107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b

Resubmissions

05/02/2023, 00:36

230205-ayff7sfc59 8

05/02/2023, 00:32

230205-av41dsae71 8

Analysis

max time kernel
204s
max time network
259s
platform
windows10-1703_x64
resource
win10-20220812-es
resource tags

arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
05/02/2023, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKlauncher 3.0.exe
Size

1.2MB
MD5

32c7e3347f8e532e675d154eb07f4ccf
SHA1

5ca004745e2cdab497a7d6ef29c7efb25dc4046d
SHA256

107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b
SHA512

c82f3a01719f30cbb876a1395fda713ddba07b570bc188515b1b705e54e15a7cca5f71f741d51763f63aa5f40e00df06f63b341ed4db6b1be87b3ee59460dbe2
SSDEEP

24576:Dh199z42ojP6a7HJlF9eu5XFQZSIZeNGdmEE8H17UBcegl:R9zbgH3euNFQZr/oEE892cfl

Score

8^/10

adware discovery persistence stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
223	5056	msiexec.exe

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1828	jre-8u361-windows-x64.exe
2928	jre-8u361-windows-x64.exe
4668	installer.exe
4872	javaw.exe

Loads dropped DLL 64 IoCs

pid	Process
3760	javaw.exe
3112	MsiExec.exe
3112	MsiExec.exe
3112	MsiExec.exe
4872	javaw.exe
4872	javaw.exe
4872	javaw.exe
4872	javaw.exe
4872	javaw.exe
4872	javaw.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe
4668	installer.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5068	icacls.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0052-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0118-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0119-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0039-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0042-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0120-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0081-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0090-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0204-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0051-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0061-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0105-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0043-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0045-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0077-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0084-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0196-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0047-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0085-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0103-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0060-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0111-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0103-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0152-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0202-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0041-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0147-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0217-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0035-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0095-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0129-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0092-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	installer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\WindowsAccessBridge-64.dll	installer.exe
File opened for modification	C:\Windows\system32\WindowsAccessBridge-64.dll	installer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre1.8.0_361\lib\ext\meta-index	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\jdk\giflib.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\security\java.policy	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\ext\nashorn.jar	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\images\cursors\cursors.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-console-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\jdk\thaidict.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\java.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	javaw.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\deploy\messages_ko.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\keytool.exe	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\net.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\security\trusted.libraries	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\fontmanager.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\dtplugin\deployJava1.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\sunmscapi.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\security\policy\limited\local_policy.jar	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\classlist	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\images\cursors\win32_MoveDrop32x32.gif	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\cmm\GRAY.pf	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\fonts\LucidaBrightDemiBold.ttf	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\hijrah-config-umalqura.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\jdk\pkcs11cryptotoken.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\jdk\relaxngom.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\pack200.exe	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\fxplugins.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\unpack.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-util-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	javaw.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\wsdetect.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\jfr.jar	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\unpack200.exe	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\jfr\profile.jfc	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\jdk\mesa3d.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\flavormap.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\jdk\jcup.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-synch-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\psfontj2d.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\jdk\icu.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\jabswitch.exe	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\bci.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\net.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\jvm.hprof.txt	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\Welcome.html	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\dt_socket.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\deploy\messages_zh_TW.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\rmid.exe	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\javafx\public_suffix.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\security\policy\limited\US_export_policy.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	javaw.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\glib-lite.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\fontconfig.bfc	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\javaws.jar	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\jsoundds.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\prism_d3d.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\rt.jar	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\lib\management\jmxremote.password.template	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\jdk\dynalink.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-processthreads-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\legal\javafx\libxml2.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_361\bin\mlib_image.dll	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e594af9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54AE.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71ED.tmp	msiexec.exe
File created	C:\Windows\Installer\e594afc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e594af9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58D5.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F64180361F0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DA9.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4612	440	WerFault.exe	87
4076	4460	WerFault.exe	99

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_361\\bin"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe"	installer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_60"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0074-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0143-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0107-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0220-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0195-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0057-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_57"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0048-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0036-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0086-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0196-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_196"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_09"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0076-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_76"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0044-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0173-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0169-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0070-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0053-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0109-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_109"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_03"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0075-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_75"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_85"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0035-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0026-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0071-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0119-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0154-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_154"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0034-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0062-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0077-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0053-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_03"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0198-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_72"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0196-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_48"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0038-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0070-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32	installer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0096-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0148-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0052-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0099-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0036-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0059-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0195-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_09"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0041-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0041-ABCDEFFEDCBC}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0087-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_87"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0088-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_88"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_35"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0095-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0049-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_36"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0054-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0056-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0042-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_42"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0182-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_182"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_06"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0152-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0186-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0087-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_04"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0052-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_52"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0065-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0033-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0049-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0073-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_03"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0033-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell\Open\Command\ = "\"C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2launcher.exe\" -securejws \"%1\""	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0177-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_177"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0150-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\SKlauncher 3.0.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\jre-8u361-windows-x64.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeDebugPrivilege	1312	firefox.exe
Token: SeShutdownPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeIncreaseQuotaPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeSecurityPrivilege	5056	msiexec.exe
Token: SeCreateTokenPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeLockMemoryPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeIncreaseQuotaPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeMachineAccountPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeTcbPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeSecurityPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeTakeOwnershipPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeLoadDriverPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeSystemProfilePrivilege	2928	jre-8u361-windows-x64.exe
Token: SeSystemtimePrivilege	2928	jre-8u361-windows-x64.exe
Token: SeProfSingleProcessPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeIncBasePriorityPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeCreatePagefilePrivilege	2928	jre-8u361-windows-x64.exe
Token: SeCreatePermanentPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeBackupPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeRestorePrivilege	2928	jre-8u361-windows-x64.exe
Token: SeShutdownPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeDebugPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeAuditPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeSystemEnvironmentPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeChangeNotifyPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeRemoteShutdownPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeUndockPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeSyncAgentPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeEnableDelegationPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeManageVolumePrivilege	2928	jre-8u361-windows-x64.exe
Token: SeImpersonatePrivilege	2928	jre-8u361-windows-x64.exe
Token: SeCreateGlobalPrivilege	2928	jre-8u361-windows-x64.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: 33	2880	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2880	AUDIODG.EXE
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe
Token: SeRestorePrivilege	5056	msiexec.exe
Token: SeTakeOwnershipPrivilege	5056	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
2928	jre-8u361-windows-x64.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3760	javaw.exe
3760	javaw.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe
2928	jre-8u361-windows-x64.exe
2928	jre-8u361-windows-x64.exe
2928	jre-8u361-windows-x64.exe
2928	jre-8u361-windows-x64.exe
2928	jre-8u361-windows-x64.exe
1312	firefox.exe
1312	firefox.exe
1312	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3760	2152	SKlauncher 3.0.exe	66
PID 2152 wrote to memory of 3760	2152	SKlauncher 3.0.exe	66
PID 3368 wrote to memory of 1312	3368	firefox.exe	69
PID 3368 wrote to memory of 1312	3368	firefox.exe	69
PID 3368 wrote to memory of 1312	3368	firefox.exe	69
PID 3368 wrote to memory of 1312	3368	firefox.exe	69
PID 3368 wrote to memory of 1312	3368	firefox.exe	69
PID 3368 wrote to memory of 1312	3368	firefox.exe	69
PID 3368 wrote to memory of 1312	3368	firefox.exe	69
PID 3368 wrote to memory of 1312	3368	firefox.exe	69
PID 3368 wrote to memory of 1312	3368	firefox.exe	69
PID 1312 wrote to memory of 3612	1312	firefox.exe	71
PID 1312 wrote to memory of 3612	1312	firefox.exe	71
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 3984	1312	firefox.exe	73
PID 1312 wrote to memory of 2448	1312	firefox.exe	74
PID 1312 wrote to memory of 2448	1312	firefox.exe	74
PID 1312 wrote to memory of 2448	1312	firefox.exe	74
PID 1312 wrote to memory of 2448	1312	firefox.exe	74
PID 1312 wrote to memory of 2448	1312	firefox.exe	74
PID 1312 wrote to memory of 2448	1312	firefox.exe	74
PID 1312 wrote to memory of 2448	1312	firefox.exe	74
PID 1312 wrote to memory of 2448	1312	firefox.exe	74

C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:3760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.0.996305182\1154536071" -parentBuildID 20200403170909 -prefsHandle 1520 -prefMapHandle 1320 -prefsLen 1 -prefMapSize 219938 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 1648 gpu
    3⤵
    PID:3612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.3.226351254\1041219195" -childID 1 -isForBrowser -prefsHandle 2280 -prefMapHandle 2276 -prefsLen 156 -prefMapSize 219938 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 2252 tab
    3⤵
    PID:3984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1312.13.1036424961\735497964" -childID 2 -isForBrowser -prefsHandle 3248 -prefMapHandle 3244 -prefsLen 6938 -prefMapSize 219938 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1312 "\\.\pipe\gecko-crash-server-pipe.1312" 3236 tab
    3⤵
    PID:2448

C:\Users\Admin\Downloads\jre-8u361-windows-x64.exe
"C:\Users\Admin\Downloads\jre-8u361-windows-x64.exe"
1⤵
- Executes dropped EXE
PID:1828
- C:\Users\Admin\AppData\Local\Temp\jds240694031.tmp\jre-8u361-windows-x64.exe
  "C:\Users\Admin\AppData\Local\Temp\jds240694031.tmp\jre-8u361-windows-x64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2928
- - C:\Program Files\Java\jre1.8.0_361\bin\javaw.exe
    -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_361\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
    3⤵
    PID:5036
- - C:\Program Files\Java\jre1.8.0_361\bin\javaw.exe
    -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_361\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
    3⤵
    PID:3956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5056
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 80090BB362D929B9A77DAB29530C1BAB
  2⤵
  - Loads dropped DLL
  PID:3112
- C:\Program Files\Java\jre1.8.0_361\installer.exe
  "C:\Program Files\Java\jre1.8.0_361\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_361\\" INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180361F0}
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:4668
- - C:\Program Files\Java\jre1.8.0_361\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_361\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4872
- - C:\Program Files\Java\jre1.8.0_361\bin\ssvagent.exe
    "C:\Program Files\Java\jre1.8.0_361\bin\ssvagent.exe" -doHKCUSSVSetup
    3⤵
    PID:4824
- - C:\Program Files\Java\jre1.8.0_361\bin\javaws.exe
    "C:\Program Files\Java\jre1.8.0_361\bin\javaws.exe" -wait -fix -permissions -silent
    3⤵
    PID:3156
  - - C:\Program Files\Java\jre1.8.0_361\bin\jp2launcher.exe
      "C:\Program Files\Java\jre1.8.0_361\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_361" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzYxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzYxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM2MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM2MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzYxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzYxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      PID:440
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 440 -s 1028
        5⤵
        Program crash
        
        PID:4612
- - C:\Program Files\Java\jre1.8.0_361\bin\javaws.exe
    "C:\Program Files\Java\jre1.8.0_361\bin\javaws.exe" -wait -fix -shortcut -silent
    3⤵
    PID:4420
  - - C:\Program Files\Java\jre1.8.0_361\bin\jp2launcher.exe
      "C:\Program Files\Java\jre1.8.0_361\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_361" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzYxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzYxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM2MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM2MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzYxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzYxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      PID:4608
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 611F5FF3C213F8BA82CE2815946A33CE E Global\MSI0000
  2⤵
  PID:3312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x414
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3304

C:\Users\Admin\Desktop\SKlauncher 3.0.exe
"C:\Users\Admin\Desktop\SKlauncher 3.0.exe"
1⤵
PID:3472
- C:\Program Files\Java\jre1.8.0_361\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_361\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Desktop\SKlauncher 3.0.exe"
  2⤵
  PID:4460
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:5068
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4460 -s 540
    3⤵
    - Program crash
    PID:4076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jre1.8.0_361\bin\WindowsAccessBridge-64.dll

Filesize
190KB

MD5
a29afdfa9183650e1bdd2308df510fb5

SHA1
22c507916bef3d16903d3be32dcd106edd3cc7fa

SHA256
2284dd976c8d56db535e4eaf51c99107f136d59dff1e028a3651919800780364

SHA512
8e9844ec99c6c1a5b22877282f2065864313bac755d028970cd2374a641b9a30c9876fd880cc0593a96ac0356da0817f1a8e16beb411ae4241ae4ec46bfd90f7

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-debug-l1-1-0.dll

Filesize
11KB

MD5
b0e0678ddc403effc7cdc69ae6d641fb

SHA1
c1a4ce4ded47740d3518cd1ff9e9ce277d959335

SHA256
45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1

SHA512
2badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
11KB

MD5
94788729c9e7b9c888f4e323a27ab548

SHA1
b0ba0c4cf1d8b2b94532aa1880310f28e87756ec

SHA256
accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187

SHA512
ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-heap-l1-1-0.dll

Filesize
11KB

MD5
3a4b6b36470bad66621542f6d0d153ab

SHA1
5005454ba8e13bac64189c7a8416ecc1e3834dc6

SHA256
2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af

SHA512
84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
12KB

MD5
d75144fcb3897425a855a270331e38c9

SHA1
132c9ade61d574aa318e835eb78c4cccddefdea2

SHA256
08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f

SHA512
295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
13KB

MD5
e173f3ab46096482c4361378f6dcb261

SHA1
7922932d87d3e32ce708f071c02fb86d33562530

SHA256
c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14

SHA512
3aafefd8a9d7b0c869d0c49e0c23086115fd550b7dc5c75a5b8a8620ad37f36a4c24d2bf269043d81a7448c351ff56cb518ec4e151960d4f6bd655c38aff547f

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-synch-l1-1-0.dll

Filesize
13KB

MD5
6c3fcd71a6a1a39eab3e5c2fd72172cd

SHA1
15b55097e54028d1466e46febca1dbb8dbefea4f

SHA256
a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26

SHA512
ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\java.dll

Filesize
163KB

MD5
db081a9968bb0c37a57725cdb66a0c7b

SHA1
d5fed172d82111d1f3bcb46ab3bd8b412f3ee003

SHA256
5b9b01f1ec06ad559285201cf0907e1c31473f6fb91aa09813dd8f076f94afe3

SHA512
8a3717be2bdc1d2e628a069a61ac5b504467c52c7b52496c14050cd0fbc3e1023c791ca8b5c3270579e1cc725a8a0cff62c427dc1c25c2ec74725d1dacc621d5

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\java.exe

Filesize
273KB

MD5
47b34557cbf069e0ad9807305cb5c36a

SHA1
58abfbefc486427175b15e69e8e8f4e346318c34

SHA256
cabcfcf1aebf926bbe03b2aded9e7bbb57f4e10600578a6f2acafbf83b7423d4

SHA512
f9354ec19c3bad2a3a9e95211a306e54ebe559127d8ae660ce75c88839afd558821a0a858366db8820517cb12f7fe0056bb5c09199c1fe1a9083e299b02a148d

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\javacpl.exe

Filesize
103KB

MD5
85a777d55b268c8d8bb8b8c0a2244e9b

SHA1
6d0889388e875a654d3f67d171c2ea0009f5f039

SHA256
87adedaca5cc9d483f1bef7e06c12bf223c3db79cb6e2d137167f99fad3948bf

SHA512
c581e410b84846aa2dad4e9a5e3561784513ddf09f450fa7d8278bd635877116fed32f35a31b9716edf18acc333b14ebfb05673e671f8a404aa0ee4146eddabd

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\javaw.exe

Filesize
273KB

MD5
dc1ddfa9036cd403e17fb7134aff000f

SHA1
0183543dd2fbb2ff7d0997c56ac624e6b2ebff40

SHA256
9bb8aaa6673ec46e5e9cff88fedefad4b33941b0831f4a7047433a24399e9692

SHA512
ecb7603a5f07a95ce3506ecaf38cb07ee089070cc041ce0c92722cafe8c3545b73dd5bf59f06115291b774d3c034c6e677f6fec2780208fa73e387d7c379cb9f

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\javaw.exe

Filesize
273KB

MD5
dc1ddfa9036cd403e17fb7134aff000f

SHA1
0183543dd2fbb2ff7d0997c56ac624e6b2ebff40

SHA256
9bb8aaa6673ec46e5e9cff88fedefad4b33941b0831f4a7047433a24399e9692

SHA512
ecb7603a5f07a95ce3506ecaf38cb07ee089070cc041ce0c92722cafe8c3545b73dd5bf59f06115291b774d3c034c6e677f6fec2780208fa73e387d7c379cb9f

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\javaws.exe

Filesize
446KB

MD5
19f42aa6335878775e6f623792b5c367

SHA1
cb0e0570690ddefb6cda86230be2cd4224758aa3

SHA256
ce8a6e8de2af68a1d8865a13eb54d6bee403624105c2b1e5c0def4c2225fbe04

SHA512
cc859623cd60344a4fd96505533a6873dcc5f313a6c4dd70c716bafd18f41fbf2d4a3630ccc4f8f4007f99b788af0c562f274c1d4a47faaf1660dc5df030c172

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\msvcp140.dll

Filesize
613KB

MD5
c1b066f9e3e2f3a6785161a8c7e0346a

SHA1
8b3b943e79c40bc81fdac1e038a276d034bbe812

SHA256
99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

SHA512
36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\server\jvm.dll

Filesize
8.2MB

MD5
a5b5e313919826735b73731252a2bc2e

SHA1
090054f0aeeaaac570130ef5a03c26970cdb050c

SHA256
86765f3558ffbb2cf28fb683ee17c288967e636b5cb4fe0422ade39591f6abf4

SHA512
2e0199624f91f9c952ea4fb81a01096febe8dde6fba85f66e7978c98ba749da3cd53cb6d986260e357c19a1d3b5411d6716548ef57e31ec75d55f4d3a3420c3f

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\vcruntime140.dll

Filesize
83KB

MD5
1453290db80241683288f33e6dd5e80e

SHA1
29fb9af50458df43ef40bfc8f0f516d0c0a106fd

SHA256
2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c

SHA512
4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\verify.dll

Filesize
54KB

MD5
c15088054d639475e51b88251369c226

SHA1
8849a9ee53e6bc7d1618103b674a6f481b72f3aa

SHA256
a7e7890ec2e238b3108fe2d9b4796898b2fff30ce07957f60689975d7460098c

SHA512
81ae70caf0304c63adadc3437e592ea9540db59ac7bd7417b769b5702a2aa012bec79aab8ce01187ebbd78555b7824fc4434a113dd9be5b667ce693b293122c4

Download Submit
C:\Program Files\Java\jre1.8.0_361\bin\zip.dll

Filesize
84KB

MD5
7c7a8adce66eeb67a96ca617c8286d72

SHA1
da1f100637f0b94aaea4e3999ef96a32a63bfc2b

SHA256
d15be64cc05ae14db69b5a3558cd57767eda91e708c74d3dccdc4958c42cb5d9

SHA512
00d3c1145b8c8ea246f456000c2fcfe1e978d148ad69ddabdf9e5f332db4e44025211916c6452b5030f8326d523d6e72de8aebd9e41d83afccb8713e88782f31

Download Submit
C:\Program Files\Java\jre1.8.0_361\installer.exe

Filesize
1.1MB

MD5
dcb07febfc873261ae0c351d327027a0

SHA1
b3855001990bb500212f4f8b421594e91f45d5f3

SHA256
e9d0623547dd40d5ccc42e4718d4e307241fcf2d4a5df93d1ec0fdc9925aafac

SHA512
374d8d4d39e344cc050ea0cde3a51db801ba77b18c85934820e6d1f37101922878b4107dc506f5be7ab3e0f2badbf0ace87bb0ab5713f5bdc27df00731f84dff

Download Submit
C:\Program Files\Java\jre1.8.0_361\installer.exe

Filesize
1.1MB

MD5
dcb07febfc873261ae0c351d327027a0

SHA1
b3855001990bb500212f4f8b421594e91f45d5f3

SHA256
e9d0623547dd40d5ccc42e4718d4e307241fcf2d4a5df93d1ec0fdc9925aafac

SHA512
374d8d4d39e344cc050ea0cde3a51db801ba77b18c85934820e6d1f37101922878b4107dc506f5be7ab3e0f2badbf0ace87bb0ab5713f5bdc27df00731f84dff

Download Submit
C:\Program Files\Java\jre1.8.0_361\lib\amd64\jvm.cfg

Filesize
634B

MD5
499f2a4e0a25a41c1ff80df2d073e4fd

SHA1
e2469cbe07e92d817637be4e889ebb74c3c46253

SHA256
80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb

SHA512
7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

Download Submit
C:\Program Files\Java\jre1.8.0_361\lib\charsets.jar

Filesize
2.9MB

MD5
82ade56ed7fa67287198802746ee6045

SHA1
2c5ad0a04bd0fae259cf29af346379284c684d42

SHA256
c89895405e63110d69bb37178f0650bf2a4a489ab9e98da613464c61c475b58c

SHA512
cd3c2180e185d1fce354ede366845668ab165ad0ebf7fd9cd9fbb3723ab64c3515c30e772e1577a747468e530d677c7955b41528d39e6d3c8c988b11604e470d

Download Submit
C:\Program Files\Java\jre1.8.0_361\lib\classlist

Filesize
82KB

MD5
7fc71a62d85ccf12996680a4080aa44e

SHA1
199dccaa94e9129a3649a09f8667b552803e1d0e

SHA256
01fe24232d0dbefe339f88c44a3fd3d99ff0e17ae03926ccf90b835332f5f89c

SHA512
b0b9b486223cf79ccf9346aaf5c1ca0f9588247a00c826aa9f3d366b7e2ef905af4d179787dcb02b32870500fd63899538cf6fafcdd9b573799b255f658ceb1d

Download Submit
C:\Program Files\Java\jre1.8.0_361\lib\jce.jar

Filesize
119KB

MD5
1f4d4fc6b33c30c5782c66b80d92c4f9

SHA1
194df32fb23b470dae4929605d18abd041c743c6

SHA256
81b8de0e148ed3601cf5f1bdf2787c5b15213d842bc537af9ede9635d692b904

SHA512
dfde7e03fc106b785887f2a409b3528c5862663f188c95f6a95c739bdfcc8c6205c03b739de1b259e9a8a0360aa4e10e8d4bce1a57445797a214160b8d98a085

Download Submit
C:\Program Files\Java\jre1.8.0_361\lib\jfr.jar

Filesize
559KB

MD5
18c5aec1e008f781bf74707662920000

SHA1
c29c11cda5b867b68cba1fa7cb331d54a66b3f56

SHA256
e9eab8ec4712142a3ed9ac833d853e144043699c1712986736f3667a9267c11b

SHA512
9988b510d7e036ef41673edd8e38e2f72b695741da3ef63678b808b5e10a76951d016e27cdd23857de0ed0f3b44be8f7fb3a141021b543f104f2a214e53ca74d

Download Submit
C:\Program Files\Java\jre1.8.0_361\lib\jsse.jar

Filesize
1.7MB

MD5
f095a5ac04775e1093d54822460cc5a7

SHA1
2e0f0ec528c41b437126c506a91fe1ad5e699865

SHA256
784b8df88387ee27383d6db4e184b169a21cb4b8bcb0d8395a7b1ac2b128108a

SHA512
c0b5ca94ead3dffd33e19a2d757b2b653867b4f539a143ef17baeef1015c3845aba4f0666ef1d0c7ce02d156ce826b9c324c8159983a71d19d60415d60e25d36

Download Submit
C:\Program Files\Java\jre1.8.0_361\lib\meta-index

Filesize
2KB

MD5
91aa6ea7320140f30379f758d626e59d

SHA1
3be2febe28723b1033ccdaa110eaf59bbd6d1f96

SHA256
4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4

SHA512
03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

Download Submit
C:\Program Files\Java\jre1.8.0_361\lib\resources.jar

Filesize
3.4MB

MD5
0fdcdf2b521c8ffba3fcae32a684358e

SHA1
45a3ae43334b1a0f46d76599d3926c40fa790965

SHA256
2189d10490922562be379da742eedc5e77cac61a6d2a484a3ed4693965dfe290

SHA512
1a1489faa7903bc24d4cc3fbd0ee80e79602a39ea9530f10075a52460e6100c807dbafb17e4b1a7997c23cbe3906808291be7718e6525a79a295e1ddc8ed9eda

Download Submit
C:\Program Files\Java\jre1.8.0_361\lib\rt.jar

Filesize
53.2MB

MD5
f9067274f870f513dee2284e9089d2b9

SHA1
6aab77a3bf6c208adf805432f407dea41833e70f

SHA256
9016dc6f643af8b411d38fb6189f6af0e6bb39210e3ca379c8313f666c94aac1

SHA512
510a34d46b0187f8360373df3e023eda6b98c1187e35b24bf4bd9e5fc3774532e1e96d93ee08bb3b7e130404855a3704918038f5df4a614d4f520ea896df52c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361_x64\jre1.8.0_36164.msi

Filesize
58.7MB

MD5
407d36101348022e67342b44292d2b39

SHA1
1811ab3993672a9f329868622d96014043bd5f4a

SHA256
213e9fa760dfa2af22a4ac94a10c7f21f4b482aa04e8cf3706264e4c17d2481e

SHA512
cd78f2d3d8057467f87c846fd2252cc2632de822b2c5d37a9f2bcd0c68fafe598bdc4bc69760cd7e84037a5b28b3f11a4385684962857e3ce572ec9b302f0c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jds240694031.tmp\jre-8u361-windows-x64.exe

Filesize
61.7MB

MD5
e920cf3e63612868ed4b6cd9612bae77

SHA1
ef64fb46f8e955430d6fbd3778ff03e4c1f0e1b0

SHA256
a45104f8bf9a356b538f74aec9c7d25b92bef2d8e97cc27ed6d7232294a8ed82

SHA512
b02af44d9a87e06b0309e842d550b54b92575ba36a3ea74184bba40d4665751d91c8547ddd9c1c009d413f56829f7fcc604592ba51118c916cd1e039930571b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\jds240694031.tmp\jre-8u361-windows-x64.exe

Filesize
61.7MB

MD5
e920cf3e63612868ed4b6cd9612bae77

SHA1
ef64fb46f8e955430d6fbd3778ff03e4c1f0e1b0

SHA256
a45104f8bf9a356b538f74aec9c7d25b92bef2d8e97cc27ed6d7232294a8ed82

SHA512
b02af44d9a87e06b0309e842d550b54b92575ba36a3ea74184bba40d4665751d91c8547ddd9c1c009d413f56829f7fcc604592ba51118c916cd1e039930571b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
267KB

MD5
65521b6db4d361007bbc0b60375f9bff

SHA1
fc80dd8b7c29d7c9f98f5c005ebe0c093a53bf4b

SHA256
8bb967f376d0f8657d3b1d558273bb3ec00817d5ce139637e44dc95dc89fb681

SHA512
dc841dbb9085bf04ab7bb614261f7c5f300c663bfcc9087bee02d193d4a0326f86d592e5531cfa8ed2fa74b205ce1d944731a5d7b9d3be966542c5eb930cc9fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
293KB

MD5
87610c8e7b7025cedbbb0d062dc2a087

SHA1
e2303a7c7877d47507f5d9dd1bdb7b75f284d4e8

SHA256
ff31cdb0c5fe297eb57426b32ea37637f6bcd8d7f18958089192364cbf928fbb

SHA512
de31a0578902816ef739d6d613cb077c9a9d95b8ef5f07027502e088f34795251374e41deffbe59307befce590dd8d7a4ad59ca1ff150a3b89108676a5125192

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
306KB

MD5
f96ea2f73206275237ab50ad20e9d03d

SHA1
a86a12da3fd17254473870992b00b7125544ba0e

SHA256
7aa352e1c303cdba149f0b7dfa48152d1fecbbb08f3169fe630beb6dde832ba8

SHA512
d39f3e3a0a3ddd7d5307f38fc036cc2fb84ebfd17e2cd7ecc594ed79b58649d74c6ec14da9777c7b3ea2f7be8f0620b6989222a22a8cea0246132a268d394433

Download Submit
C:\Users\Admin\Downloads\jre-8u361-windows-x64.exe

Filesize
62.1MB

MD5
e70de386ebc763932a181fc37a2ad042

SHA1
18e76e452b289ae2fc167667b55a81b11ec2693f

SHA256
419328f3a2325b1dc27f710abd73e232e9deac47915b4dba61a697b925b5b83d

SHA512
a45cb9c665a867042d0d52f085d095ac774c3f9b10febd858b26d2c899f7c2b5024586156ec572be384b226a8efc44d6757bbbc920843ce58119345bea155a0d

Download Submit
C:\Users\Admin\Downloads\jre-8u361-windows-x64.exe

Filesize
62.1MB

MD5
e70de386ebc763932a181fc37a2ad042

SHA1
18e76e452b289ae2fc167667b55a81b11ec2693f

SHA256
419328f3a2325b1dc27f710abd73e232e9deac47915b4dba61a697b925b5b83d

SHA512
a45cb9c665a867042d0d52f085d095ac774c3f9b10febd858b26d2c899f7c2b5024586156ec572be384b226a8efc44d6757bbbc920843ce58119345bea155a0d

Download Submit
C:\Windows\Installer\MSI54AE.tmp

Filesize
759KB

MD5
216acbc40fb42eb247260a1feb124114

SHA1
3f16a8479e9e467a200c9fc6d98ffe56cfa642ec

SHA256
bbad98c96204a8f8b09457779a5da5cc3563de73925f0535e37b3f5e73fdc2a9

SHA512
001cf5470656cce65205074fda01528e066226b135b8e8bcb0e5dd13ca64e8bb70b45ee8e99ec2d8139157d40355a1cba353022c8a69bc3f9fa9af18304448e5

Download Submit
C:\Windows\Installer\MSI58D5.tmp

Filesize
759KB

MD5
216acbc40fb42eb247260a1feb124114

SHA1
3f16a8479e9e467a200c9fc6d98ffe56cfa642ec

SHA256
bbad98c96204a8f8b09457779a5da5cc3563de73925f0535e37b3f5e73fdc2a9

SHA512
001cf5470656cce65205074fda01528e066226b135b8e8bcb0e5dd13ca64e8bb70b45ee8e99ec2d8139157d40355a1cba353022c8a69bc3f9fa9af18304448e5

Download Submit
C:\Windows\Installer\MSI71ED.tmp

Filesize
759KB

MD5
216acbc40fb42eb247260a1feb124114

SHA1
3f16a8479e9e467a200c9fc6d98ffe56cfa642ec

SHA256
bbad98c96204a8f8b09457779a5da5cc3563de73925f0535e37b3f5e73fdc2a9

SHA512
001cf5470656cce65205074fda01528e066226b135b8e8bcb0e5dd13ca64e8bb70b45ee8e99ec2d8139157d40355a1cba353022c8a69bc3f9fa9af18304448e5

Download Submit
C:\Windows\Installer\e594afc.msi

Filesize
58.7MB

MD5
407d36101348022e67342b44292d2b39

SHA1
1811ab3993672a9f329868622d96014043bd5f4a

SHA256
213e9fa760dfa2af22a4ac94a10c7f21f4b482aa04e8cf3706264e4c17d2481e

SHA512
cd78f2d3d8057467f87c846fd2252cc2632de822b2c5d37a9f2bcd0c68fafe598bdc4bc69760cd7e84037a5b28b3f11a4385684962857e3ce572ec9b302f0c0c

Download Submit
\??\pipe\chrome.1312.10.104078097

Filesize
460B

MD5
bed9bad8574c579d6c51e3655e71dd77

SHA1
ef60ddfa004d941f57d8e835a6bbd87f7dcd7263

SHA256
88ea812fa2f06cd4e8a819a57341fdaffef905b84f6cc36bae460bc5672ae982

SHA512
dc7d784debab9b23d6d95530fb09a70a96b1c8ac40bcb07b5b25050ef29c5ccfc9bd556876156f68e7741f807bfba0841aace48decdb20588d08fb241fa3f43e

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-debug-l1-1-0.dll

Filesize
11KB

MD5
b0e0678ddc403effc7cdc69ae6d641fb

SHA1
c1a4ce4ded47740d3518cd1ff9e9ce277d959335

SHA256
45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1

SHA512
2badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
11KB

MD5
94788729c9e7b9c888f4e323a27ab548

SHA1
b0ba0c4cf1d8b2b94532aa1880310f28e87756ec

SHA256
accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187

SHA512
ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
11KB

MD5
94788729c9e7b9c888f4e323a27ab548

SHA1
b0ba0c4cf1d8b2b94532aa1880310f28e87756ec

SHA256
accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187

SHA512
ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-heap-l1-1-0.dll

Filesize
11KB

MD5
3a4b6b36470bad66621542f6d0d153ab

SHA1
5005454ba8e13bac64189c7a8416ecc1e3834dc6

SHA256
2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af

SHA512
84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-heap-l1-1-0.dll

Filesize
11KB

MD5
3a4b6b36470bad66621542f6d0d153ab

SHA1
5005454ba8e13bac64189c7a8416ecc1e3834dc6

SHA256
2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af

SHA512
84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
12KB

MD5
d75144fcb3897425a855a270331e38c9

SHA1
132c9ade61d574aa318e835eb78c4cccddefdea2

SHA256
08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f

SHA512
295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
12KB

MD5
d75144fcb3897425a855a270331e38c9

SHA1
132c9ade61d574aa318e835eb78c4cccddefdea2

SHA256
08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f

SHA512
295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
13KB

MD5
e173f3ab46096482c4361378f6dcb261

SHA1
7922932d87d3e32ce708f071c02fb86d33562530

SHA256
c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14

SHA512
3aafefd8a9d7b0c869d0c49e0c23086115fd550b7dc5c75a5b8a8620ad37f36a4c24d2bf269043d81a7448c351ff56cb518ec4e151960d4f6bd655c38aff547f

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
13KB

MD5
e173f3ab46096482c4361378f6dcb261

SHA1
7922932d87d3e32ce708f071c02fb86d33562530

SHA256
c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14

SHA512
3aafefd8a9d7b0c869d0c49e0c23086115fd550b7dc5c75a5b8a8620ad37f36a4c24d2bf269043d81a7448c351ff56cb518ec4e151960d4f6bd655c38aff547f

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-synch-l1-1-0.dll

Filesize
13KB

MD5
6c3fcd71a6a1a39eab3e5c2fd72172cd

SHA1
15b55097e54028d1466e46febca1dbb8dbefea4f

SHA256
a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26

SHA512
ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f

Download Submit
\Program Files\Java\jre1.8.0_361\bin\api-ms-win-core-synch-l1-1-0.dll

Filesize
13KB

MD5
6c3fcd71a6a1a39eab3e5c2fd72172cd

SHA1
15b55097e54028d1466e46febca1dbb8dbefea4f

SHA256
a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26

SHA512
ef1c14965e5974754cc6a9b94a4fa5107e89966cb2e584ce71bbbdd2d9dc0c0536ccc9d488c06fa828d3627206e7d9cc8065c45c6fb0c9121962ccbecb063d4f

Download Submit
\Program Files\Java\jre1.8.0_361\bin\java.dll

Filesize
163KB

MD5
db081a9968bb0c37a57725cdb66a0c7b

SHA1
d5fed172d82111d1f3bcb46ab3bd8b412f3ee003

SHA256
5b9b01f1ec06ad559285201cf0907e1c31473f6fb91aa09813dd8f076f94afe3

SHA512
8a3717be2bdc1d2e628a069a61ac5b504467c52c7b52496c14050cd0fbc3e1023c791ca8b5c3270579e1cc725a8a0cff62c427dc1c25c2ec74725d1dacc621d5

Download Submit
\Program Files\Java\jre1.8.0_361\bin\msvcp140.dll

Filesize
613KB

MD5
c1b066f9e3e2f3a6785161a8c7e0346a

SHA1
8b3b943e79c40bc81fdac1e038a276d034bbe812

SHA256
99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

SHA512
36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

Download Submit
\Program Files\Java\jre1.8.0_361\bin\server\jvm.dll

Filesize
8.2MB

MD5
a5b5e313919826735b73731252a2bc2e

SHA1
090054f0aeeaaac570130ef5a03c26970cdb050c

SHA256
86765f3558ffbb2cf28fb683ee17c288967e636b5cb4fe0422ade39591f6abf4

SHA512
2e0199624f91f9c952ea4fb81a01096febe8dde6fba85f66e7978c98ba749da3cd53cb6d986260e357c19a1d3b5411d6716548ef57e31ec75d55f4d3a3420c3f

Download Submit
\Program Files\Java\jre1.8.0_361\bin\vcruntime140.dll

Filesize
83KB

MD5
1453290db80241683288f33e6dd5e80e

SHA1
29fb9af50458df43ef40bfc8f0f516d0c0a106fd

SHA256
2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c

SHA512
4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91

Download Submit
\Program Files\Java\jre1.8.0_361\bin\verify.dll

Filesize
54KB

MD5
c15088054d639475e51b88251369c226

SHA1
8849a9ee53e6bc7d1618103b674a6f481b72f3aa

SHA256
a7e7890ec2e238b3108fe2d9b4796898b2fff30ce07957f60689975d7460098c

SHA512
81ae70caf0304c63adadc3437e592ea9540db59ac7bd7417b769b5702a2aa012bec79aab8ce01187ebbd78555b7824fc4434a113dd9be5b667ce693b293122c4

Download Submit
\Program Files\Java\jre1.8.0_361\bin\zip.dll

Filesize
84KB

MD5
7c7a8adce66eeb67a96ca617c8286d72

SHA1
da1f100637f0b94aaea4e3999ef96a32a63bfc2b

SHA256
d15be64cc05ae14db69b5a3558cd57767eda91e708c74d3dccdc4958c42cb5d9

SHA512
00d3c1145b8c8ea246f456000c2fcfe1e978d148ad69ddabdf9e5f332db4e44025211916c6452b5030f8326d523d6e72de8aebd9e41d83afccb8713e88782f31

Download Submit
\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4279730420050.dll

Filesize
9KB

MD5
697d496ac9f5aaab8ae025322358c61e

SHA1
2043eac8cdcc2e24b854af1eacd77a5f2a395a27

SHA256
a7273a4cf48ab3413f2c186cc95a3367a73ce99f8d45329383219d4cc27003aa

SHA512
b6702cd49a3af9f97f697565136f140692af9f8b271e672f2e91c920a23212b778583786f2377078117113647926338614a92c4a2423318b7a21ba2fe3a89838

Download Submit
\Windows\Installer\MSI54AE.tmp

Filesize
759KB

MD5
216acbc40fb42eb247260a1feb124114

SHA1
3f16a8479e9e467a200c9fc6d98ffe56cfa642ec

SHA256
bbad98c96204a8f8b09457779a5da5cc3563de73925f0535e37b3f5e73fdc2a9

SHA512
001cf5470656cce65205074fda01528e066226b135b8e8bcb0e5dd13ca64e8bb70b45ee8e99ec2d8139157d40355a1cba353022c8a69bc3f9fa9af18304448e5

Download Submit
\Windows\Installer\MSI58D5.tmp

Filesize
759KB

MD5
216acbc40fb42eb247260a1feb124114

SHA1
3f16a8479e9e467a200c9fc6d98ffe56cfa642ec

SHA256
bbad98c96204a8f8b09457779a5da5cc3563de73925f0535e37b3f5e73fdc2a9

SHA512
001cf5470656cce65205074fda01528e066226b135b8e8bcb0e5dd13ca64e8bb70b45ee8e99ec2d8139157d40355a1cba353022c8a69bc3f9fa9af18304448e5

Download Submit
\Windows\Installer\MSI71ED.tmp

Filesize
759KB

MD5
216acbc40fb42eb247260a1feb124114

SHA1
3f16a8479e9e467a200c9fc6d98ffe56cfa642ec

SHA256
bbad98c96204a8f8b09457779a5da5cc3563de73925f0535e37b3f5e73fdc2a9

SHA512
001cf5470656cce65205074fda01528e066226b135b8e8bcb0e5dd13ca64e8bb70b45ee8e99ec2d8139157d40355a1cba353022c8a69bc3f9fa9af18304448e5

Download Submit
memory/440-286-0x000002610FE20000-0x0000026110E20000-memory.dmp

Filesize
16.0MB

Download
memory/440-302-0x000002610FE20000-0x0000026110E20000-memory.dmp

Filesize
16.0MB

Download
memory/440-303-0x000002610FE20000-0x0000026110E20000-memory.dmp

Filesize
16.0MB

Download
memory/2152-139-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-134-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-155-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-154-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-153-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-152-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-125-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-151-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-157-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-158-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-120-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-126-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-150-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-127-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-149-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-148-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-147-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-146-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-145-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-144-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-143-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-121-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-142-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-141-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-122-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-140-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-128-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-138-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-137-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-136-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-135-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-124-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-156-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-123-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-133-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-131-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-132-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-130-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/2152-129-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-374-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-359-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-368-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-375-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-370-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-373-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-376-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-372-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-371-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-367-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-366-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-365-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-364-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-363-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-362-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-369-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-361-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-346-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-347-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-348-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-350-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-360-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-355-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-357-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3472-358-0x00000000778C0000-0x0000000077A4E000-memory.dmp

Filesize
1.6MB

Download
memory/3760-199-0x0000000002790000-0x0000000003790000-memory.dmp

Filesize
16.0MB

Download
memory/3760-164-0x0000000002790000-0x0000000003790000-memory.dmp

Filesize
16.0MB

Download
memory/3760-179-0x0000000002790000-0x0000000003790000-memory.dmp

Filesize
16.0MB

Download
memory/3760-187-0x0000000002790000-0x0000000003790000-memory.dmp

Filesize
16.0MB

Download
memory/3760-194-0x0000000002790000-0x0000000003790000-memory.dmp

Filesize
16.0MB

Download
memory/3760-198-0x0000000002790000-0x0000000003790000-memory.dmp

Filesize
16.0MB

Download
memory/3956-401-0x00000210AB0F0000-0x00000210AC0F0000-memory.dmp

Filesize
16.0MB

Download
memory/4460-432-0x0000021B4B2F0000-0x0000021B4C2F0000-memory.dmp

Filesize
16.0MB

Download
memory/4460-412-0x0000021B4B2F0000-0x0000021B4C2F0000-memory.dmp

Filesize
16.0MB

Download
memory/4460-436-0x0000021B4B2F0000-0x0000021B4C2F0000-memory.dmp

Filesize
16.0MB

Download
memory/4460-435-0x0000021B4B2F0000-0x0000021B4C2F0000-memory.dmp

Filesize
16.0MB

Download
memory/4460-434-0x0000021B4B2F0000-0x0000021B4C2F0000-memory.dmp

Filesize
16.0MB

Download
memory/4460-433-0x0000021B4B2F0000-0x0000021B4C2F0000-memory.dmp

Filesize
16.0MB

Download
memory/4460-428-0x0000021B4B2F0000-0x0000021B4C2F0000-memory.dmp

Filesize
16.0MB

Download
memory/4608-335-0x000002005C740000-0x000002005D740000-memory.dmp

Filesize
16.0MB

Download
memory/4608-337-0x000002005C740000-0x000002005D740000-memory.dmp

Filesize
16.0MB

Download
memory/4608-336-0x000002005C740000-0x000002005D740000-memory.dmp

Filesize
16.0MB

Download
memory/4608-341-0x000002005C740000-0x000002005D740000-memory.dmp

Filesize
16.0MB

Download
memory/4608-313-0x000002005C740000-0x000002005D740000-memory.dmp

Filesize
16.0MB

Download
memory/4872-253-0x000001EC00000000-0x000001EC01000000-memory.dmp

Filesize
16.0MB

Download
memory/5036-354-0x000002A23B100000-0x000002A23C100000-memory.dmp

Filesize
16.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads