Analysis
-
max time kernel
43s -
max time network
176s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-2.919-Installer-1.3.3.exe
Resource
win7-20240215-en
General
-
Target
TLauncher-2.919-Installer-1.3.3.exe
-
Size
23.0MB
-
MD5
38d4740072a8962d2301b482c96ad41d
-
SHA1
f4058683b559f1a3cac9e19ff6121a3d990a5909
-
SHA256
1127fd6ea53d54feb45168d7e98488387e11b0673123142cf8a8f84fbe73140d
-
SHA512
77b981c49fdcb351a5b6cbe0a0feae3c702b98d68c71ae28b570f0e8a449c664f284059887fbf3f7d32d7e3ea0ae54ce63cd7c2c4ecfdcb89b9a9d0aab2179b7
-
SSDEEP
393216:c25K22hvhyr4hQ5+kcOWyiGhtkNtdal39+ytpUcOy0rr6of5MJ7ZWqxPAIgtMIMo:5K2Q7m+QWpGEtgl3n3vObrrKJBH5lFRq
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
pid Process 2488 irsetup.exe 2264 BrowserInstaller.exe 2940 irsetup.exe 2844 jre-windows.exe 2008 jre-windows.exe 2612 installer.exe 2216 javaw.exe -
Loads dropped DLL 64 IoCs
pid Process 1732 TLauncher-2.919-Installer-1.3.3.exe 1732 TLauncher-2.919-Installer-1.3.3.exe 1732 TLauncher-2.919-Installer-1.3.3.exe 1732 TLauncher-2.919-Installer-1.3.3.exe 2488 irsetup.exe 2488 irsetup.exe 2488 irsetup.exe 2488 irsetup.exe 2488 irsetup.exe 2488 irsetup.exe 2488 irsetup.exe 2488 irsetup.exe 2264 BrowserInstaller.exe 2264 BrowserInstaller.exe 2264 BrowserInstaller.exe 2264 BrowserInstaller.exe 2940 irsetup.exe 2940 irsetup.exe 2940 irsetup.exe 2488 irsetup.exe 2844 jre-windows.exe 1204 Process not Found 1204 Process not Found 2040 MsiExec.exe 2040 MsiExec.exe 2040 MsiExec.exe 2040 MsiExec.exe 2040 MsiExec.exe 2040 MsiExec.exe 2040 MsiExec.exe 2040 MsiExec.exe 2040 MsiExec.exe 2040 MsiExec.exe 2040 MsiExec.exe 2388 msiexec.exe 2612 installer.exe 2612 installer.exe 2612 installer.exe 880 Process not Found 880 Process not Found 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe 2216 javaw.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1572 icacls.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0257-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0040-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0043-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0288-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0012-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0043-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0080-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0080-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0176-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0190-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0243-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0226-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0256-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0127-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0100-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0135-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0129-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0169-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0197-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0317-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0394-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0035-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0031-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0230-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0047-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0056-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0089-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0192-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0265-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0315-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0344-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0089-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0047-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0096-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0255-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0387-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0078-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0089-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0176-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0087-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0075-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0052-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0220-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0398-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0119-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0098-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0112-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0358-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0382-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe -
resource yara_rule behavioral1/files/0x000b0000000144e0-3.dat upx behavioral1/memory/2488-19-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/files/0x000400000001dc88-736.dat upx behavioral1/memory/2940-753-0x0000000001340000-0x0000000001729000-memory.dmp upx behavioral1/memory/2940-816-0x0000000001340000-0x0000000001729000-memory.dmp upx behavioral1/memory/2488-817-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/memory/2488-1380-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/memory/2488-1383-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/memory/2488-2114-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/memory/2488-2281-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/memory/2488-2392-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/memory/2488-2397-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/memory/2488-2420-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/memory/2488-2523-0x00000000002B0000-0x0000000000699000-memory.dmp upx behavioral1/memory/2488-3319-0x00000000002B0000-0x0000000000699000-memory.dmp upx -
Blocklisted process makes network request 1 IoCs
flow pid Process 25 2388 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} installer.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe File opened for modification C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\content-types.properties msiexec.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\zip.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\fxplugins.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\ssv.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\mlib_image.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\tzmappings msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip msiexec.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\deploy.jar msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\jsound.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\jli.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\calendars.properties msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf msiexec.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md msiexec.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\javaws.jar msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.cpl msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_font.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\jfr.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\fontmanager.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll msiexec.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\Installer\f769ac9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9F36.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9FC4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA041.tmp msiexec.exe File created C:\Windows\Installer\f769acc.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA2E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\f769ac9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9EB8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA0BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9D3F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA13D.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIA2E3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA372.tmp msiexec.exe File created C:\Windows\Installer\f769ace.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9DCC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9E3B.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main jre-windows.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre-1.8\\bin" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" installer.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0259-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0099-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0128-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0075-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0086-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0114-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0247-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0106-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0081-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0076-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0191-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0008-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_08" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0129-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0157-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0238-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0041-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_41" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0106-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0369-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0051-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0115-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0147-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_147" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0240-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_240" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0249-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_249" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0309-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0314-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0140-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0266-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0037-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0083-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0104-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0209-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0205-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0037-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0124-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_124" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0197-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0249-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0332-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0063-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0071-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0164-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0143-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0080-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0381-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0114-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_114" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0046-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0094-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0098-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0064-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_64" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0069-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0344-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_344" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0208-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_15" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0042-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0174-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0282-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0005-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_05" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0213-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0085-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0118-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0206-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0007-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_07" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0073-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0143-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0055-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0016-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0203-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0309-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0057-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0075-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_66" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0142-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0041-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0216-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0223-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0170-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0111-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0113-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0263-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0019-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jnlp\ = "JNLPFile" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0405-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0099-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0356-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0080-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_80" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0005-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0110-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_110" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0145-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0171-ABCDEFFEDCBB} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0391-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0237-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_237" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0058-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0133-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_16" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0202-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0338-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0359-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0373-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_373" installer.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde irsetup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2940 irsetup.exe 2940 irsetup.exe 2388 msiexec.exe 2388 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2008 jre-windows.exe Token: SeIncreaseQuotaPrivilege 2008 jre-windows.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeSecurityPrivilege 2388 msiexec.exe Token: SeCreateTokenPrivilege 2008 jre-windows.exe Token: SeAssignPrimaryTokenPrivilege 2008 jre-windows.exe Token: SeLockMemoryPrivilege 2008 jre-windows.exe Token: SeIncreaseQuotaPrivilege 2008 jre-windows.exe Token: SeMachineAccountPrivilege 2008 jre-windows.exe Token: SeTcbPrivilege 2008 jre-windows.exe Token: SeSecurityPrivilege 2008 jre-windows.exe Token: SeTakeOwnershipPrivilege 2008 jre-windows.exe Token: SeLoadDriverPrivilege 2008 jre-windows.exe Token: SeSystemProfilePrivilege 2008 jre-windows.exe Token: SeSystemtimePrivilege 2008 jre-windows.exe Token: SeProfSingleProcessPrivilege 2008 jre-windows.exe Token: SeIncBasePriorityPrivilege 2008 jre-windows.exe Token: SeCreatePagefilePrivilege 2008 jre-windows.exe Token: SeCreatePermanentPrivilege 2008 jre-windows.exe Token: SeBackupPrivilege 2008 jre-windows.exe Token: SeRestorePrivilege 2008 jre-windows.exe Token: SeShutdownPrivilege 2008 jre-windows.exe Token: SeDebugPrivilege 2008 jre-windows.exe Token: SeAuditPrivilege 2008 jre-windows.exe Token: SeSystemEnvironmentPrivilege 2008 jre-windows.exe Token: SeChangeNotifyPrivilege 2008 jre-windows.exe Token: SeRemoteShutdownPrivilege 2008 jre-windows.exe Token: SeUndockPrivilege 2008 jre-windows.exe Token: SeSyncAgentPrivilege 2008 jre-windows.exe Token: SeEnableDelegationPrivilege 2008 jre-windows.exe Token: SeManageVolumePrivilege 2008 jre-windows.exe Token: SeImpersonatePrivilege 2008 jre-windows.exe Token: SeCreateGlobalPrivilege 2008 jre-windows.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe Token: SeRestorePrivilege 2388 msiexec.exe Token: SeTakeOwnershipPrivilege 2388 msiexec.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2488 irsetup.exe 2488 irsetup.exe 2488 irsetup.exe 2488 irsetup.exe 2940 irsetup.exe 2940 irsetup.exe 2008 jre-windows.exe 2008 jre-windows.exe 2008 jre-windows.exe 2008 jre-windows.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2488 1732 TLauncher-2.919-Installer-1.3.3.exe 28 PID 1732 wrote to memory of 2488 1732 TLauncher-2.919-Installer-1.3.3.exe 28 PID 1732 wrote to memory of 2488 1732 TLauncher-2.919-Installer-1.3.3.exe 28 PID 1732 wrote to memory of 2488 1732 TLauncher-2.919-Installer-1.3.3.exe 28 PID 1732 wrote to memory of 2488 1732 TLauncher-2.919-Installer-1.3.3.exe 28 PID 1732 wrote to memory of 2488 1732 TLauncher-2.919-Installer-1.3.3.exe 28 PID 1732 wrote to memory of 2488 1732 TLauncher-2.919-Installer-1.3.3.exe 28 PID 2488 wrote to memory of 2264 2488 irsetup.exe 30 PID 2488 wrote to memory of 2264 2488 irsetup.exe 30 PID 2488 wrote to memory of 2264 2488 irsetup.exe 30 PID 2488 wrote to memory of 2264 2488 irsetup.exe 30 PID 2488 wrote to memory of 2264 2488 irsetup.exe 30 PID 2488 wrote to memory of 2264 2488 irsetup.exe 30 PID 2488 wrote to memory of 2264 2488 irsetup.exe 30 PID 2264 wrote to memory of 2940 2264 BrowserInstaller.exe 31 PID 2264 wrote to memory of 2940 2264 BrowserInstaller.exe 31 PID 2264 wrote to memory of 2940 2264 BrowserInstaller.exe 31 PID 2264 wrote to memory of 2940 2264 BrowserInstaller.exe 31 PID 2264 wrote to memory of 2940 2264 BrowserInstaller.exe 31 PID 2264 wrote to memory of 2940 2264 BrowserInstaller.exe 31 PID 2264 wrote to memory of 2940 2264 BrowserInstaller.exe 31 PID 2488 wrote to memory of 2844 2488 irsetup.exe 33 PID 2488 wrote to memory of 2844 2488 irsetup.exe 33 PID 2488 wrote to memory of 2844 2488 irsetup.exe 33 PID 2488 wrote to memory of 2844 2488 irsetup.exe 33 PID 2844 wrote to memory of 2008 2844 jre-windows.exe 34 PID 2844 wrote to memory of 2008 2844 jre-windows.exe 34 PID 2844 wrote to memory of 2008 2844 jre-windows.exe 34 PID 2388 wrote to memory of 2040 2388 msiexec.exe 37 PID 2388 wrote to memory of 2040 2388 msiexec.exe 37 PID 2388 wrote to memory of 2040 2388 msiexec.exe 37 PID 2388 wrote to memory of 2040 2388 msiexec.exe 37 PID 2388 wrote to memory of 2040 2388 msiexec.exe 37 PID 2388 wrote to memory of 2612 2388 msiexec.exe 38 PID 2388 wrote to memory of 2612 2388 msiexec.exe 38 PID 2388 wrote to memory of 2612 2388 msiexec.exe 38 PID 2612 wrote to memory of 2216 2612 installer.exe 39 PID 2612 wrote to memory of 2216 2612 installer.exe 39 PID 2612 wrote to memory of 2216 2612 installer.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-2.919-Installer-1.3.3.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.919-Installer-1.3.3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.919-Installer-1.3.3.exe" "__IRCT:3" "__IRTSS:24067351" "__IRSID:S-1-5-21-2248906074-2862704502-246302768-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1679762 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1708464" "__IRSID:S-1-5-21-2248906074-2862704502-246302768-1000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2940
-
-
-
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\jds259427353.tmp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jds259427353.tmp\jre-windows.exe" "STATIC=1"4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2008 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus5⤵PID:2404
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 305⤵PID:1512
-
-
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"3⤵PID:2132
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"4⤵PID:1808
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M5⤵
- Modifies file permissions
PID:1572
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding AD8E27A78649C9D0852EC142B2DC54A42⤵
- Loads dropped DLL
PID:2040
-
-
C:\Program Files\Java\jre-1.8\installer.exe"C:\Program Files\Java\jre-1.8\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre-1.8\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={71024AE4-039E-4CA4-87B4-2F64180401F0}2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216
-
-
C:\Program Files\Java\jre-1.8\bin\ssvagent.exe"C:\Program Files\Java\jre-1.8\bin\ssvagent.exe" -doHKCUSSVSetup3⤵PID:1788
-
-
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -permissions -silent3⤵PID:1200
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵PID:2472
-
-
-
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -shortcut -silent3⤵PID:448
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵PID:2376
-
-
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 3305D9DBA7FC7471A0C7B67989F389E9 M Global\MSI00002⤵PID:632
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9617BBDED0DFA515CAC3CE24158C6BC32⤵PID:1560
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AF7FB1CBC3DCDB0E0018BAE220D757AC M Global\MSI00002⤵PID:1760
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵PID:1604
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"2⤵PID:1096
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵PID:2892
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"2⤵PID:2012
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵PID:1708
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"2⤵PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
962KB
MD5b632827d8d3b2093530284534a30e870
SHA141b84e3abf6bfb1ba5f3b352493fbc51c996e7b9
SHA25617f904c05dab4ae3b0d54e18df9a425d9d1e6400becb98f892ea9772f3bfc95b
SHA51247f95d793a86b5648e87f5a8f0053bbd7a6dd1a2e990a664fe361d2ba11ed2223d6f5dc044b31d8e4dab90563271425f3867bef2c426fb8df8c8fd78fe5502f2
-
Filesize
7KB
MD5009d8b6fe99b3132048b55b998b06646
SHA1223eea0810a15d5bea73619ec6bc1e255168fc81
SHA2564e4077f7259f9d2a33bf64b7dd8093ceaeedc6dde13e94d1c4eaa5e8814183cc
SHA5121725f35af6d2a43ec1a9f7024a03cecea885a32d474e3e146c86b55ca67d692188454bdc1c061313d30cc6c2a9949b26c97631ed849e98f45635dfd87e5a99ed
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk
Filesize197B
MD5b5e1de7d05841796c6d96dfe5b8b338c
SHA1c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547
SHA256062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d
SHA512963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d
-
Filesize
177B
MD56684bd30905590fb5053b97bfce355bc
SHA141f6b2b3d719bc36743037ae2896c3d5674e8af7
SHA256aa4868d35b6b3390752a5e34ab8e5cba90217e920b8fb8a0f8e46edc1cc95a20
SHA5121748ab352ba2af943a9cd60724c4c34b46f3c1e6112df0c373fa9ba8cb956eb548049a0ac0f4dccff6b5f243ff2d6d210661f0c77b9e1e3d241a404b86d54644
-
Filesize
173B
MD5625bd85c8b8661c2d42626fc892ee663
SHA186c29abb8b229f2d982df62119a23976a15996d9
SHA25663c2e3467e162e24664b3de62d8eeb6a290a8ffcdf315d90e6ca14248bc0a13a
SHA51207708de888204e698f72d8a8778ed504e0fe4d159191efb48b815852e3997b50a27ba0bc8d9586c6fb4844166f38f5f9026a89bbbc3627e78121373982656f12
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize471B
MD517965f5ac37a3d2a0e07c0d41f7d4196
SHA1b82ccf16459772f471d2fe330dd3376d09bb6eec
SHA256819ce2088812aa36c3ab0ad9884d57ce81db03be13aa1200c9ea6abe06d5f9d1
SHA5120b84bbac81ace00a670ad65cc73edb6cd87234dc795d03263f1d4dacef440fbc424544ab1d3fa97b8766b01b44fdcef92f2ac9b0b258059fc223175b8f497492
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abafc0c939a3dd67d72b647c75c6dd11
SHA1c084b151e510d9fae2d342a83bc620be15d8636b
SHA256e681ed1647c44967cf6eaa9dc19834bacc09b1f44435c006ce382e52b076ed5e
SHA512d9e2e858823c69cb3698da1d276985f9745eaa3d2b2b39ffb9d127ea2bec5731b030d079a2fad42a8c8e42c470b4ea1a14d3be12ac9911eab60658dcd52b5403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53778d90e49743b7243e32a7c2d7bca10
SHA1d7a891e95b26e002269380653814e11beb39c18d
SHA2567299e314f111c0230c515dd997bbbe8cbaeb2937a349d6e34b70f71a4dccca35
SHA512f56aa685a3eaa5091ff74485b9050c003fd78dac71107edebc45535e15778ff0ca0ec22283d333f1099f78d23d64b113b8bf75e733327d8d59354a91f39e8206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4cbf848466e15fabe5ab83e0eb43dc2
SHA1c26ce9694b5b29efd8deca411cd50ae5c1e1bba7
SHA25663e04c70ff99d9fae4932ba8938e5ef8139ca301a49a5ef9b3c12029ac5d8552
SHA5126d7347c1ce5d16a414d32492a69fb968e0cf07bdb06b364353df2b4ca1663aa2002a4768d842fdde59e43eddf2cdcd679935d518afba36948aa7dc8fd5eec8b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize400B
MD587b1a68e1a9b6e4cc2ab2f607dbc753c
SHA13658012c7224b38fb75a4c3c66f81933b5bba80d
SHA25695f203235880483486005fb8b2a8afd239dfeae100158d9fbb5e9cfacf128747
SHA5126d21e31c9128706774f0e437a604b19a8b26d8641b776d2d1d1791f3e985e370e851890aab15ce4a46ca36c269789b662c35988f8ee3c36c41f7f0785cb87878
-
Filesize
60.9MB
MD54b80c230492aedab6757f904167b4e17
SHA1ca169fc089c12341ac8a023e98e5f7d58a1d5d90
SHA2560d961da2bc9f0fe029c31beb616d5069b718abd7f494f28a86fc6ace8e4718ea
SHA512fcfbaa9c987bda1143f2596aca5bb3c04eebbb8ff7cacb9f855ef66d4c1b433a0a07c9694dcaff56f481df0234e8cc833e0c4b66aa52c2541db5fc562a741aca
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\673IEUYT\common[1]
Filesize1KB
MD5f5bb484d82e7842a602337e34d11a8f6
SHA109ea1dee4b7c969771e97991c8f5826de637716f
SHA256219108bfef63f97562c4532681b03675c9e698c5ae495205853dbcbfd93faf1a
SHA512a23cc05b94842e1f3a53c2ea8a0b78061649e0a97fcd51c8673b2bcb6de80162c841e9fdde212d3dfd453933df2362dcb237fe629f802bafaa144e33ca78b978
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\rtutils[1]
Filesize244B
MD5c0a4cebb2c15be8262bf11de37606e07
SHA1cafc2ccb797df31eecd3ae7abd396567de8e736d
SHA2567da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1
SHA512cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\runtime[1]
Filesize42KB
MD55d4657b90d2e41960ebe061c1fd494b8
SHA171eca85088ccbd042cb861c98bccb4c7dec9d09d
SHA25693a647b1f2cadcbdb0fe9c46b82b2b4baf7685167de05933811549145c584ee0
SHA512237738c0a6cb25efe29effc9c3637245e3e2397207ed51e67bae5a1b54749f88e090de524f7868d964debbb29a920a68205ccbd2dfceed4a1f3cd72d08b16fa3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IFGNZ1XG\host[1]
Filesize1KB
MD5a752a4469ac0d91dd2cb1b766ba157de
SHA1724ae6b6d6063306cc53b6ad07be6f88eaffbab3
SHA2561e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3
SHA512abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IFGNZ1XG\layout[1]
Filesize2KB
MD5cc86b13a186fa96dfc6480a8024d2275
SHA1d892a7f06dc12a0f2996cc094e0730fe14caf51a
SHA256fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058
SHA5120e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IFGNZ1XG\masthead_left[1]
Filesize4KB
MD5b663555027df2f807752987f002e52e7
SHA1aef83d89f9c712a1cbf6f1cd98869822b73d08a6
SHA2560ce32c034dfb7a635a7f6e8152666def16d860b6c631369013a0f34af9d17879
SHA512b104ed3327fed172501c5aa990357b44e3b31bb75373fb8a4ea6470ee6a72e345c9dc4bcf46a1983c81adb567979e6e8e6517d943eb204c3f7fac559cd17c451
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\l10n[1]
Filesize4KB
MD51fd5111b757493a27e697d57b351bb56
SHA19ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711
SHA25685bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f
SHA51280f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\masthead_fill[1]
Filesize1KB
MD591a7b390315635f033459904671c196d
SHA1b996e96492a01e1b26eb62c17212e19f22b865f3
SHA256155d2a08198237a22ed23dbb6babbd87a0d4f96ffdc73e0119ab14e5dd3b7e00
SHA512b3c8b6f86ecf45408ac6b6387ee2c1545115ba79771714c4dd4bbe98f41f7034eae0257ec43c880c2ee88c44e8fc48c775c5bb4fd48666a9a27a8f8ac6bcfdcb
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
116KB
MD5e043a9cb014d641a56f50f9d9ac9a1b9
SHA161dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA2569dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA5124ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
-
Filesize
1.6MB
MD583a8f0546164c9ba1a248acedefd6e5d
SHA17652f353ed74015e7e78bc9f9e305a48d336b6d1
SHA256e7c5072ec60d32022b3c818c527ad86f4985837a4f0e9fc6477f54ae86d9f1c9
SHA512111d11acdaef0036ff5cabeb16ed55bf4c681fa6eb3c006af450a0ebadae3e213a8f3abb0f4a9aecc8e893af7a79b4eb7f74a5fc3743e338c3e3136b5d7f9f2d
-
Filesize
12KB
MD53adf5e8387c828f62f12d2dd59349d63
SHA1bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA2561d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
SHA512e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
-
Filesize
43KB
MD575decfe97d92fa34481d3b502316fd2f
SHA1b98065fcacb2e19cb67eec0bf6f2fce53403b38b
SHA256247a19e724dc8cf8ff5d3dce60fdc12c839e55149670d0366b362d827f7d0a91
SHA51210dfd147f5366143357de272b0f2ff2db517c0a9b6b5da2956b52a5bd141c8d6898d0575d3efec3b146fe194eafa3b8cc968bbc5dcf6776de2d16cb62eb85aea
-
Filesize
644B
MD5e9f67b64d881a992b1cfd8e3530cca32
SHA12a94600e58d1d88e7ddd19419b98c58cb3202be3
SHA256b1b65f3ef3b45ea3d98a19c8b1b2dcc25c54a2a5887525724434ec64d7677089
SHA5120d1bf5b51368132b9bae5510227e15ff9d4c68716b2760950adef49735553f4c721067ee4867255607d492a9f756e5501ea1095dd0ed35b65aba6a7122b16635
-
Filesize
40KB
MD57c707de88ac21b3c96714ec7518a23e3
SHA1c0ad9f5ad7e0584a1734c6c8123883c3c938a3e8
SHA256a4ea28436ddb281bd848406fc8136a15738ff86ebf5f7e1925f69accb97d6dc2
SHA512403fd9ef1071ed76fd25a9d67e8084de0f5954d1864bc49cdfd68b24c6869c5b079f46a11ee086c57f831a61db27394f7b96c5355f0fe111ddc1284971e53ad1
-
Filesize
12KB
MD5f35117734829b05cfceaa7e39b2b61fb
SHA1342ae5f530dce669fedaca053bd15b47e755adc2
SHA2569c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
SHA5121805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
-
Filesize
12KB
MD5f5d6a81635291e408332cc01c565068f
SHA172fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA2564c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
SHA51233333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
-
Filesize
438B
MD5121558ff4a60cbdd63a2c563f64e3a8d
SHA1c5a58189193a6dd14ecea5e8f9abfa534182afab
SHA25657e4e472dd3e5a8d82a63b607d79e9d96ed42c69bca5d3f9aa4b1a338ff7318c
SHA51236b2366bd1fa8597c20ff43b041c5dc1c62183ba536dea31ca1125cc1f99ff1dcb7e907959d6f0672e57ed82be585615ceaa6b963a8b5e540510d329c610a267
-
Filesize
136KB
MD51ffd93751bc3400074dc0affa49ddfaf
SHA181be618514bdb88161333386f326cfcac2075517
SHA256e65cc17886b8632c1ff12ff8a97128d3ca379a6b9ad2c0300788f43958c458be
SHA512b2aefcf3a2f3e4da57c3507f7b419d229985cee88c782232dd90a96a6e9dbe46c18a7a58c7c4d1a3fe4b8b4b187f884fa09ac9e9a70d179e941704d7cbfddb30
-
Filesize
64.0MB
MD596d622d62567def49ad8999324a66709
SHA15a4749631631d97e9db816f5cca2392e69d0b7d9
SHA256953b06705f72bfffac774c41ceb359fe1d3f8a0c5d6a44f93597ce9c39399994
SHA512c2d350895f47c5164138d2e3befbeb0acda8097a7904a28d9ad9db70ea0aabb3ec54a476dcb2746a41308fb79616d810305c53f7e23a4856a3f9eb656896de0d
-
Filesize
1KB
MD5642df0b6f7cb14bb764c997836780ebc
SHA10928fa67266781de2cb7b508640fe402a48e9539
SHA2562a5f0863c26523d444864d8a7260443d47f8e889a48dc9a9fdfe99b068e2622d
SHA512b91da0d3d558daff09d17a9ef1ef240fb93023eb52c3bb5d6b1cf0ca71a8c3e5d5f8f575f80ddb4348c7c93ebb0490453526f7e1db5f753bf57463d0b108a075
-
Filesize
3KB
MD5dfeacc296b3fbf36170f4eec1463a613
SHA1d601b6307b83b3da7ba01ed72111cc8783e878b5
SHA25631b913699cbce1b6ee58a8b44e644cb816520118349119f331d006d04c2dec45
SHA5122be3be9b74bfbbd2f5ee8ef9ebbbca9005f735b66011d2896f178a21e277fbcb141af76a40a103ff7c0514c2bcec68352687b1985c3f59f11d005391e877df67
-
Filesize
4KB
MD568060cc017e4615b50af2566b89e1569
SHA1d9b77244d68749811bc18444bd72750d664c1743
SHA2568100d9e5393d8bc8ffdd8cca9789142e90f624aed79d50f9a51099d9ecb20cb8
SHA51251ca3cfe059830d963562a9c8676b5f033cf0f17ae4551c05aec42080f97bda0eee376c137160e22bc3e0fef46139706e837134d46ffd1e1c100b7fa777b6a5d
-
Filesize
23KB
MD5d3fc456a27adfceac4e03c88abafe323
SHA149c142b99b5fffdcb9d2e48a0474d20516ea372a
SHA256ff7aa52d14967b99046d96d6458712e192df44645486a6326d49afcc2cac5522
SHA5128ba48bb2a4731b019cd43034be18da25fa9e629132d6a67e60a5da4a7683e99065617de8d7196c18398eb1925fb1fbc19d26b06642c0cf3cd25c27c141b30bea
-
Filesize
741B
MD51178db51754a0e1eecb82c0df50b222b
SHA1287e191b8f90d2c88671de39098df3e450c5d309
SHA2569cbd0658b652f21ebacf6e81dd033b7921bf3309d1e01cdc52a5351b8b630097
SHA5122f21d43d97ce002447bf4278deba1399983e3244f0f3383be252f03be92b3adad2a062ff006aa736bd9ba3c9c679ae900c3b3fe350e0d91cea0767c4cf69387d
-
Filesize
9.1MB
MD54f7fa4dee62924a4fd3b726cc150c256
SHA1684319e7c90f8101980c88e9b327eaf3e00c3aa1
SHA25616ee6b2cb0ad4b9e862bc8511dc916c6fcfa3e1898e4f8d96ee3ce98a1e84401
SHA512a3a38b96e7376d083edeef681a5eec21baee2e736547840ed6e41397f85c917e25c57d9201df9fdc9c0140a7fac4cf775d7af2d218646cd921d5b468b21a1c66
-
Filesize
45KB
MD5300bf5341502ba7eee93c2b16c63af7a
SHA1c0b30be839455dfe2f514c07c52dd085392bb022
SHA256046d24487296987dd7126d52df2bcf36040bb573f8fa695018e255b48200f7b2
SHA5127720d9e1b94bcd4480100d430bb103d332214b7062212a33e066e60457659645251b86c1e331b1afd872ac5cae1835b826c94f9400c56bc40fd43ba1c4daa6a7
-
Filesize
206B
MD5e5d58eadbf836dd10e686eebc3a5be5c
SHA1d1ca91793d766019ddb08e92e8734b0dcc866c46
SHA2561d55e1a2619072c43fde1846479bdf096de360fe157939569965e75bebd1a4b2
SHA512c52187077ef449bcd85424cd629390752998e4fc492dbe22ad3a9ec1b757e68d2901d491dffdfaed1269f8c8022adafa3987c4c2b55428262d0dc9052b6ce60d
-
Filesize
41KB
MD544b7f88f828cb198ef4d3bb74c491da9
SHA1e152b950eae01d9f8a3255bfc1576f63239d73ea
SHA2564f0d9bddf74090d9deaf5fa332e93ce98ab673ca9d4a7ae722a8641bfb572c2f
SHA5129d97e8d8e93112f93d21428fbb8170d699973bcb28604b49541c0f20d6b0b803fcc9bb4ce0c55f03912675c08963d33490c0dabc9bba9524f2d6bc224e95ec78
-
Filesize
475B
MD5ff54bcac65743e803865f43f041284b2
SHA14ab743a7d2a0a9a5237c1d503f134339e4d31f7a
SHA256c0506574d1b5b01f7906fd8c6baf99e9631f6a204d1ab5b8c5bd8f6bbd907743
SHA5123b21c743ffdec316597c143cd293bb98fb58da911ba9af5c1df8e602082b75b131ec3d8bb3b07d89bbe589f3e062fbe1bb70e57176ee1de10bfc5f30b76f63c6
-
Filesize
368B
MD59a922807c184a7f18f808735ac851f3b
SHA1142c5e76464e31ce99795f0126e284c25d11040c
SHA256a576357ae47d4bb1aa07fb6a503c1f88e55467c97275e85f48792c0351f7e408
SHA51238f2c9c5881ba07fccebcef28c5a7b75b72fea8d30e7049b62142868c803be6e01409d8bd6e371c5bb6188eef505e268274894a9a8ebd65053f35f8d53f1ed3a
-
Filesize
18KB
MD53bdf235f93674d1b6dcaa407668086d8
SHA15d13ec9b8f9ffee2fbc77454a79444d887981cb1
SHA256ec38caf820d42f56b1734240dd749bbe20c295b069f172af25b6ba0197cfb816
SHA5126fe52c08407c4bb3501b14557e847eee2ce87c0660bdd08d9f3816ca665358b49722d982b9cfee1bf41524805d764959643a572c8d086a71d7eb3512eab7d40a
-
Filesize
4KB
MD5196566efa6012836eb7dbff1b8cfd199
SHA1749c62d50665e5a4c4e857c4cd977d364d19f5bd
SHA2565aaba6de85eae4e9d6b0cae21133d44a8a78318439b672a1d3077b7eeff58fd0
SHA512993bbf9937b85724863fdc09cf1277611d22b9ab789e52d431790917992b2f7e921cf3bb3d7c0508f7116c43ed091e8f6af748dc8f1b1e9b6244e722277d4c3d
-
Filesize
867B
MD58f97666b05ae3b034adccd5140363d59
SHA143de7b977b8db916712057b58c4dc7f2fc409b7a
SHA2560895175844007f006edb994a5936d322fce4c94917c208da055194d598fa2146
SHA5128a87dbad4ecc3a2eb5f435e6df8662a4bce1818e92a465e9ebb242761353c2741b320926fe70bc089b3ab5ec561f13d39f36b41da0dafa434b07355dd7598629
-
Filesize
1.0MB
MD5d7390d55b7462787b910a8db0744c1e0
SHA1b0c70c3ec91d92d51d52d4f205b5a261027ba80c
SHA2564a2f7d9d33e4ad643bf72722587f2b268d92dab3bb1d9bc56af316672e34728a
SHA51264f3837dd6099561ce9be97d6fae0b11f3f6cc08281f1a3266d5a6f3ca8baf13bbd780735ef62b449b577d62d086f942b48519671226c60f0e1480f9dbdde434
-
Filesize
1.7MB
MD5dabd469bae99f6f2ada08cd2dd3139c3
SHA16714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b
SHA25689acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606
SHA5129c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915
-
Filesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
Filesize
1.2MB
MD585772cc6142fd068e316f5bcdfb9fa18
SHA12b6169f71860685189abef7c46a271b43a6af36b
SHA256b5e561a9e6aa55cdde55a182aa753b726dd9ce299d1734824ea4ef4f0a1775a8
SHA5120f03c69813b366ee352c5fc0209fe4a7dc257230f82afdda75d97d7676ff1abf30bc09cb900ce28916e9ee07e5b9f850c4f3ec803c0d23cd572ffee928d0418d
-
Filesize
325KB
MD5c333af59fa9f0b12d1cd9f6bba111e3a
SHA166ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0
SHA256fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34
SHA5122f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4
-
Filesize
1.2MB
MD5a266e0ae1001da0023f9664afbcaee99
SHA1f943c180e5221a5943039c21b21f394dd99cbe14
SHA256819b9a02a788445ad6c4d8f38e05abe911e289e71e4d2c2e37923c9f66f576cf
SHA512525b8473b17732ba94942df63b0e43b26ee0157b137a1a39f52034b04ce686097e92ec8d9ea422acf02edc4385863c0179a6af73af01dfcfc1cb6d7c9dad1e7c
-
Filesize
64.4MB
MD5af1d24091758f1e02d51dc5f5297c932
SHA1dc3f98dded6c1f1e363db6752c512e01ac9433f3
SHA256e52a8d0337bae656b01cb76c03975ac3d75ac4984c028ba2a6531396dea6dddd
SHA5128d4264a6b17f7bbfd533b11ec30d7754a960a9f2fbef10c9977b620051c5538d8eb6080ea78e070904c7c52a6ce998736fad2037f6389ad4c5c0ce3f1d09e756
-
Filesize
953KB
MD564a261a6056e5d2396e3eb6651134bee
SHA132a34baf051b514f12b3e3733f70e608083500f9
SHA25615c1007015be7356e422050ed6fa39ba836d0dd7fbf1aa7d2b823e6754c442a0
SHA512d3f95e0c8b5d76b10b61b0ef1453f8d90af90f97848cad3cb22f73878a3c48ea0132ecc300bfb79d2801500d5390e5962fb86a853695d4f661b9ea9aae6b8be8