bazarbackdoor | 845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac

Analysis

max time kernel
685s
max time network
680s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-04-2023 20:45

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

TLauncher-2.879-Installer-1.1.0.exe
Size

22.6MB
MD5

601b94e3b018e39e0da90881fe89156d
SHA1

dc5340d6e1cb98c6ae2fa6882a4c7284e990705b
SHA256

845b0953c143daf9382b38c8ac7faeef62d5298bb0191f1be60865f78a942bac
SHA512

493c283aa3e201501843e59d593d82b3c98d2628639c95c977c9f22c268d89f7b072907d7b5d244fb7f122348277a97f7d68ce0ebdb36d7fc479c5f3c5bd33db
SSDEEP

393216:+Xj4yibrRbGPfs/dQETVlOBbpFEjdGphRqV56Hpkf+V4scTKAjENq+:+zCrRsHExi73qqHpg+Vvc+AmX

Score

10^/10

bazarbackdoor adware backdoor discovery persistence stealer upx

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\jre-windows.exe	BazarBackdoorVar3
C:\Windows\Installer\6e5c25.msi	BazarBackdoorVar3

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

103 1684 msiexec.exe
Downloads MZ/PE file

flow	pid	process
103	1684	msiexec.exe

Executes dropped EXE 25 IoCs

Processes:

irsetup.exeBrowserInstaller.exeirsetup.exejre-windows.exejre-windows.exeinstaller.exebspatch.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exejavaw.exessvagent.exejavaws.exejp2launcher.exejavaws.exejp2launcher.exeMSI3D40.tmpjavaw.exejavaw.exeTLauncher.exejavaw.exe

pid	process
316	irsetup.exe
1152	BrowserInstaller.exe
1064	irsetup.exe
1920	jre-windows.exe
1064	jre-windows.exe
864	installer.exe
2204	bspatch.exe
2440	unpack200.exe
2480	unpack200.exe
2524	unpack200.exe
2564	unpack200.exe
2608	unpack200.exe
2648	unpack200.exe
2688	unpack200.exe
2728	javaw.exe
2496	ssvagent.exe
2232	javaws.exe
2568	jp2launcher.exe
2080	javaws.exe
2064	jp2launcher.exe
1396	MSI3D40.tmp
796	javaw.exe
2976	javaw.exe
2420	TLauncher.exe
2068	javaw.exe

Loads dropped DLL 64 IoCs

Processes:

TLauncher-2.879-Installer-1.1.0.exeirsetup.exeBrowserInstaller.exeirsetup.exejre-windows.exeMsiExec.exemsiexec.exebspatch.exeinstaller.exeunpack200.exeunpack200.exe

pid	process
1216	TLauncher-2.879-Installer-1.1.0.exe
1216	TLauncher-2.879-Installer-1.1.0.exe
1216	TLauncher-2.879-Installer-1.1.0.exe
1216	TLauncher-2.879-Installer-1.1.0.exe
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
1152	BrowserInstaller.exe
1152	BrowserInstaller.exe
1152	BrowserInstaller.exe
1152	BrowserInstaller.exe
1064	irsetup.exe
1064	irsetup.exe
1064	irsetup.exe
316	irsetup.exe
1920	jre-windows.exe
1220
1220
1564	MsiExec.exe
1564	MsiExec.exe
1564	MsiExec.exe
1684	msiexec.exe
2204	bspatch.exe
2204	bspatch.exe
2204	bspatch.exe
864	installer.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2440	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe
2480	unpack200.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2432 icacls.exe

pid	process
2432	icacls.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

rundll32.exeinstaller.exessvagent.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0279-ABCDEFFEDCBA}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0110-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0113-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0318-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0272-ABCDEFFEDCBA}\InprocServer32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0273-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0124-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0116-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0138-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0080-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0238-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0000-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0098-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0155-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0086-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0042-ABCDEFFEDCBC}\InprocServer32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0081-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0220-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0164-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0197-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0018-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0095-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0060-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0018-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0270-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBB}\InprocServer32	ssvagent.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0269-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0091-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0074-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0052-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0066-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0243-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0301-ABCDEFFEDCBB}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0167-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0144-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0174-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0279-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0054-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\INPROCSERVER32	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0233-ABCDEFFEDCBC}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0109-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0226-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0085-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0281-ABCDEFFEDCBC}\InprocServer32	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0069-ABCDEFFEDCBB}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0305-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0094-ABCDEFFEDCBB}\InprocServer32	ssvagent.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0038-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0122-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0061-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBC}\InprocServer32	rundll32.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/316-73-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/316-367-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/316-389-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/316-390-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/316-421-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe	upx
behavioral1/memory/316-502-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/1064-503-0x0000000000F90000-0x0000000001378000-memory.dmp	upx
behavioral1/memory/316-983-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/316-1465-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/316-2667-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/316-2717-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/316-2731-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/2204-3075-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2204-3079-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2204-3081-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/316-3639-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx
behavioral1/memory/316-4603-0x0000000000E10000-0x00000000011F8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 12 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

installer.exerundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	installer.exe

Drops file in System32 directory 6 IoCs

Processes:

rundll32.exeinstaller.exe

description	ioc	process
File opened for modification	C:\Windows\system32\javaws.exe	rundll32.exe
File created	C:\Windows\system32\java.exe	rundll32.exe
File created	C:\Windows\system32\javaw.exe	rundll32.exe
File created	C:\Windows\system32\WindowsAccessBridge-64.dll	rundll32.exe
File opened for modification	C:\Windows\system32\REN6F39.tmp	rundll32.exe
File created	C:\Windows\system32\WindowsAccessBridge-64.dll	installer.exe

Drops file in Program Files directory 64 IoCs

Processes:

installer.exemsiexec.exe

description	ioc	process
File created	C:\Program Files\Java\jre1.8.0_351\lib\tzdb.dat	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\management\jmxremote.access	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Lima	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\classlist	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Regina	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages_pt_BR.properties	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javafx-font.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2native.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\jdk\xalan.md	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\ext\zipfs.jar	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Bahia	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\management\jmxremote.access	installer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-private-l1-1-0.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\images\cursors\cursors.properties	installer.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Panama	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\COPYRIGHT	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\ext\localedata.pack	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Halifax	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\msvcp140_2.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\fonts\LucidaSansRegular.ttf	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Recife	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\accessibility.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\deploy\splash_11-lic.gif	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Macau	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\Xusage.txt	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\t2k.dll	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\jdk\asm.md	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\cacerts	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\splash.gif	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\fonts\LucidaTypewriterRegular.ttf	installer.exe
File opened for modification	C:\Program Files\Java\jre7\bin\zip.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\deploy.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\lib\security\policy\limited\US_export_policy.jar	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\jdk\freebxml.md	installer.exe
File created	C:\Program Files\Java\jre1.8.0_351\legal\jdk\jcup.md	installer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Qatar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java_crw_demo.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\verify.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_351\bin\awt.dll	installer.exe

Drops file in Windows directory 26 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI228C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6e5c2b.ipi	msiexec.exe
File created	C:\Windows\Installer\6e5e70.msi	msiexec.exe
File created	C:\Windows\Installer\6e5e72.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B5B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI640A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI634D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE137.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DFC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6e5c25.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI61E5.tmp	msiexec.exe
File created	C:\Windows\Installer\6e5c27.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\6e5c2b.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D40.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6e5e70.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C28.tmp	msiexec.exe
File created	C:\Windows\Installer\6e5c25.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6e5e72.ipi	msiexec.exe
File created	C:\Windows\Installer\6e5c29.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6e5c27.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI229D.tmp	msiexec.exe
File created	C:\Windows\Installer\6e5e74.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI636D.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

rundll32.exeiexplore.exeIEXPLORE.EXEinstaller.exejre-windows.exeirsetup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_351\\bin"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	jre-windows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FAC7E21-DA4D-11ED-9047-D2C9D0B8F522} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\ = "11"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\ = "74"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_351\\bin"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	irsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_351\\bin"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4B5F-9EE6-34795C46E7E7}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\tlauncher.org\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\Total = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "11"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "74"	IEXPLORE.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "51"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = e304000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\tlauncher.org	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7044f3095a6ed901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000a622dd5de9437fbff4ffdaeeb9164001bd159590a6dc6cdefb0eb2e46bf05dbb000000000e80000000020000200000002b11cd3d453fc065ad40e1fd01f61818700e353fd3bf4948b9c7dc82fb223fe9900000007854feafd4e21c1ee3d035e7979908a81d35d0cc4bb419e884489f1b304f8375c312698485973a3c0ad2894d037b0de77ef439dd23181d4520d2f0e6902550fea926339ed3c8617a1cf9dc391deafe27f691307a59b297a0a71d7f8f3e6f5968ec80f6b61f4ccd1e474a0858251036560caf473d859d7a700dc000132c377c6e9557650a6855c01e28d6aa8e26363caf40000000ae269592651d06ef997cef9722fc1602858a5d9730fdbb1afc90486f6df42569a56ba9283005e148aef2e4737d003bbb40cadfda6dcf50d1a30b594f949c29d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a0000000002000000000010660000000100002000000053238c519e6ec3bf6f8f19c3e44e3f869fa1857b826aaebceb5a8dada6425bf9000000000e80000000020000200000002faccbca65de92083c520d83d47262e51ffd5c7deefba231900e5eee16ede3eb20000000e7b809df9c0cc7220f3142d6da577498b3bab3f1cea859686a2f9d8f2eaf044a400000004a067e9507c964f1f2b67048fd4c86bd0a10468190fcd78b8a5dd85a888338aa2503a4797f962fc72c40c5e58200c0e49ad617637895876eaa2c06c5cccedeff	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\Total = "11"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

installer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0009-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_09"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0030-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_30"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0089-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0167-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_167"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0055-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0203-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0296-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0206-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0096-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0166-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0069-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0162-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0155-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0136-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0232-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0297-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0080-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0195-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0020-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0251-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0278-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0074-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0173-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0221-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0201-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_67"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0046-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0137-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_137"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0187-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0054-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0093-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_93"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0121-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_121"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0131-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0244-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0184-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_184"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0224-ABCDEFFEDCBC}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0026-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_26"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0041-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_41"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0070-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0087-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0169-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0142-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0220-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0271-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_271"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0083-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0054-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_54"	installer.exe

Modifies registry class 64 IoCs

Processes:

rundll32.exemsiexec.exeinstaller.exessvagent.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0359-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF260140708FF\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0179-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_26"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0262-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0243-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0258-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0307-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\INPROCSERVER32	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0348-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_78"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0000-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0328-ABCDEFFEDCBB}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0094-ABCDEFFEDCBB}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0246-ABCDEFFEDCBB}	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0327-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0104-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0200-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_200"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0218-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0272-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_272"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0081-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0149-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0155-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBA}\InprocServer32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0180-ABCDEFFEDCBA}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0183-ABCDEFFEDCBC}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0218-ABCDEFFEDCBA}\InprocServer32	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0053-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_53"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0091-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_91"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0098-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_98"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0046-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0074-ABCDEFFEDCBB}\INPROCSERVER32	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0090-ABCDEFFEDCBA}	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0318-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0079-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0265-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0280-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0246-ABCDEFFEDCBC}	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0265-ABCDEFFEDCBA}	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0169-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBA}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0152-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0092-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_92"	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0169-ABCDEFFEDCBC}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0184-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0340-ABCDEFFEDCBA}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0221-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_221"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0186-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0133-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0217-ABCDEFFEDCBA}	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0346-ABCDEFFEDCBB}\InprocServer32	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0309-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_309"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0218-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0155-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0123-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0212-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_212"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0316-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_316"	ssvagent.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

irsetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	irsetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	irsetup.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

Processes:

javaws.exejp2launcher.exejavaws.exejp2launcher.exeMSI3D40.tmpmsiexec.exetaskmgr.exe

pid	process
2232	javaws.exe
2568	jp2launcher.exe
2080	javaws.exe
2064	jp2launcher.exe
1396	MSI3D40.tmp
1684	msiexec.exe
1684	msiexec.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

jre-windows.exetaskmgr.exe

pid process

1064 jre-windows.exe
2976 taskmgr.exe

pid	process
1064	jre-windows.exe
2976	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

jre-windows.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1064	jre-windows.exe
Token: SeIncreaseQuotaPrivilege	1064	jre-windows.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeSecurityPrivilege	1684	msiexec.exe
Token: SeCreateTokenPrivilege	1064	jre-windows.exe
Token: SeAssignPrimaryTokenPrivilege	1064	jre-windows.exe
Token: SeLockMemoryPrivilege	1064	jre-windows.exe
Token: SeIncreaseQuotaPrivilege	1064	jre-windows.exe
Token: SeMachineAccountPrivilege	1064	jre-windows.exe
Token: SeTcbPrivilege	1064	jre-windows.exe
Token: SeSecurityPrivilege	1064	jre-windows.exe
Token: SeTakeOwnershipPrivilege	1064	jre-windows.exe
Token: SeLoadDriverPrivilege	1064	jre-windows.exe
Token: SeSystemProfilePrivilege	1064	jre-windows.exe
Token: SeSystemtimePrivilege	1064	jre-windows.exe
Token: SeProfSingleProcessPrivilege	1064	jre-windows.exe
Token: SeIncBasePriorityPrivilege	1064	jre-windows.exe
Token: SeCreatePagefilePrivilege	1064	jre-windows.exe
Token: SeCreatePermanentPrivilege	1064	jre-windows.exe
Token: SeBackupPrivilege	1064	jre-windows.exe
Token: SeRestorePrivilege	1064	jre-windows.exe
Token: SeShutdownPrivilege	1064	jre-windows.exe
Token: SeDebugPrivilege	1064	jre-windows.exe
Token: SeAuditPrivilege	1064	jre-windows.exe
Token: SeSystemEnvironmentPrivilege	1064	jre-windows.exe
Token: SeChangeNotifyPrivilege	1064	jre-windows.exe
Token: SeRemoteShutdownPrivilege	1064	jre-windows.exe
Token: SeUndockPrivilege	1064	jre-windows.exe
Token: SeSyncAgentPrivilege	1064	jre-windows.exe
Token: SeEnableDelegationPrivilege	1064	jre-windows.exe
Token: SeManageVolumePrivilege	1064	jre-windows.exe
Token: SeImpersonatePrivilege	1064	jre-windows.exe
Token: SeCreateGlobalPrivilege	1064	jre-windows.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe
Token: SeRestorePrivilege	1684	msiexec.exe
Token: SeTakeOwnershipPrivilege	1684	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exetaskmgr.exe

pid	process
1604	iexplore.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe
2976	taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

irsetup.exeirsetup.exeiexplore.exeIEXPLORE.EXEjre-windows.exejp2launcher.exejp2launcher.exe

pid	process
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
316	irsetup.exe
1064	irsetup.exe
1064	irsetup.exe
1604	iexplore.exe
1604	iexplore.exe
1328	IEXPLORE.EXE
1328	IEXPLORE.EXE
1328	IEXPLORE.EXE
1328	IEXPLORE.EXE
1064	jre-windows.exe
1064	jre-windows.exe
1064	jre-windows.exe
1064	jre-windows.exe
2568	jp2launcher.exe
2064	jp2launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TLauncher-2.879-Installer-1.1.0.exeirsetup.exeBrowserInstaller.exeiexplore.exejre-windows.exemsiexec.exeinstaller.exe

description	pid	process	target process
PID 1216 wrote to memory of 316	1216	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 1216 wrote to memory of 316	1216	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 1216 wrote to memory of 316	1216	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 1216 wrote to memory of 316	1216	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 1216 wrote to memory of 316	1216	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 1216 wrote to memory of 316	1216	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 1216 wrote to memory of 316	1216	TLauncher-2.879-Installer-1.1.0.exe	irsetup.exe
PID 316 wrote to memory of 1152	316	irsetup.exe	BrowserInstaller.exe
PID 316 wrote to memory of 1152	316	irsetup.exe	BrowserInstaller.exe
PID 316 wrote to memory of 1152	316	irsetup.exe	BrowserInstaller.exe
PID 316 wrote to memory of 1152	316	irsetup.exe	BrowserInstaller.exe
PID 316 wrote to memory of 1152	316	irsetup.exe	BrowserInstaller.exe
PID 316 wrote to memory of 1152	316	irsetup.exe	BrowserInstaller.exe
PID 316 wrote to memory of 1152	316	irsetup.exe	BrowserInstaller.exe
PID 1152 wrote to memory of 1064	1152	BrowserInstaller.exe	irsetup.exe
PID 1152 wrote to memory of 1064	1152	BrowserInstaller.exe	irsetup.exe
PID 1152 wrote to memory of 1064	1152	BrowserInstaller.exe	irsetup.exe
PID 1152 wrote to memory of 1064	1152	BrowserInstaller.exe	irsetup.exe
PID 1152 wrote to memory of 1064	1152	BrowserInstaller.exe	irsetup.exe
PID 1152 wrote to memory of 1064	1152	BrowserInstaller.exe	irsetup.exe
PID 1152 wrote to memory of 1064	1152	BrowserInstaller.exe	irsetup.exe
PID 316 wrote to memory of 1604	316	irsetup.exe	iexplore.exe
PID 316 wrote to memory of 1604	316	irsetup.exe	iexplore.exe
PID 316 wrote to memory of 1604	316	irsetup.exe	iexplore.exe
PID 316 wrote to memory of 1604	316	irsetup.exe	iexplore.exe
PID 1604 wrote to memory of 1328	1604	iexplore.exe	IEXPLORE.EXE
PID 1604 wrote to memory of 1328	1604	iexplore.exe	IEXPLORE.EXE
PID 1604 wrote to memory of 1328	1604	iexplore.exe	IEXPLORE.EXE
PID 1604 wrote to memory of 1328	1604	iexplore.exe	IEXPLORE.EXE
PID 1604 wrote to memory of 1328	1604	iexplore.exe	IEXPLORE.EXE
PID 1604 wrote to memory of 1328	1604	iexplore.exe	IEXPLORE.EXE
PID 1604 wrote to memory of 1328	1604	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1920	316	irsetup.exe	jre-windows.exe
PID 316 wrote to memory of 1920	316	irsetup.exe	jre-windows.exe
PID 316 wrote to memory of 1920	316	irsetup.exe	jre-windows.exe
PID 316 wrote to memory of 1920	316	irsetup.exe	jre-windows.exe
PID 1920 wrote to memory of 1064	1920	jre-windows.exe	jre-windows.exe
PID 1920 wrote to memory of 1064	1920	jre-windows.exe	jre-windows.exe
PID 1920 wrote to memory of 1064	1920	jre-windows.exe	jre-windows.exe
PID 1684 wrote to memory of 1564	1684	msiexec.exe	MsiExec.exe
PID 1684 wrote to memory of 1564	1684	msiexec.exe	MsiExec.exe
PID 1684 wrote to memory of 1564	1684	msiexec.exe	MsiExec.exe
PID 1684 wrote to memory of 1564	1684	msiexec.exe	MsiExec.exe
PID 1684 wrote to memory of 1564	1684	msiexec.exe	MsiExec.exe
PID 1684 wrote to memory of 864	1684	msiexec.exe	installer.exe
PID 1684 wrote to memory of 864	1684	msiexec.exe	installer.exe
PID 1684 wrote to memory of 864	1684	msiexec.exe	installer.exe
PID 864 wrote to memory of 2204	864	installer.exe	bspatch.exe
PID 864 wrote to memory of 2204	864	installer.exe	bspatch.exe
PID 864 wrote to memory of 2204	864	installer.exe	bspatch.exe
PID 864 wrote to memory of 2204	864	installer.exe	bspatch.exe
PID 864 wrote to memory of 2204	864	installer.exe	bspatch.exe
PID 864 wrote to memory of 2204	864	installer.exe	bspatch.exe
PID 864 wrote to memory of 2204	864	installer.exe	bspatch.exe
PID 864 wrote to memory of 2440	864	installer.exe	unpack200.exe
PID 864 wrote to memory of 2440	864	installer.exe	unpack200.exe
PID 864 wrote to memory of 2440	864	installer.exe	unpack200.exe
PID 864 wrote to memory of 2480	864	installer.exe	unpack200.exe
PID 864 wrote to memory of 2480	864	installer.exe	unpack200.exe
PID 864 wrote to memory of 2480	864	installer.exe	unpack200.exe
PID 864 wrote to memory of 2524	864	installer.exe	unpack200.exe
PID 864 wrote to memory of 2524	864	installer.exe	unpack200.exe
PID 864 wrote to memory of 2524	864	installer.exe	unpack200.exe
PID 864 wrote to memory of 2564	864	installer.exe	unpack200.exe

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1216

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.1.0.exe" "__IRCT:3" "__IRTSS:23652861" "__IRSID:S-1-5-21-3948302646-268491222-1934009652-1000"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-3948302646-268491222-1934009652-1000"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1064

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://ad.tlauncher.org/link/hight-gpu-settings-en
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1604 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1328

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\jds7217682.tmp\jre-windows.exe
"C:\Users\Admin\AppData\Local\Temp\jds7217682.tmp\jre-windows.exe" "STATIC=1"
4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1064

C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
-Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_351\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
5⤵
- Executes dropped EXE
PID:796

C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
-Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_351\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
5⤵
- Executes dropped EXE
PID:2976

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
3⤵
- Executes dropped EXE
PID:2420

C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
4⤵
- Executes dropped EXE
PID:2068

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
5⤵
- Modifies file permissions
PID:2432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 467629F824C05E542751858EFC38BA6A
2⤵
- Loads dropped DLL
PID:1564

C:\Program Files\Java\jre1.8.0_351\installer.exe
"C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:864

C:\ProgramData\Oracle\Java\installcache_x64\7237135.tmp\bspatch.exe
"bspatch.exe" baseimagefam8 newimage diff
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204

C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_351\lib/plugin.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440

C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_351\lib/javaws.jar"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480

C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_351\lib/deploy.jar"
3⤵
- Executes dropped EXE
PID:2524

C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_351\lib/rt.jar"
3⤵
- Executes dropped EXE
PID:2564

C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_351\lib/jsse.jar"
3⤵
- Executes dropped EXE
PID:2608

C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_351\lib/charsets.jar"
3⤵
- Executes dropped EXE
PID:2648

C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.jar"
3⤵
- Executes dropped EXE
PID:2688

C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
3⤵
- Executes dropped EXE
PID:2728

C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe
"C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe" -doHKCUSSVSetup
3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:2496

C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
"C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -permissions -silent
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2232

C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
"C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2568

C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
"C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -shortcut -silent
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2080

C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
"C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2064

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 8624055E1B595E6315A7F1A0BBDEAD89 M Global\MSI0000
2⤵
PID:2652

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding E83C5CA19127EC81ED71E687B6E9C06E
2⤵
PID:2856

C:\Windows\Installer\MSI3D40.tmp
"C:\Windows\Installer\MSI3D40.tmp" C:\Program Files\Java\jre7\;C;2
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1396

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Program Files\Java\jre7\bin\\installer.dll",UninstallJREEntryPoint
2⤵
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:1640

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding FEB7524DAAADD4567D2017DC8CDF24DD
2⤵
PID:1608

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 341BE774C248D23DDF86A7E185965FF5 M Global\MSI0000
2⤵
PID:2340

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478
1⤵
PID:676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b0
1⤵
PID:1012

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518
1⤵
PID:2628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x564
1⤵
PID:864

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc4
1⤵
PID:1720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4
1⤵
PID:2700

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x544
1⤵
PID:2664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520
1⤵
PID:3012

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c
1⤵
PID:2680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1d0
1⤵
PID:2796

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:3004

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6e5c28.rbs
Filesize
925KB

MD5
e11274f00f8e09cbe6a4291ced24ef72

SHA1
0357b8221cec29cef49f9ad3e99e806f83641bab

SHA256
f0bb73181da1f6291751d21d53200b3a19d5b3fcce1842a09ea2f4a48a43a19d

SHA512
d3948a353e23824d72fc65526e13eaa731a577b2fb795acac3574e52e147b1414a0670940d9287d3ce943a373dbdbe7cc03af01659b018cf12c1002dee45cfb8

Download Submit
C:\Config.Msi\6e5c2c.rbs
Filesize
112KB

MD5
7e3990fa0a84ffdab68263f3877694bc

SHA1
82db6d1d1073e29184d79091e9fe7eb7d3014351

SHA256
2b4db1817891a8a2dbcedbf9078ccdf969ccb94e80b1ca20744f03882e74bb09

SHA512
f672d73cdb4d8f74ecab6bf56179290a6b72551fcc817c7e89ff4b1816fd970a1675a4c191dfad3d742c53e48c3373f3f672a7d407ea6872d2aff6f37995234c

Download Submit
C:\Config.Msi\6e5e73.rbs
Filesize
7KB

MD5
1085f9ec7c1319ab94129375dd60f4df

SHA1
e633fda35b5c29d549279d750f184b17445e010a

SHA256
ef139acde65091e76df507f1f3ab46e3d3137d99da539879b4857fc7654901e3

SHA512
af6308688e8f4256b189593f1bc3a3611a73cf078e4201246826eac7e9bbecfbe870f02ce179ae3a9543afcd5b80f58a716f36008482de24c5bbac1e6000f3d8

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\dtplugin\npdeployJava1.dll
Filesize
1.8MB

MD5
ff91ac355dc6b1df63795886125bccf8

SHA1
90979fc6ea3a89031598d2146bf5cdbbb6db6b77

SHA256
14b30467cfea0071dffc658dd31b8a25b7b4e79608933f171911c2cba6aa9a0a

SHA512
77aa8c7930730004bdb8d49a82712e1042db978102f6eca0d38317b6fd98ef03e52279130eadc7a0da1148e759db6589f7f8334d4c2eccfb2613e8f19542e197

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\javacpl.exe
Filesize
103KB

MD5
7a9d69862a2021508931a197cd6501ec

SHA1
a0f7d313a874552f4972784d15042b564e4067fc

SHA256
51ff63cbac78bd133333e98d91b02b652c88cd57cedd0052519051a17be77856

SHA512
5c331e6deefc8256ea203d63770484f6b485d4c3832a60ecf4a540dff3cb75a76dbde37980fe1763ca487401b68126f58f8d1a4c72ee610f5144c624c4736850

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
Filesize
446KB

MD5
24ccb37646e1f52ce4f47164cccf2b91

SHA1
bc265e26417026286d6ed951904305086c4f693c

SHA256
adf2d659c2b2a4afff1ca58f3a742d27d767d27eabeca6a8b6ee243e9c913a39

SHA512
cb174e7a219f6ffae3715e37beb428979bc1462202729c05a25fa7b8da90e2dd6faa92c03cd9ca21567d354dce7acc1852669f4071298e953d6a286243794e32

Download Submit
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
Filesize
216KB

MD5
691f68efcd902bfdfb60b556a3e11c2c

SHA1
c279fa09293185bddfd73d1170b6a73bd266cf07

SHA256
471d70ebf91bdc762dcacbea9f6ca883f97921938e83269fef911dbf83598a70

SHA512
a4816ae0654f41bd130d56e44839d9f29ab48bd2f99c3d6db38ce3358ac46c1cef09da09184c6291dd378018a49f9e56173c35d780d3eaefcce459592c75de3f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk
Filesize
197B

MD5
b5e1de7d05841796c6d96dfe5b8b338c

SHA1
c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547

SHA256
062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d

SHA512
963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url
Filesize
178B

MD5
3b1c6b5701ef2829986a6bdc3f6fbf94

SHA1
1a2fe685aba9430625cba281d1a8f7ba9d392af0

SHA256
6a2cdce88637830202e1031bc8c11f083103a6bbb8c1ce16fb805671a46633c8

SHA512
f3391d790bb6acb1c25b82253b19c334e7cd73648e9821b7050fefbd5b0bc4b48a0cedd97e425a83c788f9b798337d33dee2e989771604c4f886da46d2debea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_96EEC010953ED454BBCDFA69FC071E7C
Filesize
1KB

MD5
530416fa9fdc80e1250c14be24787f7e

SHA1
ead34c198971ade481eeb896123958141209fd63

SHA256
2e8ed9c49c70978b03d3f70902800c2d7d4d4050089543d292081be95a930654

SHA512
6e54b2000fa8e2facbd775eb3b36dc1ba7c52335d68b061165f199bc0855d7dd0c775ba4801454bd47f785968343a3493f1a464660046e6fed208e8f25151f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_96EEC010953ED454BBCDFA69FC071E7C
Filesize
516B

MD5
35c730fbcef966dfc43f287b0847f523

SHA1
3f5403fef6d158bddf24b4fb4a4c2e0c843f9b72

SHA256
795c00f9117a40f38902f1a2c94238c0c0ae55b7c47614d1c97ed7f455e64d80

SHA512
510ab0cc0c293eff77857ff860da50adf53c808a15336fdb5d24b219fecff8ef6ea19d5f06e02b7a57aec55bb45f18c089876e513bdde9586c1ac6f8aecf211b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
37439961498add867cb791529dd1361a

SHA1
79b8b1f8a89993a720106b03bd275bf9aa7c5169

SHA256
1bdcdd66f89c8ef85203b8f35d1d7d96f0cc82c171f5749f49693ee83ae433f0

SHA512
476b0ef6d92e916262f88104ac01d644fb0f328cea17d6b624f0219aba64f6bf247c6b1d80fbeab590f9b3588aa35390a8f605828516eb63a5181cd51ce0bb59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
408B

MD5
11e1c4c0abeb093ff8fba8c43a447fb4

SHA1
ab9473a2356c1b81b6ce59fe9e2f33638046a9ff

SHA256
7210bb11e67171e2571ae6ea64ec978acdc3716bc7bd98e71914aa0173f29592

SHA512
91a1db780f51fcab8202c80df62dc47b8ea91a96d90532927bcd1fdc58141fc4a45fab69426278acf89f69237c4f90e389b63f6accfda4c3946548a0f3704095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a4a0ff310c3790ce61a32823b208a16b

SHA1
0ac20d13d0c813186c16a779b530d29a3ac35b26

SHA256
c45b613fc45e36ee955ede33126354e7e0f995db3bfdcb7cd748e102fad5b2e5

SHA512
8036b849e1ed4b7dae1338078d6bf6268efd5f5025a4215527c58cc69401e163d1a7e5cb8e4652ee18b9dfd44a9cb42c86140b20b729780264c39add0f0ecf86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
30ea7446dd745a66e6999d3ab98c8fdb

SHA1
b19ba0e3ea3eb53ef035881bbcabe9c0f4568677

SHA256
ff7c57998ac6fb850fa57a35e9b408de09edd2bbca3d8192f60e75b8fa61291d

SHA512
6cc1c98c2a9547a225ec3ea432df84542d6ccd287d261e9c103b35f9d6435a2e8ff9a31cbee6f69cbfb0c909c0d28272cb2fb374ef9983360b736412bd7717f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
cd94d008799927644100c0fd6117015c

SHA1
13e4f69ae8b40020a5d4a4935cfb47ea6437c35d

SHA256
6a780ae4a040761b7bc95abfc3963723a2de21c88abe68adb920ed4b37dd1a9b

SHA512
676b4ba091b83cb834574c4cd070798bae95d6b523158fd23ccfce7f9bcea88315dc824975eced584d25e938fa105b5c0ca6016377c08d970821abb41b459dd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
777cdc2c6dadc041046923a9cecfe09b

SHA1
b88c82acfebd58d53b6315e12898ae45d733688c

SHA256
938b74ed76318c1d103af583d777989058c351ad101c35872bed6b5fc359e29a

SHA512
a30d85c91c43065c89f7143d926ad90ccf4c5e0cbfdc49387b8d9b0df31a53485e273f51d525a370d915ae173773f527a89e9d0673a902e9ac0d5c3c7b4bf61b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
c63cdae4b59634d9af1aae3886ecd078

SHA1
9eaa1d1469e9cd52e795e363ca34d40e0e551c1e

SHA256
34262c556a225973d5866e27ac2eec08a7384dafc317563677eff25b4f387707

SHA512
3eebbd0aa07cce6211bc296be715b0e3ddb8bce4125a1eea31ac276ab553dd7b45c8dc297cae903397fb10cb9b3c35a6db55138f11a925e47b3afe4999c4d9bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
5f35407187e8436811d8d5f896a449e4

SHA1
947023ddcd86852d9f9a080c1d43f17e40e18946

SHA256
0acfde5bd63b7c40514e603b617dccbfd9e54a8e011840b030b488bf589f8aa1

SHA512
a20090105e10d5a0a574fd25b5c8bb9c322f7e08858c3b350c16824ce60fed15ba494880a72b9d2cb386cfdc17b307206c89168641be9553397238eeb3e42a17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
88f3a952dad740238702a89f8f77b918

SHA1
913e39960fbb3fb73b0e64f6a39097982870b84b

SHA256
c9409b6605a42ee2f7e56169bf8b77c69c652cd644b7820f656711bc79d7be59

SHA512
21dbf5c98a91970872cac773432b0983459b049fff36602e760cd8d2df71f9f9094ee0b4bcc109eea50979bd5e27064df1b573d330154bad9b84317719587dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
5c40566a7398bda9d14ad2dd9439a9b1

SHA1
4bb8848387508697e82091c3fac9b922c9597613

SHA256
fa6864fe640990c97aed848650c42b91d0aa2c7ae922a942122f9bf307fd64c3

SHA512
76ef63cf82ab57533b153afdf7225882eee268536ab13577a31ac40803d6d2c9f8c5a9624b57adf6c648439564b8fc81f795e17e0ab72dbfa3ff9a41f58acb01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
7926da9c5d5d4840842e07806a7bb23a

SHA1
e2d36f1c1138507262041d38396530eef1e02a51

SHA256
0555695f0cff5acf3a2a343482d034196e20bc3dd4ae326a18ad8fffa447d08c

SHA512
1b546513c5e966d7c403c422060d28b2512c46f867e688e75cda19123583f33c7fd8c30040067c9f63bf9c034f51fbfcf3873fd750b5ecfb3d5dcc9bbbff3155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
f6928e3a137d34a96437d40841981871

SHA1
32b2a55244f10cce2bcb9c0e3059ca5432550062

SHA256
beea983238f87a812854911e19b48594bad3ee9079162e25a4d41d80ce9e7918

SHA512
800d7b6e0ab7fcc8f9c20324dec50c5967e1491f70df430c88a31fbdd39925fc23bf6d4d54be8c2ba295682f196732e80f2e49de42e34c387f28f6842c0ad825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
184fd4ca9efb536db22e1b1f6a9973b0

SHA1
ef47fa04f9cce676e9fa6e7c1912ca029430858f

SHA256
9c538332afd2e7c6eb785bb52fe3a5dde6ee8a158bf78c553c2d8c4cc518d06a

SHA512
51e1f54de6806ee27634ab56cf34c90bf6007a9016ee11ea62e4febc4d1ad7156987b075852ef0e12b64d3aecf60072a365de0a840a2b9c40b3629bde049e298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
2cc97e5f84d95db69182d70835d00198

SHA1
660e7c7f86ee3764e897a7050844444cc9a826a6

SHA256
67898cad1be8a65d740078e64035708d40ed89c069e46da1347b7dc034ff52a3

SHA512
54346cde75e5ca2e535037e014e3243f0ca4a6a8a42f937141921a18f87d4012676322eac1761f3dedbb28fbb427000701e0694fcf4f56a4c8de7b9f2b7f309d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
bf5edab05b21ae3b2e82c7e92317cc83

SHA1
d84ca754cae387c8fb143599dcc66771368eb2ee

SHA256
66b9fb04d807435df147182eb1cef3a1aa7db875c6e13296f28a481583a44125

SHA512
b56a84034963030f1d3cff3d327c4eef17fca46bcedcaa870fb802a52b6f4365a4f4b34ffbcbb8659ea20a886438e7ac1082b012ce4b6a22cd5dd324f4bb6b01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
ab17de33c7646e62e89042a64bcaa53f

SHA1
75a013a49def749c2272985a36e0c403b1bceb75

SHA256
af6470e73b216b4ae104c3084d932cd032edd6d36607450e50bdcf1808fb6587

SHA512
26731164641d8074dfeb04f6d9b460087e9eabb526af799783e42c60d8bfa562445e7683fcbcc5fd720455e38c255ce511bc4ae8c1e0cbeca819a401a54f01e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
5d2226d270fb8a147ae59c7c131f2c59

SHA1
f3601600ff34fb7877f5811d0543143e251bf084

SHA256
6741e8c19d2d2cadd99e992c4cfe61d917e0557ff8d0e9d0d834ca0e566e1a88

SHA512
92de1d7ca3f6e5aee692c12d73348025ff9cd3cc03316ca8e0129146dc391f880ac0c0c3b84c64d5006d73c9bc4d0b3a3ae4a64e382004fbb8354a4cb69d93ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
5d55fb1c70972998f5f00f2964a4163b

SHA1
78069987dc82b4fface79c93245c088aa6bbd25d

SHA256
a64e50e01ce6b5615ef1d7344ae5b1eeea5322c1282325f05d6171a064ac9bf7

SHA512
88f4b8316e1f5b46bc9250a6d541e7754cf883b08ebae60ea467d9a76d80d958cdc74ae9e067f0bb2dbd98d59a45944d87ac2d8ad23820643ef3ff483f68c162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
aed194c2162c2e47c1eb4d5f3b91063c

SHA1
46e54bdece2373e07f8a590382e4e832d0644c80

SHA256
c2c071fc9edeae3aa8aad6ba94f545f4ce42fe2cb12e7f9c80135d12f9fc0564

SHA512
822deae78b709642e8ce1130e40f4c0adb40de4dc69c6298e231a116a00b677dbf736db716dee608ec2a452eac86593ce819b763acfb7857ebcbec3134ddec51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
fdd4d091171db0109cf6092adc641f44

SHA1
b25fe248af206c857131e36f99301d1c51900344

SHA256
4c4dbae636e3f0f4d800db22830a27de10676c1779b6be49a6c291f69a7b80e3

SHA512
8e67230958a5c5194c5c311555f8d44b52778b0bd3949ef4de2d0aca26acbcaa400611288c149c5005f56ccf3d45a00424e807c5fa42a5b2716c4a11da255372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
9c714bc21e8e1cb572a7f5fe5f5b697a

SHA1
fc398323d39f84b75ad76f1b9348a037565125ef

SHA256
c2523a734a996c410137f36da96342e19e76060cc508c1d04a994078328764ed

SHA512
9d835826dec90c6204dab2a6d46d95e6e67f5ad36076dfd8123e8f1506552f51beac9dd63eafbfbd88c4454292e55bfad1ec08be243e2935c7a211219ed67b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
0d2e6b3badf9d48d7783d761b53e8729

SHA1
4869300fee81228804a3dd569987a8f723c8306c

SHA256
c3798247b802f161d6caa84051ad41277a268f09249972c367e343c1f5e3cb24

SHA512
9beaa020836c425c3a09e58bdbfb3f786d6087c8aeb86e0066f476f33e027e44c99b0d7bcfbb63ca9afc4aba79fbb8475776d5b27403a05ab6f7bb23f6ffcdd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
0c0c51ca13c4221a872b2a6f96539208

SHA1
506e401beac43b48c1f2582aab662a742765959e

SHA256
9f190513d7295f86419a4686393c55c987c2903e4733b58f94feff80de4b14e6

SHA512
e561172b22ebd37ac7ee6ee8ae6efbf67dc3fd3459520500f4b53cf49a34e2fd3e6808db5f40616d80ca72bb81f65ccffc7269cef22d086897fdde66c15737a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
d643be85e64ba5c21bc63a9b5fe602b5

SHA1
99a98dd8f5c9c86308ad2a582a5c41208912cebc

SHA256
a30d9dbeb958a32266bf772f2c6db66c1704daa13248274f4b60ae424ef85a7e

SHA512
3abf4134fe03e93ba36cc9c4c1aae132e3340012100dd2311b0deb528880550d7c2de9607fd72e4211f6ab0e947e229d63eed909212ffaf4333b8863fbc5afc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
e7e0f0ab28fe227570d96ab3aea22048

SHA1
75273db5f83c2030c117e9bfd398c7d8ccb4e188

SHA256
004aed5f12095e33465d96dc73adc44d82439c96f7d1b4494a4bd8cdba0a817d

SHA512
545e8f8979a0083beb016e6aff9c4824d82292d6dcb74e086eae07205ff7f1c6ca6cdebc7a9d0c4d465d9f66e2012f36453e6635f62d8a1dc24ae643891200ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
0f31ef753d9ac14514369f93d84d0e84

SHA1
eec9cf67078804a8b7cae4706a8827008e866b7d

SHA256
fefc5ca2457b5a047bb0f9d16a00af891ff51b92e5c15c05c666b4a2edb4d6e9

SHA512
4353f967e86b4411001dc120edd4f3a965d3155912f653e2e76bb63421554f67b92549c201d3cf64fa43931c546e71afe17b9f6065e5ba90e7f0629e82984e20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
0f31ef753d9ac14514369f93d84d0e84

SHA1
eec9cf67078804a8b7cae4706a8827008e866b7d

SHA256
fefc5ca2457b5a047bb0f9d16a00af891ff51b92e5c15c05c666b4a2edb4d6e9

SHA512
4353f967e86b4411001dc120edd4f3a965d3155912f653e2e76bb63421554f67b92549c201d3cf64fa43931c546e71afe17b9f6065e5ba90e7f0629e82984e20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
Filesize
242B

MD5
78b0d342d4539f11efa767639fa7503f

SHA1
ba75468c718fa5e72d27029fe2e4597e11f9986d

SHA256
b3007f9e2b0214d846a74fa9dd81443a871a1b9e55a7f32fd8fdbb3c10d04d9d

SHA512
48a99217b2a5cd46ecb261bdb120de19d27de1688dc771b5291173f1ab3b3301ae1a0c712ff2ed33ae06d1fcc024b07471c170e9eca7cc8330c1bd63c309cd0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\EHCJX0Z5\vk[1].xml
Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\EHCJX0Z5\vk[1].xml
Filesize
270B

MD5
f7cbc1282e99aac7b5e45abd1bc1456c

SHA1
475f5772ee3615e20d7e4b360fe85245a27f479b

SHA256
f8382c91ebb56156bce1a22f3d416970d02dec3aeb7a0eebe91fc1b453d4a3ca

SHA512
8b84e312f61e490a42980fd5a9716513cb044065c75424ab31e25eb5fef34c140aee0d28320f12aa4fd843811aea48a56d8a8156ac5639006efe3c89fd67d460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\idyde9r\imagestore.dat
Filesize
19KB

MD5
0ceb8883a9df1633192baf771d7d9de0

SHA1
61f644567c52a5e471d0f3d547c9effc778d6c76

SHA256
47a14c1a85eb521223a33a4c9acb83d3d1e7f1c1708e35499fb1859487784807

SHA512
21103fe8da139c7ef3887c7436bb3c8303d76077cf1850d709288a0b45e88f6573398e790c4e2916821b8643a062dbd4d4e653826c07bc555c52f995e92883b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACT9UUKV\common[2]
Filesize
1KB

MD5
f5bb484d82e7842a602337e34d11a8f6

SHA1
09ea1dee4b7c969771e97991c8f5826de637716f

SHA256
219108bfef63f97562c4532681b03675c9e698c5ae495205853dbcbfd93faf1a

SHA512
a23cc05b94842e1f3a53c2ea8a0b78061649e0a97fcd51c8673b2bcb6de80162c841e9fdde212d3dfd453933df2362dcb237fe629f802bafaa144e33ca78b978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACT9UUKV\runtime[1]
Filesize
41KB

MD5
c65bc05f8e3c03fe4899862480f4d3f3

SHA1
5a5d38a3154430d1ada06724567eba14f652ae4e

SHA256
cc8f816e080d837cf1d98a1a301ab2a8ddd64ccad69d01995125645710b5ef21

SHA512
874112843ebc5eb4bc1038a003bd3706e55844205f0ad676ca76aaa9e51f8e9e05b61c427ee50bd193ed693124c9adff94689df1a73cfa35d981df9540a928ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\favicon[1].ico
Filesize
14KB

MD5
b0c996f95fd371be4ab5681dcc24f4cd

SHA1
bfa810629504dd5c84730616977333602fb92b00

SHA256
6b2cbf911e05719647675bfd9779646bbd8179166cea6d68fc38b01cb43635d1

SHA512
f36b23681cacaff008cea9c0c223d4e2ac3dc0286c01e8192853bb27a9f1dca15bf6da4824392f76661cb4605c729440a775aff5b39806f9a697c961d32d34af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\host[2]
Filesize
1KB

MD5
a752a4469ac0d91dd2cb1b766ba157de

SHA1
724ae6b6d6063306cc53b6ad07be6f88eaffbab3

SHA256
1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3

SHA512
abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\layout[2]
Filesize
2KB

MD5
cc86b13a186fa96dfc6480a8024d2275

SHA1
d892a7f06dc12a0f2996cc094e0730fe14caf51a

SHA256
fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058

SHA512
0e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\masthead_left[2]
Filesize
4KB

MD5
b663555027df2f807752987f002e52e7

SHA1
aef83d89f9c712a1cbf6f1cd98869822b73d08a6

SHA256
0ce32c034dfb7a635a7f6e8152666def16d860b6c631369013a0f34af9d17879

SHA512
b104ed3327fed172501c5aa990357b44e3b31bb75373fb8a4ea6470ee6a72e345c9dc4bcf46a1983c81adb567979e6e8e6517d943eb204c3f7fac559cd17c451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIMPJA9E\rtutils[2]
Filesize
244B

MD5
c0a4cebb2c15be8262bf11de37606e07

SHA1
cafc2ccb797df31eecd3ae7abd396567de8e736d

SHA256
7da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1

SHA512
cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NMXH1C0L\l10n[1]
Filesize
4KB

MD5
1fd5111b757493a27e697d57b351bb56

SHA1
9ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711

SHA256
85bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f

SHA512
80f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NMXH1C0L\masthead_fill[2]
Filesize
1KB

MD5
91a7b390315635f033459904671c196d

SHA1
b996e96492a01e1b26eb62c17212e19f22b865f3

SHA256
155d2a08198237a22ed23dbb6babbd87a0d4f96ffdc73e0119ab14e5dd3b7e00

SHA512
b3c8b6f86ecf45408ac6b6387ee2c1545115ba79771714c4dd4bbe98f41f7034eae0257ec43c880c2ee88c44e8fc48c775c5bb4fd48666a9a27a8f8ac6bcfdcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8373.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
Filesize
27KB

MD5
7206d92ac2bd6a1d906fadb12cf51f90

SHA1
ef5d0d80a017885e06bbb5bf71c2470d157d3522

SHA256
05ce2bddf4e1f9d95ddfc00beb3fabb7b857d32595384a9e3a3b24ad4609cd02

SHA512
65fd990a4661a42d007acdc2ac38b39abdcf82c93519c2bd7c07a58c6f14482e63b6d38c388dea7ba8b9c316c025a8d10312d88ebfb8a57b6a4d683756c6659c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C0E.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D7D.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
Filesize
339B

MD5
a45137507477ea159a4c0481fadbdde8

SHA1
772e535525cd41abb781167334f923f1127f6d24

SHA256
fcc6693f94f87dbb9f03bd664f029db87257c79ac9a974d2caadc790f20ea67a

SHA512
393a8d9387b388524fbf7bc8387d521c830e7d384aabe278251cb4fa1291d32e2875c464a01f93670259bc2009d69507b632a692d43244f3eb7551414c9d635a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG
Filesize
644B

MD5
f54bbaadafacf2ed607c2b44e76bd5f2

SHA1
e6e313e86b0adb771643dc9aa465652646d83329

SHA256
2dcd3efb7e14a1439973b066c810eb3187cb851a7d01b2a03376d978b6b0d927

SHA512
1d7f940d290c3c7eca12739f7e4753901a1d070ca9f43171b4fe25530ba48b3b376c16b125a32d6e701d63d576ef829824472bcac99e568784543bfc4c50b732

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG
Filesize
40KB

MD5
4f71465fa9fcc2f321a1e934f214ac33

SHA1
38c9f15f23e4e5158b04c2eee54d0fcc8104405a

SHA256
ea29ba222b5c2c2f13a71314ae449fca748e96343a6d1520140a9534df57cda0

SHA512
6f151ae73b3ef807a3397cdb57820a839f77923320951bfef09c0efcab84e3fbfbe02dfe71e912b7d1b36ea78bf70c254a0015227fa5dbf861f40551fd0e1645

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG106.PNG
Filesize
1KB

MD5
f785bd0f38d4132c404ab3233bb1766b

SHA1
7c8f01921d026646289d92d4e08529482f2dd881

SHA256
4ddf6c789a700dbbca5c405f6b9625e2dee8d6e279f8629eb1e451e5040fbd0e

SHA512
45f806a91993918177e838ac21bf59f37e2000aeefa191d0b538e156165eac82309cc0c67b5379bdaa7f7bbbc97ae25ffd741a6c35c07377a893721442811573

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG
Filesize
2KB

MD5
c70b569d43f5e00ee3dd81530899f191

SHA1
38b7f73c29d9d355625bf7dcc611d657c263dbc4

SHA256
778c8b5a8e7422ce84f4113fc1cbd90204f3b3c0b3bb8545b3fe68003525e9e8

SHA512
f0aafa93ffd1edb8764f7e435fa982b0eb596b1962472dcefac26731382c58d44306e876f04675146595a1e7ee6ae8170e2fa01ed0fca075e36a9749709f4df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG
Filesize
280B

MD5
01e097a324673878a3cb5e8e0f3cf152

SHA1
35ef5c438eca9672c7ee19bcde3952f83dc77928

SHA256
d8d0719a20d267a73d298d2ec1fbc050fe2ce25447c7441058ea3966acfbbb22

SHA512
e873763e96b3a52fe73f3fc9b3bcfd764c807c0206b5984d5f7dddd7debec4e6f0b6705ca6a7c6379b83c2fea792d7a16880ea109469ac1af41cc7bdb5f96e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG
Filesize
1KB

MD5
362d3183b2acc152c99ec123611f3297

SHA1
3db69a12917cb11a14fb9294d73c5409fe11a398

SHA256
8ae66727c5c92ca76a131aa104cc126858e8e3ed490ae08482109dfedd9a8cda

SHA512
2c7f40564479d1fe90cb59b4b413e8bf9a5bb7cd2f94193f8759e376549c0269afce030df7d306b4cd814f604ad460d744fb00d961f6d2608a4ecb6b186a4f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
Filesize
281B

MD5
d88e18e2a020a756a8de999b76e7b1fd

SHA1
150f801600b9427039197847aaac784f8ba15258

SHA256
38b8f2202a5e48a8f528708922f504379896ef52b3882ce82efc3481c51804bb

SHA512
d048a569d155aa4636f25ed2963fd5e2234643735ad461df3ad3201cbe152b646c2893557a236fa9683aa3cb07351fa79b9e5788f631442e5142cab0bc98654a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG
Filesize
438B

MD5
87221bf8c9222a1489e949e4266a2980

SHA1
60c9d850f696e56b53dc3f940f52463d228febf2

SHA256
8d6e1d814dd38525115ee5d77e2d2ae6df8be31562a3c6805012097d6625efc4

SHA512
fa7ba5edb212a0ad70de123b1eabebd8d4cf5e2e3f59841330923c91d6ce6d8a0bbbf0176a8215a183ea860ae5286a4205b73f70df4d032cfd6c03109d1e433c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG
Filesize
206B

MD5
bc193c9f3fd0730341d2ba951f734652

SHA1
ebe3f410cf0bf5f30fe36b1c1df96fa27e73b01f

SHA256
e9137bc2fefbd9a3c4506708f283fe52c40b00b35c2677fc31e196b305b00e67

SHA512
355cb9a7ba6e2a77a51339bfa732537bc77d36da372fe926f1e4bf25de865b09c98122d9559f5ec234b41a83cb97de4fd49427a9476169653ac6058912261c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG
Filesize
43KB

MD5
16c0e37cb0c5540fd9f93a8d82d94e52

SHA1
52d5aabf804381b47d13a358d80256c4088eec21

SHA256
2b772e66ebc70c93deb0b9a9e054373ee33d9245809e16174b1f132f786a063f

SHA512
dd54308739f9621f5fe707c69f24657431fd58b46e357a79d25c3d8e96d3b2914ce19d94beeee0bbd32311737670f06b01c364f0c7d70625a4246da64c29b0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG
Filesize
1KB

MD5
a7a8625948d61d814dbb29225e04f908

SHA1
16bc91a8bb3c22cf78447644a32010ad869eaf99

SHA256
61979f700f77d187c8647cba3bee95ca4a70e187bbb76323f4055385dd8879d5

SHA512
04b0bb58095a6e8f1d29203f21eee99fd837494b74736e91e5e304eb3dc3ccb32796b6959361ede965731b76607a53b0f9d211cb4b3d94b25ea34898e760d295

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
Filesize
114KB

MD5
bd5626a0237933e0f1dccf10e7c9fbd6

SHA1
10c47d382d4f44d8d44efaa203501749e42c6d50

SHA256
7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762

SHA512
1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
Filesize
4KB

MD5
05c4d525467b5f0dfa2ee2a2ffa14f44

SHA1
695a2c05e0bef0f1ef733aea3bb6838f8ac359e6

SHA256
7818bc62169560519b35a8d5a6dc2e23e3dd6a2445c4a461e37c94d337043fcd

SHA512
2ea696c25c4907e5cdfed6bf774a1cc623f5342e3a5856010640d4371055b4fec817317700f84d7b28f181af2e805a5028e6eec3aaf9c762c25b044bcf378622

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log
Filesize
4KB

MD5
0c83661741089b2505080c4d726645e0

SHA1
3fad0f213ffb3ef28b446e89d77ede486a6117bc

SHA256
ac3d3c09c6b7cf52ed34f7283491dd8097fe6fef02e4025fd5a8569f1f87d7f6

SHA512
8baf6647f00871c38662d0115764018947accefcb8d7f226b463f5868d2f82bb9d37bb006b870385ba57f2200bce8f05f02c484edcad346c63a3b49a17549e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
Filesize
591B

MD5
23cd5592d8f527956e91bb2ba89fb0a2

SHA1
b696197b08ffbfc392d9cd78c7bb72f6721e642b

SHA256
22304a3e045244b5034879c3ad0df20b4d15a284c67a2fb7c9e4b0382f82cfcb

SHA512
8781409c17b21b2b8cf436d360c1fcfb6ab364813e95600ee6664392716a8dfb85db5510cd70c0424cee7098c9dc9f083c9bade13e3a796b00d0cb4a5301c73f

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF86F68516C2BEC04C.TMP
Filesize
16KB

MD5
11f741fa674d6566f4d025190321f571

SHA1
900a0cafa336eaf637bafbd72d72943840ceded3

SHA256
065855bd5ae735d64d7ee02abd65a72298cba1c4463d7d94c2554022e39a1503

SHA512
db612aed772d0c16de5b49abaa5a9b2f79729240ed45333c5bff20a3450565be1f4763566881d5e7072dd384195924e0ec9816e731192a6f03b7d48d121bafa2

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
Filesize
6.3MB

MD5
545c62b3d98ee4cc02af837a72dd09c4

SHA1
54446a007fd9b7363d9415673b0ac0232d5d70d5

SHA256
738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4

SHA512
8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP
Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG
Filesize
1KB

MD5
58c10711ee61290c5e53d6c235d14c7f

SHA1
6cd433f1d5224b7441efecfef8e0982bbda4415b

SHA256
2d8d51d2405fd3534f5fce5ffea5b9a100ce4aacf35caa7d165c7c6672949b35

SHA512
b895b6f07fefc06695cb521fa923534c8ef99312ab6c27295c86de29fc1bdb09e3ba17cd4aea75f8dd9cf7e1a3c4494a6ef960eadcb209eecb1b623d70c367f0

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
Filesize
45KB

MD5
32b9a83f00af4123b811eb6a85ee7971

SHA1
a1e6bdfe76e6103aca76bd21ce60c0b48e4de570

SHA256
a39a8cb1d54a2036257211b6364f84caf033fccf3394e9f890434563770e594d

SHA512
eb272c6dbaa3e59887cfdfd21dba5e2abc56a12beeda55ba091aa9b02da71af5ce11c0f7af4fb34f58da9836f91d787e26ab9f898b8669c861e9bacee973ca9f

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG
Filesize
457B

MD5
19678bec078614865a71ade211a305f2

SHA1
9da7f2ff66044138863ed5d1dcf2fc7e90ffedf4

SHA256
d80c15c79946fbe8b3a6a5280f2509eed654338e53096fa6f22d280ad2f6263d

SHA512
b2894b6bbdb5ab639fcc615ff0d2b414fb517d9e1ea8062c61d23182056a0de02e118b9e43824b4765a8617dc4fd330c7f4187e3b395ee92c6ac5e893f242602

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG
Filesize
352B

MD5
034eab9a50571cbab86294322e639886

SHA1
cae94b8cfe3ecce8e750d6fd34d54e766ea607aa

SHA256
449d678cc9a235d42a5a2f4e685536d9af87c6b5fc022f28dba32b08b4e88ee1

SHA512
b364c0cbb38bfb35e3c2d29705df72a8ce7dc111f04ebc05eceec4294987f18200581a31b78a79b05da890b5358e5463d1640d2230a8af930804efa3d4da42b0

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG
Filesize
1KB

MD5
9eb36caea38bf80ed9fa40a3f67597b7

SHA1
3c23e2e30119f6dd321d34a82a339d52723bfacc

SHA256
6be2e43a38969226e1cbb00605cdac634d0de3e82ce605b08dcf1cf596f64370

SHA512
22b57fc57d45ec73865e5429210d6016d2bab0cd990877c8272b4fc6ded8effe3bfa0c9b0890d7b0de8296e6bc3c262f29637b8ce7840efba2f963e70a978e53

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG
Filesize
1KB

MD5
23e26969753c07af68f232cdd684c003

SHA1
f14666db750cc2f89ccdd8852b4259fcfa663271

SHA256
17f138eea95423738d2c9b75834b607c671cb2ac4d71c9aecf100a8b847003d2

SHA512
7c57a6309da9ae381073e005d374b9c8a82c7b4e92322b91433009d41f8f34655ed9d45958ab1743023faa9e7aa0c82a05d9292b078efccb64c19992b7e4d4d2

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG
Filesize
41KB

MD5
7aae2de61d5e6296c00fde67046dfaeb

SHA1
87a65e99d520045c39997b53c6a0aa08cec35e57

SHA256
07b11e82a30598438ac4221d6c8796739c42c2a596365464f257481a37fa00c6

SHA512
c5ebaf43ffc19a1a3b2f49e070ea1d5532ae433c3bcd02493e31bd3389b6c3edfb1e04373902fbd252eb7370612dd96c3d36eb3fac8240111f57020ab99fa882

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG
Filesize
1KB

MD5
0bde2ca44cd4e4e31c5c0364c66eb57b

SHA1
8496e4a8dcea6e42af33b503dc200d4a1ef07101

SHA256
38031284395ba7a773a335a861536b487bbf60b81496424b8a9a8a6697a919de

SHA512
4e60f45022b0c6739db94097401f6046e5f95b26dca71e685db834338451b7ea0b3ed3afc128d564c3f79074905b7986714f75925c41f763eda6b901875af555

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Filesize
33KB

MD5
25c8bcbcf1a313b8512aafaa36717696

SHA1
c17d21d6b6bf9e0e438ba089ca175cbab78f02cf

SHA256
44b0554a75d96c80d2a6fa7ad97f1fc32a098de14d2e71ea0411abcb16a218b8

SHA512
ab7eb76e66b4c48d7457094e019e52245cadcd6c2bb89ba2150d92f778dee297b68aa0f1540d3d03fba65fdf0831f63044eeaf68aad5c3b83fbf67f7d481af66

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Filesize
6KB

MD5
4f7be9736242579cb8afa1af86980dfe

SHA1
1c486393847996db4f6b78532dd7bd9a0a924549

SHA256
9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4

SHA512
4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9

Download Submit
C:\Users\Admin\Desktop\AddCompare.rtf
Filesize
609KB

MD5
e257a4e0a8ffb96678a4666ac0cc7940

SHA1
6cd9f7f22b3557bb43b9b2f6274fb96b41430409

SHA256
8906b6ec187d958cfea36d8ebc6a3e7ec48e804ad89c57b7112d7dd0005c6429

SHA512
4e7baafd20eff9c3e1ed577d7920ca0735d65439d56f9b110aaef4be28ed0b584eb2c3814916109d665cfa23d61f0059a923ea0225816936c79fb63a30f807c3

Download Submit
C:\Users\Admin\Desktop\BackupMove.dib
Filesize
981KB

MD5
5c1cf6fa4fe84d798da5379412637aba

SHA1
61a747b91766d661653858ebd1ffecf658d36827

SHA256
dae28970f24b83ac986f04902f5711d1830d30df948adccba44c3fc14446d376

SHA512
fee55977b6032d519ef40aac92ae887344401609214bc9ffcb674ad0ded8d0586c1a1ff4d7eb861a663378b4e1402c8a2bca6edcd58e289554e799af503a52f3

Download Submit
C:\Users\Admin\Desktop\CheckpointSwitch.tiff
Filesize
880KB

MD5
9cecf76ef8cc2653253b3e6ecb8dadcd

SHA1
ad1ad575e07a037dd0a75de7e27696c13a1efaff

SHA256
44d142d058aa6169110c53ca70a8dc1621692848a7cb32ecc4d44c10a6715a16

SHA512
189cd6e1770d12013e91a549eb98540959acaec74a44b51c5fa5db89e15750a396015806aa1464594351a38130b62bb287d78abe92583a44b9e74e011b0ae91f

Download Submit
C:\Users\Admin\Desktop\ClearPush.m3u
Filesize
541KB

MD5
675f5e53ec7ff778e41daa4e0d226e48

SHA1
d72bb597007967d26b6883175ca13952a5708102

SHA256
a0dde7a88a6b9c7a64c76a33c70c29efa87538d25e4f1bc9e4c2b2d15e5c4fa7

SHA512
99bae200bbd92cbc3d2233bbce5dbe57bf41cb8954dfb4fa6255b60eb7d6b5de6d9125010145a5c32e4ff05d8729e97a44abd025e8c0efcec3c2fef30fcc3057

Download Submit
C:\Users\Admin\Desktop\ConvertFromWrite.mpe
Filesize
1.0MB

MD5
a3ce2c84ab0b622ba2629d44880c718a

SHA1
348fa2c9cf52eacc87fb8cdf7dbbf97209615baa

SHA256
8b77e32e9df9ba00e15b96a236b0843b5d5bbbfe9a884c7343af4f1f01cdbda1

SHA512
68549e05049e71c0ee5d9024df45fea414817e32345b704e806ed1b2b160acc3a1dbbdb4c3924785c3764dc24311d51a1505d22048d9bf445d0dbb5494a98510

Download Submit
C:\Users\Admin\Desktop\DebugRegister.txt
Filesize
473KB

MD5
bd579f1ffeaf4a4e7b3f361a0b4937e8

SHA1
25d7d78e8d98087c11dbb612dfd666193b09d5ea

SHA256
d3168d64d329d48bd43e0d1a6b71bb8bf10b4bd3f7da2ba07c48ca3cf2e2ddd7

SHA512
b3b1885703e3e8ed3505cd836f694e6f2b7ceece9fbe95acad53bfd955acea83b2c4854137f88fceacb62ff39fb0c727d0400341f4827e4fb111023eb8efa571

Download Submit
C:\Users\Admin\Desktop\DenySend.potx
Filesize
406KB

MD5
6258edf1cec3a239ce1c77490e764a67

SHA1
8e6a5193eaea6796a6a0a8d04e16d37e604fa1d8

SHA256
31dc56da8ac6d90287472b53056525bfc5189563d85da4d45b5d28c3c6bf6c3b

SHA512
696e8366c263a14a9d2c628aae57e10e2955c7e9039a59774a04904eb51f3230288549d70364a23f3d9d78011d219c978d350cfb658af0f7735f2fdf4eefca86

Download Submit
C:\Users\Admin\Desktop\DisablePing.xlt
Filesize
812KB

MD5
b4b5688c33aadc831b5456dc32f3d564

SHA1
f56d4c7a2c3ffab69c17bb22de7380158ea05ecd

SHA256
d402834ae2a02a2c760b601d5defc4c52c8387341fdcc00376ead939b4e8c335

SHA512
455c31346033161625ede0bc725a55e20da406e3770c70307866c08581e02eb5e0ef4bfc83ad4a6aa7b2aee482e2a5f6807b73eec364e5b2bc0632dccac1cce4

Download Submit
C:\Users\Admin\Desktop\DisableSubmit.mht
Filesize
372KB

MD5
c533190d145e6b7be91b05a66fbc2695

SHA1
cfd543806b427072cd03cc688908bbed66301a3d

SHA256
27a55777a6f0f9fc7959bb21a0e94895af47ac8ec5544049ee4d94762e2f6e39

SHA512
b4ef72ba06f05b0e81c0cfc72b85f81d5d3c83b54d5f1bfaf705eb669c8d4048000918ed22defe3a33c7d032445ed89ec605faebdcccc7d17ed623bc278aa164

Download Submit
C:\Users\Admin\Desktop\HideInitialize.wma
Filesize
1.4MB

MD5
d758bfee34d0d9b162845501439afe58

SHA1
81c9537b7c58cfaf26ad0e3aac74bd2fb98a1f40

SHA256
987d0d8e825009f639fb0fc79750e529975f0988a36078db4f4e48353b418ce0

SHA512
bf1a91669013421a9ee00161ae938394d68e76c3dffcf75ea28cfa2b53990fca759b61416112a642abb0b1b8b65effd8878d5ad7942d96196fc92fbca1519789

Download Submit
C:\Users\Admin\Desktop\HideSave.zip
Filesize
1015KB

MD5
ef9384e3b6bee8742a21e62891b7de06

SHA1
3c995484102faae37a917300e3edd992f8a85289

SHA256
17f1c1577c85884c002e5c41fe5c94f6c998a7700eb0df590e544243fed2f7b1

SHA512
4848a063fd9a5382f2c6744260005eddba70c7e72bade2f77a1d7a0544597187ef13146a87f49637cd9912bf2cbc47d86b3f21595d4314502ac480ec2cb002fb

Download Submit
C:\Users\Admin\Desktop\MoveDismount.avi
Filesize
778KB

MD5
70db4b2062b9a64f9ab8232a1b85d6c0

SHA1
2b952bd08722329d9c8956773053e7bab91104d7

SHA256
024ff15a6ff447e51e9639d5623206f4c0e81d1d812411299bf509d447b8b2a7

SHA512
c40138fe794882ce43b11023112d80579cd1f6fdc81fe7e2d4fc4fc35a633701b30ed7a8374e27c2637c92b21fd1200bd193b0f89e096cc41370b84f9db9bd4f

Download Submit
C:\Users\Admin\Desktop\OpenJoin.xml
Filesize
575KB

MD5
bddc18c1fd24587506733331469d9f02

SHA1
169d33d6f069e5cfc0df24ffb8b45731c9734e33

SHA256
76dd2ddca9bd12b517cb983dac00de99cba340d9325ccf219e2537e3937a2b3b

SHA512
9230f09c09b89a339a89e14c4a9e5faecaa30fe50922cc6f1e0a6c5ff7ed6e5505a7412c4160e21ec010fd98274b67515bb832c5268b57b718247ca74c30b9dc

Download Submit
C:\Users\Admin\Desktop\ResetConvertTo.m1v
Filesize
913KB

MD5
5a640f282e7bc1a05963b37eb9fadd0c

SHA1
07dc516519ae7f74cb114955088b4d563c046466

SHA256
1a014951c0fe421ac3bbd60cc0bfccaa019a8f2285ef829f3cf60b0063478be2

SHA512
09fca8a25908ffe8557a70a1cb5139d80b6fb9c26b0de184ba40b23fa5575d6442bbeb9aa96b5fab5142624b72e55bce4374852e10df16d68035a16e28b02601

Download Submit
C:\Users\Admin\Desktop\SplitNew.xps
Filesize
440KB

MD5
a11303354f8787b926218a5065422f1d

SHA1
b7f51b1e82196784b3b9f35aed59cb7fc7e32c0f

SHA256
2e1b819764b1e4eca5c3f820f28680a47c35035f2289eb2c4e2365d9bdf66c0b

SHA512
c3e2ec830756fa39f2e598f90d74433730589c38a613de6d944ef886fc435cb4ac435f57311fddc28130f049ce54dac85239d53c5ee661b8da5f63171f3359d8

Download Submit
C:\Users\Admin\Desktop\SwitchUnpublish.mpa
Filesize
744KB

MD5
c085e5025375074b176e0baa1477f355

SHA1
759dcbabf4ab584f93e8469f4dced0ac78a66e04

SHA256
29a1703898397f18b890097d3b3dd679a1541269bc50caa6dd3a239c53d51258

SHA512
5b33b9c46fe7b92e0d22537f355e0af3d3baa0386512575ffa039560fad545a4ddb1b554d1119837e6354df9cacb20d1bedf86317c80ac503aba53cc6d4783e6

Download Submit
C:\Users\Admin\Desktop\SyncUnpublish.ocx
Filesize
677KB

MD5
0ae8cbb3add8fb7e9855b9a03f942776

SHA1
47574e6a5526bc0926724b84e45a46754fd06687

SHA256
af5089835eddc3346e108cb6588aadebfd2ebe8e7c35213d88a47e5bf5497c49

SHA512
853970636ed6a1fc2aaf1ffe6e75d886e866149426017c1561bf84feb758a55b9701379333356d47b7695f03f332984b541ea7bbecb2274150390939f6a61226

Download Submit
C:\Users\Admin\Desktop\UndoConfirm.xlsb
Filesize
507KB

MD5
c6940cc5935be0ce4ecc1d29a03f81cc

SHA1
438feb51eec5c99c95503c3b2ce2d643362cddaa

SHA256
eb16bd4c6e8f6a7e3da1ed0dc2dcf3ecc42f437f32e545c728db36ef370471ec

SHA512
0d9e900b4a4b4f6c985b13994e98d461d85ac1dc6eda76f175a39421d91a01f37d21449a5958348b51fb596315e98681f6dc8da203f1bf34e1a083b775b678ed

Download Submit
C:\Users\Admin\Desktop\UninstallConnect.rm
Filesize
643KB

MD5
3ca8d7004148405707ca2fd5080a4b6d

SHA1
13ddccd0bd66ef1aa3745098676be3bb0b5c59dc

SHA256
b590cbdfabd7e7f4f090b145fe48e3ec06bd44967b15d2b0371918500f6c4fae

SHA512
3de6d6677e063b12c905a95b00c39d796905ff3e335e67ea827b37702e542e274dda63936da15b26a4f86d48ee933f70833a32706e4558b29501e0e970bed4d7

Download Submit
C:\Users\Admin\Desktop\UpdateRevoke.vbe
Filesize
947KB

MD5
7f02bd734b09db4d791eeedbc2b436f1

SHA1
1549ddff74d3adcbaf00f7bb9ef2e4fc7ca20ef2

SHA256
7efc15058120c2d0ff854476e628fbc3f52d294d1cd68a43b65383322bce227d

SHA512
584068a447c51b082aa531de7523bacef718d826b9682507fb9d54ed79a924790422454267606a790e72ed845bb7fce103b992ddd817295580b5e71a1baeccce

Download Submit
C:\Users\Admin\Desktop\UseLock.pub
Filesize
846KB

MD5
dd24d486f5400783c01b9681949ef28c

SHA1
11eb180c9333810ce22e4a2e8896b2306bc991fa

SHA256
aae4c38d6240380d4902947efb45547ea0612853f2040ba1dcfbbd8ce84f8979

SHA512
caf89871b789b1f2e8fcce201db130188543554360de117766533df480f72a649a9aad432389da7141ffa6d101ef34ad53b4d022d8ed349841accaef6863255a

Download Submit
C:\Users\Admin\Desktop\WaitSet.shtml
Filesize
710KB

MD5
3e84b22a1f18668958fdb642d3ac6f49

SHA1
1823274ce31f479acd40a11a06ce808d4bcc6f4c

SHA256
c7495409e3db24a1d97cee58ce635f9c63a6be133f14a4ceab581c2d2acbee72

SHA512
768376b27daabe763523c256aa5ae90977f1b0eca3c6d340f2f635a3ea1e2ba081f635103fa4eac86826214eeba793221631bd94176fc5faf66d05f28c469309

Download Submit
C:\Users\Public\Desktop\Adobe Reader 9.lnk
Filesize
1KB

MD5
eb04cff8f5100f4ae9123e185d7dc810

SHA1
b99d850ac86ca38f77882839b42fc182c8a63b67

SHA256
15588fe086849ae075dd9a1e565fa69b602f8375b18ca96f2d2c9ef3391ca794

SHA512
0951bf7870ec21447413860598bce26d7a581424741d362f1874ce078eac73e878be15bef3c93f6696b8d58b1db782fa1afb6b36244a8d42970e2c491768931c

Download Submit
C:\Users\Public\Desktop\Firefox.lnk
Filesize
931B

MD5
bd8f893ba183df1d23068eb015261808

SHA1
96d187ef2a172203997b9bbd35a9527d1b85d6f8

SHA256
7359add4bc0d85fb526d04cc7383adcd72dddd6f9c4664abb81750ba795cf1ee

SHA512
a20febe8b544fa25608bfd296949637c453d38a1d39b7140329b27afcc8a14b5a55ed0965110c824171a94b940895a03f70a8e5d010c342a7fd056c6ac9af9ea

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk
Filesize
2KB

MD5
b940d32b5e297c9c94cfa9f1191335dc

SHA1
7e00321b5c882e13376911655cc60407facf47c4

SHA256
a7c8c704a123ecab51cd9ef7e2725c09c0214cdaa3be8713d47f8be39ff5250b

SHA512
c21bc95e2b97d74183cd5bdd09dbe6d8b1c928595df8cffb8c1e08f48dda343b5fdb51dde6745982c93dbb06fc296d0fc8b59ec6d07b2c99359877ed93138d75

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk
Filesize
878B

MD5
6a912191d58caefecc8c360027e248f1

SHA1
44ac75775b9a85cb7cb9cb8e6e47761e1c9dc796

SHA256
09957408e6fbdb6dd78ce8ccec899ae7d025bc95d0a16967aef6096a269f5939

SHA512
7aa720779710f86bdcf09bea6952e23448077e09660c3f7505c0db3eb6a72d6a0bc13e72f0dec28c1e0345a39d4f388347d866f962d399c0fd34fc540cc00633

Download Submit
C:\Windows\Installer\6e5c25.msi
Filesize
81.0MB

MD5
1794aaa17d114a315a95473c9780fc8b

SHA1
7f250c022b916b88e22254985e7552bc3ac8db04

SHA256
7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4

SHA512
fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516

Download Submit
C:\Windows\Installer\6e5e70.msi
Filesize
1016KB

MD5
b29f7d1be8b1e479c9040e1342344ca0

SHA1
6e7e31889f809912e17fb2ad029c181f615e9f1c

SHA256
b232940538b2a1db90f16ff422a947bf42e94fad7e7e154fb8782b0f982dac2e

SHA512
f9b02d017b6851ea0d0eed32b3528a03c9a9b9255f3227e19c2115285af76d849512c86c8bd50a1ea1a961c561f943bc8c7b1a4cc4dcbec80ad99fd7fe49709a

Download Submit
C:\Windows\Installer\MSI3DFC.tmp
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
C:\Windows\Installer\MSI640A.tmp
Filesize
757KB

MD5
62cfeb86f117ad91b8bb52f1dda6f473

SHA1
c753b488938b3e08f7f47df209359c7b78764448

SHA256
f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e

SHA512
c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

Download Submit
C:\Windows\System32\REN6F39.tmp
Filesize
190KB

MD5
e60a97c65a41ab7ac640ae90ae06d210

SHA1
8c3395ceb2ab54f3b78370f0b693d0eacc469194

SHA256
6b8ee7e3552fcf48c93720bd7acfd888a9820b4b09e77e612d95bc1fad8a5eb9

SHA512
2cfb1fb9e0987a120a94a3bae06e1879ba5293167d1915d55fe1f20f78bde64b6eb15a3aff6f1f5191047c41e077f7353726c2b9609c559a8666949586b02c97

Download Submit
C:\Windows\System32\javaw.exe
Filesize
273KB

MD5
5d5fa010a61dc8496ff4e701b6d6d743

SHA1
8b1737ef8a566fb2b5b490c8fd6053ecc7419da2

SHA256
5719255fe30787d2a26390c16e0795698b219451787dbc466bc1bc00631bedae

SHA512
f1fe17e0324a637da498447299ab6d3cffbe02ca9a313a99a9060aff1e8dfa9fd4cadb531e4a4c668ec70001f7ec1820583f24587bc8d59ea0e336e8c39a5988

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
Filesize
1.8MB

MD5
8d26aecef0a7bdac2b104454d3ba1a87

SHA1
50c29c58dfece62d94ed01cb5b3d070e593dc9cf

SHA256
e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c

SHA512
0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
f8da4bc14cb40b7ff8cd2c798ca0f7b9

SHA1
1264c77f79f7a328d60dfd752e721a463fc3e247

SHA256
3050ebf56103a20f9a9466f5371561cf62d4ed3b152f7b86f86d2910f20f5be1

SHA512
0a85a6b25687e3847da34bfa360d0d01ffbd1518a26d097d16cffee00f975a9a9223c6107d270b1b70b32be3b2a6e47b2311b9ef7570dc64692837068a786d96

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Filesize
1.3MB

MD5
018c68cdf5ba005b4a380c20b13fee4c

SHA1
bf6043fbd31288e8667fcfc37cd74414bee1805f

SHA256
3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923

SHA512
506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
\Users\Admin\AppData\Local\Temp\jre-windows.exe
Filesize
84.5MB

MD5
7542ec421a2f6e90751e8b64c22e0542

SHA1
d207d221a28ede5c2c8415f82c555989aa7068ba

SHA256
188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6

SHA512
8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

Download Submit
memory/316-421-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-391-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/316-2731-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-4603-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-1471-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/316-1465-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-1335-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/316-2718-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/316-983-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-2717-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-502-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-504-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/316-422-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/316-3639-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-2667-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-73-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-365-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/316-366-0x0000000000770000-0x0000000000773000-memory.dmp

Filesize
12KB

Download
memory/316-367-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-368-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/316-389-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-390-0x0000000000E10000-0x00000000011F8000-memory.dmp

Filesize
3.9MB

Download
memory/316-450-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/316-393-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1064-503-0x0000000000F90000-0x0000000001378000-memory.dmp

Filesize
3.9MB

Download
memory/1152-4622-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/1152-507-0x0000000002EA0000-0x0000000003288000-memory.dmp

Filesize
3.9MB

Download
memory/1152-506-0x0000000002EA0000-0x0000000003288000-memory.dmp

Filesize
3.9MB

Download
memory/1152-505-0x0000000002EA0000-0x0000000003288000-memory.dmp

Filesize
3.9MB

Download
memory/1216-72-0x0000000002C10000-0x0000000002FF8000-memory.dmp

Filesize
3.9MB

Download
memory/1216-70-0x0000000002C10000-0x0000000002FF8000-memory.dmp

Filesize
3.9MB

Download
memory/2204-3075-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2204-3076-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/2204-3079-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2204-3081-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2568-3684-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2568-3703-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2568-3677-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2568-3729-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2568-3702-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2568-3698-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2568-3682-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2568-3709-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2568-3693-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2568-3701-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2728-3432-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2976-4617-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2976-4618-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2976-4619-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2976-4620-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2976-4616-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/3004-4621-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads