSH
T1B4F054F26EE0DF7C5B8C991C84037B431D3035E35AA20B006216050219B78C28202EF7
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Jac Code\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Jac Code\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State352a4b9a-a21d-4888-a67c-b8654ed437ae.tmp

Path C:\Users\Admin\AppData\Roaming\Jac Code\Network\Network Persistent State352a4b9a-a21d-4888-a67c-b8654ed437ae.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferencesffda321d-fcf4-415a-9389-e7e60b5e08fd.tmp

Path C:\Users\Admin\AppData\Roaming\Jac Code\Preferencesffda321d-fcf4-415a-9389-e7e60b5e08fd.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Jac Code\ShaderCache\index
Size 256KB
SHA256 f687b3c9b4de0f2600d7a81d17e77247777597a5ff60463968a01e6fdf8ccaa7
MD5 729b547842f3d99bba4aec7109414fc2
SHA1 eafecce2d884502a0442283589a8ad49a990e7fa
SHA512 d1fc736ece112843a9b6f252c9f8a7b8e036a705ad87916e7cf159d1a812323177f0ca63b54f60d6c639c9efb0871b121453382059da2ef22448ee3cd2eeddd9
SSDEEP 3:LsOllllklkXlyHkXl:LsUlPyHs
MD5 SHA1 SHA512 SSDEEP

Submit Download

queue.json

Path C:\Users\Admin\AppData\Roaming\Jac Code\queue-v6\queue.json
Size 38B
SHA256 6b6401b3841d14091235e8e71a5f7e767b3198be6f3662576a618cd4d296f732
MD5 ef2682934d7f3705011fa867628f2bf5
SHA1 2ed7634c7711fb62c7404aabe9727a5f7a38d4fb
SHA512 789d7b39a52f16278e8b3ecbded4622f9f32ce46f3d7877925632d40f1865ef08920261a9cb6d532e96d48c95cfe1fa1d876fc6ed3773e0f0bb260b71fa98108
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Jac Code F9078B.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jac Code F9078B.lnk
Size 2KB
SHA256 3ba4d76e8ad7cb7bb03cae77279ff7978f5d80888b7d3ff99fbd51529690b453
MD5 b99561cc758cce1be7c56805495b6e09
SHA1 ed1f72f738bd959332d66c7fa483f42c475f7b42
SHA512 3df616f531419cda1e8644d2a53fd3c5188d7f90ef723173d4ecc67505c05e1d8b8cc30da63db70c2642345bde01ed30394847c6e926efac95cdf974488130e2
TLSH
T1D941FC02C6E56B15C3F7897F16A266228F37F831EB571F0A6002D39B1E25B40AD44F1B
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\~ac Code F9078B.tmp
Size 2KB
SHA256 15d6748f6b0efe6d3550fc1278b52693ced2eefb503cfc9af8beca2b8a92d230
MD5 74fd0c6b5cc9181d3e1412e796508bca
SHA1 93963e0dfae10a2eafc08d5a75f78631ccf9395a
SHA512 0cbd55ebbb1cd8217bd07bce5506e803e418da39e1358396a459b42443eed7b878a81e3ea6aef148de8f5c23de198db2047f6d9b419d88e13486c51f727e9d44
TLSH
T18451DC02D6F96B10D3BB49BF16B266264F36F431AF5A0B0E5005C38B1E25F909E10F1B
MD5 SHA1 SHA512 TLSH

Submit Download

Jac Code F9078B.lnk

Path C:\Users\Admin\Desktop\Jac Code F9078B.lnk
Size 2KB
SHA256 ee1b5694020e16629feca521f428afd0d79ca300cad287d40499a124e393a8cc
MD5 df01fb34dcbe44c41e98c1c57b9463c5
SHA1 53f7a9d0ef07a5d6038c0a173a90321efd470f9a
SHA512 36cd86c9e500f990f46344c849178de8dd994ee82f73e720020d415c73090d79d6ca834ebbfb4483671579d7f0d43d84c814cae712c033d1a7ff69a070ed1b0f
TLSH
T109410E13DAE55720C3F7897F16A266228F36F4319B071E0A6102D35B1E25B50EE40F1F
MD5 SHA1 SHA512 TLSH

Submit Download

~ac Code F9078B.tmp

Path C:\Users\Admin\Desktop\~ac Code F9078B.tmp
Size 2KB
SHA256 4cd6df1b3be1188fefc0bce44b4f3dc42305c1cb1323532825fef101d209d165
MD5 30c82ef9f9d9ab2a808df75fd67ce9ec
SHA1 e878579c878168f89f68902c60cba36c63d3cd67
SHA512 720a678572b51364c90936efbe1f3466a7f68ec1e4c263371728bf3f35bb05f670419e58c8a26c73c9be6e2ce7ff959234de0030fa21f2b01337ee916548da1b
TLSH
T18051BC12D6F96720D3BB4ABF16B6A6264F36F4315F1A1A0E5005C34B1E25F909E50F1B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/696-408-0x00007FFB50E00000-0x00007FFB50E01000-memory.dmp

Download

memory/696-407-0x00007FFB50CF0000-0x00007FFB50CF1000-memory.dmp

Download

memory/696-470-0x0000025067990000-0x0000025067A63000-memory.dmp

Download

memory/868-22-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-18-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-12-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-11-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-9-0x000000002DE70000-0x000000002DE82000-memory.dmp

Download

memory/868-10-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-8-0x000000002E020000-0x000000002E1E2000-memory.dmp

Download

memory/868-7-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-6-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-5-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-4-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-3-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-2-0x0000000000450000-0x0000000001450000-memory.dmp

Download

memory/868-1-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-0-0x00007FFB2F65F000-0x00007FFB2F660000-memory.dmp

Download

memory/868-14-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-15-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-16-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-17-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-13-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-19-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-20-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-21-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-302-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-23-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-24-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-308-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/868-25-0x00000000716B0000-0x0000000071BD8000-memory.dmp

Download

memory/1240-448-0x0000000000EE0000-0x0000000000EEE000-memory.dmp

Download

memory/2784-662-0x0000022F6FF80000-0x0000022F70053000-memory.dmp

Download

memory/3668-449-0x00000000037D0000-0x0000000003820000-memory.dmp

Download

memory/3668-447-0x0000000000D60000-0x0000000000D6A000-memory.dmp

Download

memory/4588-442-0x0000000000570000-0x0000000000576000-memory.dmp

Download

memory/4664-318-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/4664-313-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/4664-312-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/4664-309-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/4664-307-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/4664-306-0x0000000000F70000-0x0000000000F7A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads