221e13e2a62ebb6df7d0c486af65b42841c03b62bf72e12b8563cffbb5d61c59

Analysis

max time kernel
161s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae07b234f8fa3bfb1bc427a933f6f21b.exe
Size 198KB
Sample240229-jd6bkaac91
SHA256 221e13e2a62ebb6df7d0c486af65b42841c03b62bf72e12b8563cffbb5d61c59
MD5 ae07b234f8fa3bfb1bc427a933f6f21b
SHA1 b90231f70d28bec1b86b0d9ddcb774c6a9a464a1
SHA512 481dcf92b3ebab25012f82b96ac17d6301dd8ec8d61fc0343887b9273f7dc3e8f77f49ad31bf6338262ec868e171ae3273943bccd2a038bdb6c495fe1b03d85b
SSDEEP 6144:S1EqCsvjWnGhdoGroYlGR8FnxdjFwQoS3Ov:S1EqCCVjTocnPjFnoS38
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	ae07b234f8fa3bfb1bc427a933f6f21b.exe

Executes dropped EXE 15 IoCs

pid	Process
4092	javaSetup.exe
4368	unpack200.exe
5020	unpack200.exe
3328	unpack200.exe
5072	unpack200.exe
4048	unpack200.exe
232	unpack200.exe
2928	unpack200.exe
3120	unpack200.exe
4500	javaw.exe
4496	javaws.exe
2140	javaw.exe
5012	jp2launcher.exe
1048	javaw.exe
4584	javaw.exe

Loads dropped DLL 45 IoCs

pid	Process
4380	MsiExec.exe
3440	MsiExec.exe
4368	unpack200.exe
5020	unpack200.exe
3328	unpack200.exe
5072	unpack200.exe
4048	unpack200.exe
232	unpack200.exe
2928	unpack200.exe
3120	unpack200.exe
4500	javaw.exe
4500	javaw.exe
4500	javaw.exe
4500	javaw.exe
4500	javaw.exe
3440	MsiExec.exe
3440	MsiExec.exe
3440	MsiExec.exe
3440	MsiExec.exe
4496	javaws.exe
2140	javaw.exe
2140	javaw.exe
2140	javaw.exe
2140	javaw.exe
2140	javaw.exe
5012	jp2launcher.exe
5012	jp2launcher.exe
5012	jp2launcher.exe
5012	jp2launcher.exe
5012	jp2launcher.exe
5012	jp2launcher.exe
5012	jp2launcher.exe
5012	jp2launcher.exe
5012	jp2launcher.exe
5012	jp2launcher.exe
1048	javaw.exe
1048	javaw.exe
1048	javaw.exe
1048	javaw.exe
1048	javaw.exe
4584	javaw.exe
4584	javaw.exe
4584	javaw.exe
4584	javaw.exe
4584	javaw.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4180-0-0x00000000004C0000-0x0000000000546000-memory.dmp	upx
behavioral2/memory/4180-71-0x00000000004C0000-0x0000000000546000-memory.dmp	upx
behavioral2/memory/4184-76-0x00000000004C0000-0x0000000000546000-memory.dmp	upx
behavioral2/memory/4180-1647-0x00000000004C0000-0x0000000000546000-memory.dmp	upx

Blocklisted process makes network request 1 IoCs

flow	pid	Process
69	4572	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	MsiExec.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\javaw.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\javaws.exe	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Panama	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\Mawson	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\calendars.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\security\local_policy.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Kamchatka	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Budapest	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\meta-index	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Halifax	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Darwin	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Amsterdam	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Efate	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\glib-lite.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\splashscreen.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\content-types.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\jsse.pack	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Boise	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Volgograd	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\cmm\GRAY.pf	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Adak	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\San_Luis	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Mexico_City	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Oral	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\messages_fr.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\management-agent.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Chuuk	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\ext\jaccess.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Eucla	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT-3	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Dili	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Sydney	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\UCT	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\sound.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Windhoek	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Ashgabat	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Dhaka	MsiExec.exe
File created	C:\PROGRA~2\Zona\README.txt	javaw.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\ZoneInfoMappings	MsiExec.exe
File created	C:\PROGRA~2\Zona\torrent.ico	javaw.exe
File created	C:\Program Files (x86)\Java\jre7\lib\security\java.policy	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\Casey	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Yakutsk	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT-8	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Prague	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\Macquarie	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\South_Georgia	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Adelaide	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\JAWTAccessBridge-32.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\flavormap.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Miquelon	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Yakutat	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\PST8	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Jamaica	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Porto_Velho	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Kuala_Lumpur	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jabswitch.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\pack200.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\sunmscapi.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\Jujuy	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Marengo	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\npjpi170_80.dll	MsiExec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e580887.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F03217080FF}	msiexec.exe
File created	C:\Windows\Installer\e58088b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI172F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e580887.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC3.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1029.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "40356604"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0038-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0051-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0075-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0084-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0052-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_52"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_46"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_71"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0063-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0045-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0081-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_07"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0094-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_27"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_40"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0063-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_63"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_65"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_03"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_14"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_03"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_18"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_01"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.0_02"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0071-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0058-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_54"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0095-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_27"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0081-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_08"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0035-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_35"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0019-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0035-ABCDEFFEDCBA}	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0041-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0042-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_30"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0044-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_44"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0070-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0083-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_14"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0076-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_76"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0037-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_37"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_54"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0074-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0035-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_35"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_10"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/java-deployment-toolkit\CLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_13"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0061-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0095-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0069-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0092-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_10"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_43"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_25"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.0_03"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0028-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_17"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_50"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0084-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0050-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_50"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5012	jp2launcher.exe
5012	jp2launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1504	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1504	msiexec.exe
Token: SeSecurityPrivilege	4572	msiexec.exe
Token: SeCreateTokenPrivilege	1504	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1504	msiexec.exe
Token: SeLockMemoryPrivilege	1504	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1504	msiexec.exe
Token: SeMachineAccountPrivilege	1504	msiexec.exe
Token: SeTcbPrivilege	1504	msiexec.exe
Token: SeSecurityPrivilege	1504	msiexec.exe
Token: SeTakeOwnershipPrivilege	1504	msiexec.exe
Token: SeLoadDriverPrivilege	1504	msiexec.exe
Token: SeSystemProfilePrivilege	1504	msiexec.exe
Token: SeSystemtimePrivilege	1504	msiexec.exe
Token: SeProfSingleProcessPrivilege	1504	msiexec.exe
Token: SeIncBasePriorityPrivilege	1504	msiexec.exe
Token: SeCreatePagefilePrivilege	1504	msiexec.exe
Token: SeCreatePermanentPrivilege	1504	msiexec.exe
Token: SeBackupPrivilege	1504	msiexec.exe
Token: SeRestorePrivilege	1504	msiexec.exe
Token: SeShutdownPrivilege	1504	msiexec.exe
Token: SeDebugPrivilege	1504	msiexec.exe
Token: SeAuditPrivilege	1504	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1504	msiexec.exe
Token: SeChangeNotifyPrivilege	1504	msiexec.exe
Token: SeRemoteShutdownPrivilege	1504	msiexec.exe
Token: SeUndockPrivilege	1504	msiexec.exe
Token: SeSyncAgentPrivilege	1504	msiexec.exe
Token: SeEnableDelegationPrivilege	1504	msiexec.exe
Token: SeManageVolumePrivilege	1504	msiexec.exe
Token: SeImpersonatePrivilege	1504	msiexec.exe
Token: SeCreateGlobalPrivilege	1504	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5012	jp2launcher.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2260	4180	ae07b234f8fa3bfb1bc427a933f6f21b.exe	87
PID 4180 wrote to memory of 2260	4180	ae07b234f8fa3bfb1bc427a933f6f21b.exe	87
PID 4180 wrote to memory of 2260	4180	ae07b234f8fa3bfb1bc427a933f6f21b.exe	87
PID 4180 wrote to memory of 4184	4180	ae07b234f8fa3bfb1bc427a933f6f21b.exe	93
PID 4180 wrote to memory of 4184	4180	ae07b234f8fa3bfb1bc427a933f6f21b.exe	93
PID 4180 wrote to memory of 4184	4180	ae07b234f8fa3bfb1bc427a933f6f21b.exe	93
PID 4184 wrote to memory of 4092	4184	ae07b234f8fa3bfb1bc427a933f6f21b.exe	98
PID 4184 wrote to memory of 4092	4184	ae07b234f8fa3bfb1bc427a933f6f21b.exe	98
PID 4184 wrote to memory of 4092	4184	ae07b234f8fa3bfb1bc427a933f6f21b.exe	98
PID 4092 wrote to memory of 1504	4092	javaSetup.exe	99
PID 4092 wrote to memory of 1504	4092	javaSetup.exe	99
PID 4092 wrote to memory of 1504	4092	javaSetup.exe	99
PID 4572 wrote to memory of 4380	4572	msiexec.exe	101
PID 4572 wrote to memory of 4380	4572	msiexec.exe	101
PID 4572 wrote to memory of 4380	4572	msiexec.exe	101
PID 4572 wrote to memory of 3440	4572	msiexec.exe	102
PID 4572 wrote to memory of 3440	4572	msiexec.exe	102
PID 4572 wrote to memory of 3440	4572	msiexec.exe	102
PID 3440 wrote to memory of 4368	3440	MsiExec.exe	103
PID 3440 wrote to memory of 4368	3440	MsiExec.exe	103
PID 3440 wrote to memory of 4368	3440	MsiExec.exe	103
PID 3440 wrote to memory of 5020	3440	MsiExec.exe	106
PID 3440 wrote to memory of 5020	3440	MsiExec.exe	106
PID 3440 wrote to memory of 5020	3440	MsiExec.exe	106
PID 3440 wrote to memory of 3328	3440	MsiExec.exe	107
PID 3440 wrote to memory of 3328	3440	MsiExec.exe	107
PID 3440 wrote to memory of 3328	3440	MsiExec.exe	107
PID 3440 wrote to memory of 5072	3440	MsiExec.exe	108
PID 3440 wrote to memory of 5072	3440	MsiExec.exe	108
PID 3440 wrote to memory of 5072	3440	MsiExec.exe	108
PID 3440 wrote to memory of 4048	3440	MsiExec.exe	109
PID 3440 wrote to memory of 4048	3440	MsiExec.exe	109
PID 3440 wrote to memory of 4048	3440	MsiExec.exe	109
PID 3440 wrote to memory of 232	3440	MsiExec.exe	110
PID 3440 wrote to memory of 232	3440	MsiExec.exe	110
PID 3440 wrote to memory of 232	3440	MsiExec.exe	110
PID 3440 wrote to memory of 2928	3440	MsiExec.exe	111
PID 3440 wrote to memory of 2928	3440	MsiExec.exe	111
PID 3440 wrote to memory of 2928	3440	MsiExec.exe	111
PID 3440 wrote to memory of 3120	3440	MsiExec.exe	113
PID 3440 wrote to memory of 3120	3440	MsiExec.exe	113
PID 3440 wrote to memory of 3120	3440	MsiExec.exe	113
PID 3440 wrote to memory of 4500	3440	MsiExec.exe	114
PID 3440 wrote to memory of 4500	3440	MsiExec.exe	114
PID 3440 wrote to memory of 4500	3440	MsiExec.exe	114
PID 4496 wrote to memory of 2140	4496	javaws.exe	118
PID 4496 wrote to memory of 2140	4496	javaws.exe	118
PID 4496 wrote to memory of 2140	4496	javaws.exe	118
PID 4496 wrote to memory of 5012	4496	javaws.exe	119
PID 4496 wrote to memory of 5012	4496	javaws.exe	119
PID 4496 wrote to memory of 5012	4496	javaws.exe	119
PID 4180 wrote to memory of 1048	4180	ae07b234f8fa3bfb1bc427a933f6f21b.exe	120
PID 4180 wrote to memory of 1048	4180	ae07b234f8fa3bfb1bc427a933f6f21b.exe	120
PID 4180 wrote to memory of 1048	4180	ae07b234f8fa3bfb1bc427a933f6f21b.exe	120
PID 4184 wrote to memory of 4584	4184	ae07b234f8fa3bfb1bc427a933f6f21b.exe	121
PID 4184 wrote to memory of 4584	4184	ae07b234f8fa3bfb1bc427a933f6f21b.exe	121
PID 4184 wrote to memory of 4584	4184	ae07b234f8fa3bfb1bc427a933f6f21b.exe	121

C:\Users\Admin\AppData\Local\Temp\ae07b234f8fa3bfb1bc427a933f6f21b.exe
"C:\Users\Admin\AppData\Local\Temp\ae07b234f8fa3bfb1bc427a933f6f21b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\cscript.exe
  cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
  2⤵
  PID:2260
- C:\Users\Admin\AppData\Local\Temp\ae07b234f8fa3bfb1bc427a933f6f21b.exe
  "C:\Users\Admin\AppData\Local\Temp\ae07b234f8fa3bfb1bc427a933f6f21b.exe" /asService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\javaSetup.exe" /s REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi" REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0 /qn METHOD=joff
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1504
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Roaming\Zona\tmp\Zona.7z" "C:\PROGRA~2\Zona" "C:\Users\Admin\AppData\Local\Temp\zonaErr_core_-204770413.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:4584
- C:\Program Files (x86)\Java\jre7\bin\javaw.exe
  "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" ru.megamakc.core.JavaArch
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1048

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C9E79DCE01EDDE87A48E015AAAC38CDF
  2⤵
  - Loads dropped DLL
  PID:4380
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1C2F354B31CF4B4596807FE54E3CDCA8 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\rt.pack" "C:\Program Files (x86)\Java\jre7\lib\rt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4368
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\charsets.pack" "C:\Program Files (x86)\Java\jre7\lib\charsets.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5020
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\deploy.pack" "C:\Program Files (x86)\Java\jre7\lib\deploy.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3328
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\javaws.pack" "C:\Program Files (x86)\Java\jre7\lib\javaws.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5072
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\plugin.pack" "C:\Program Files (x86)\Java\jre7\lib\plugin.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4048
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jsse.pack" "C:\Program Files (x86)\Java\jre7\lib\jsse.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:232
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2928
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3120
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4500
- - C:\Program Files (x86)\Java\jre7\bin\javaws.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaws.exe" -fix -permissions -silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
      "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.JreLocator
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2140
  - - C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe
      "C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW5camF2YXcuZXhl -ma LWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58088a.rbs

Path C:\Config.Msi\e58088a.rbs
Size 10KB
SHA256 bad7e114380745319a3e6d88120cfe26f3f2766bec94aa2a64e93eca501f0ab1
MD5 63e071ed52eb13b5cbdb8a71eeca59c1
SHA1 30815c9c264543b2ed936104d5e55bff170ba040
SHA512 b7488c82bbbcbd39d9cffa15a1d4391ea27faccf24870d43fb87b637b2386ff053740c45fe74ed02a00fe2da45235b1cf9cb0e653a3e16eae82c2c249bf124e4
SSDEEP 192:VXaxCiGdAencKOuG0GocKOuI0eazmZqpPihwba:VXspYWWhWwJmeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCR100.dll

Path C:\Program Files (x86)\Java\jre7\bin\MSVCR100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsAccessBridge-32.dll

Path C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge-32.dll
Size 95KB
SHA256 4010a3ec604a327861bedf01626c12eaded9d381b6e4f0e6f760895838834a21
MD5 1722510af00ea3c7406681b47bf442f7
SHA1 cafac266d52d78d3743c31ebef22a894781e0de5
SHA512 31a2ce3d5eb9828cbb82d2a7e29f2c5bf46528d38f25827329512cedde37bd03b3cfdba0aba3320b6c0e7779588958e83bff735f6059aad37172598e70e863eb
SSDEEP 1536:wOW8GIF0xqg9Wr0eQPgjiKMQxSo7H0IpSiXk/LPQlswj81NowG0W:zHCxqgA7QPgjiKMvo4IpSi6U6wKKxX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll
Size 3.4MB
SHA256 500d359211ece211cf672de328345876f016fb4a476b2a03cbc3b8b89023ae1f
MD5 27147e1e3faf9b5ccda882cd96f2a85c
SHA1 7103f60121727917f812bfc7cdff5347fc17cc8e
SHA512 0866c604911e243687e7fe721142eb882b19691c902736b59ba304933463d8c9154ecc319b91c9771cee8139e151cc2a2e960bc7a93ed97352cf5232a0964194
SSDEEP 49152:ZrZNQqi9xkS7HU5kf0a5m4mDfhoobdwQC+1F8E9EYm8cBwoHmFOy8CIIaB6wwzmW:7enY5WijhooGh8cGoHm6jvcv/GnUxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

deploy.dll

Path C:\Program Files (x86)\Java\jre7\bin\deploy.dll
Size 371KB
SHA256 352707a271a9ab5d0e190a539b6468d6c6c5ce9675b300acf2305aa1f30625d8
MD5 87ec9d4a00d34eb6a0f8f92e1d1cc08e
SHA1 bee4ecae201905096dd44d1d348ecb3556d90832
SHA512 5b7f9866168ad7948a5a80078b14ff747201d17922ca907072a081e0078f6ac68446ddd36b027b4a17f5afa7d1bb4962642cff28cf66867171ebb78735f242d2
SSDEEP 6144:ZtbYrD6qqtQgirH7/W4/SDMqiJjOBCCMEdvxIW1hN:ZtbYr4tG7/W4/SDMqa4vq+hN
MD5 SHA1 SHA512 SSDEEP

Submit Download

npdeployJava1.dll

Path C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
Size 864KB
SHA256 c029fd3c6ffd2158d0633fc122786838a6f5d3cc7ef78bbe934697015c8c63dd
MD5 bc3a575dfb1a58d35e8617f2966bf1ea
SHA1 6353630f62e246d7f462134e8d10a7a42935e20f
SHA512 c976da30d343f8e104bec72300dc0c17e582e380f0a3ae85b242dbf2d5b40459feb4a3b7789fb8d755b21cbaa0940038d20dbbf1296a48e77b461092abbbe514
SSDEEP 12288:vd4rPQxptuRWuSmOqPsz9YbUOLgsxel3nvb9N3YfG2JmekTvChbOso6CyQJueOdv:F4zWuSDOsz9g1Lgsxq9N3yX4USK
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.dll

Path C:\Program Files (x86)\Java\jre7\bin\java.dll
Size 117KB
SHA256 81ad5696a6fcad89127fc7a428636d431b446ff1ee0c37bf87e8d513a8bae7af
MD5 a258a133f7d565600647a248ab95792c
SHA1 1c6a855ca1fc04413b906b0b17609eff38317161
SHA512 bf9dd97947eb0c71243ae28255af54b06d9e17af7ade666538dd93f9fdf6d8fbc3855f48bfaf6522dbd9ce3c6cff655581f092709670606d033f2321b1f4a5e7
SSDEEP 3072:gnQmO7IlruvLXTYZKj8Jq1YwEyy4YtQNAoTX0D:4h3lKvL0Ztp4K3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files (x86)\Java\jre7\bin\java.exe
Size 171KB
SHA256 c7fd72a0730b377c6da5ac80cdaf5f4cca84cc999a563a4c420fe5a8576810f8
MD5 88651044108e995f9801e35d2582491c
SHA1 abbf404c0253d085223a64ab947e1057c4211c9c
SHA512 486b1d7ad7c3debcb8d70f9351adb08c8321c4cfb409a00ff818be1dacdc376a0eded630ccdc74aa99cc472589b88c9681989076fd78eb109759d33e7bf70543
SSDEEP 3072:KnwrusR90uNHgtMhsaR2fhvTxVwEPEoTBfmabjZqMN7GLi4:wwrusb07tMfRYTxVB8oTBpvqLH
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaw.exe
Size 171KB
SHA256 844ab2231f45fad60d81770ea36d9937da9aa72cd905ce06e7471ddf9d69263b
MD5 64e2bb67ea740860510dcc5c2b6ffa2d
SHA1 6c5996358264624cdb4a075acc4f0b46177cd259
SHA512 ed24331883ada44d8b034f5c8bc458e53234109d5cd02a27989972033f5b3305d23365106ce80be81caa16e472c14c103e457a1e0d138eb0d95036e58d877462
SSDEEP 3072:Yoc9DbDDUaDxmNhrS+eEcbren+W3hYTBfBX0jZqMNSKFg:jc9bDNxmzS+a3entRYTBKvt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaws.exe
Size 266KB
SHA256 841339373958786d9c93a7dad5de8fd213ed6b5ad69623f5a5762a453c48e0a5
MD5 2b4493bb1f94580c41def972ea9a887e
SHA1 880ca8b20c6df9a6a176b91cc50304cb0fe66d06
SHA512 b43e54f2c1f3e0a3c3d2fcee518e47d17476bb735606351e41b49e97e10af758ea9a539ac370a2d12cffa93e3e752e829db969968664c59386f65b732c29e40e
SSDEEP 6144:FHNCVyL+Br9XFt6KeorPZufQ4BIGQYqFkNOjvqR7:JNH6rVtdeobZ2IjYqtjv0
MD5 SHA1 SHA512 SSDEEP

Submit Download

unpack200.exe

Path C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
Size 145KB
SHA256 c89091f2a4de2fcf10b30e54a74ec5764e2dfc0577f4f1d879ac8816e3b08bcc
MD5 0d46182b6134aa9c7acd16133d67e4c3
SHA1 7b5be3d65e5e744723bf55a08f9dc1042585d5eb
SHA512 735b6c6bd69b22a71c15ae44c6fa1693700321dc3b4b2367ce05d5c37df62e45d1d3836c2c0f5e44be1036aeb11a533c2a4dbec55163b4a15adfa1c8ef75673b
SSDEEP 1536:orhTuv/39U7QVq15jIS1mlqct2ND8h+8zu17Oq4qnToIflGIO0IOY03Gk5J0X:oGe9FIFIV8/ulphTBflkaY0Wk5J0X
MD5 SHA1 SHA512 SSDEEP

Submit Download

verify.dll

Path C:\Program Files (x86)\Java\jre7\bin\verify.dll
Size 38KB
SHA256 87d8d59972e73700507c07cee8750b0053c6a0899410338722a00c2803d39ee6
MD5 cb89b1d71061f5ec52468528ecc0b1fc
SHA1 6feb23a8b5719c8997de92c7da644807fcba8819
SHA512 2ff0ed38c7f28eb7ea16f24a0841dfb3306c4fec48ded5fddec8c3140f1a425433a444fe6b6cc4c17b3a39841c8ab0c23d7c9525c119c1b9d6daac2c17a4e4b0
SSDEEP 768:gPGXoQMYf5rFV1wleN0gzhSlAHCf4ouRHJrf4t8fnd577Iq5z:gOXJMSrufMNf4wfvIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsdetect.dll

Path C:\Program Files (x86)\Java\jre7\bin\wsdetect.dll
Size 159KB
SHA256 2ef891881d506084ed182a0ac58b10dbe8c45877ef889ac9105f19431beee4ca
MD5 958bc8d82e4d0a5b51536bb4fc4fb6d6
SHA1 626312fa01c72ec5c85c9262ba0ae97a8b1f5b25
SHA512 fe17b58e3eed817619bebf6d091aee99fdc331c9c5a4163e9f5993b41b2e7362365da210e0636755ada6b8838012de1bc5435b8670aa12f378a3c9e3a9f5af04
SSDEEP 3072:gLutxFjfIlYey8KP0+KbMcfyMvc0crTwC7bd2:gLunFzIqey5P0bbVrchrTwC7x2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path C:\Program Files (x86)\Java\jre7\bin\zip.dll
Size 66KB
SHA256 35ce7ab154a38e97951714e17f7689873d89e8c01188de6e5cd741bc0ca3e384
MD5 1ecf056944068b933ba71cda3edc4a68
SHA1 2052b2138db0d9a368942470b41bb6fc5b1d4007
SHA512 cadf312841d392a9970cc068b72063e17454d5e6738b46ec9622257d9dfc0bcad0d9420352752bf7d8f8e8ceaf6aca97d83896f753dc12cfeac3e5efb5e1ab05
SSDEEP 1536:4UH9k47M2axhBBQq8SRlr8IOwIOpVnToIf1QfqPu:zl6u0xymp9TBf1QfqPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.zip

Path C:\Program Files (x86)\Java\jre7\core.zip
Size 17.2MB
SHA256 0163c6505d0cc8d0d83298ef87398eb8d60c0c12c086a084619ab3bde4888cc6
MD5 31a2cb016fa65bac6c210a05d96d9a7f
SHA1 9340659ba19e2e796ff0aee5ca4b421120f62466
SHA512 54a0dfa19fc32753177fec1f3f67fd9380ebc69a33a2e92e8c58f21c2ee63d13fd10e5e0e1824f6abc1c3f5c8ed5b09ff32bedfdaa6cc26673648a403d0fb704
SSDEEP 196608:GDekhK8sm6Dcv/GUxoc22nzzddJXChM9xFXyX/A:GZo8/6Dcv/GUxzrnz7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

charsets.pack

Path C:\Program Files (x86)\Java\jre7\lib\charsets.pack
Size 1.3MB
SHA256 8ea5af036ec067a0abcf87b8f5921e2281ff9d259e1d4c3bbe7fa9037cd87d02
MD5 549bbcd204914b543dafee670f110834
SHA1 012461935191a55482e8c3d453d245e965a10a2a
SHA512 b0346a2ec52ce47351286f27f347f5fea99e160aedde52bcf74e1629739704bd975c9c99d8db6be3b6bd45e7fa933616fa081eda49e9b911efcc031c7241400e
SSDEEP 12288:QcvuzHfxrXJEmb5yyWMOXpyDy64BqY0qohrn2Wz/n3OEDgsa1dQnBJ4F:QcWTd5EmbmXse/0/n2cn3QF
MD5 SHA1 SHA512 SSDEEP

Submit Download

deploy.pack

Path C:\Program Files (x86)\Java\jre7\lib\deploy.pack
Size 1.7MB
SHA256 928f6b847f94b920c462a08c43f0dfd3f7c40076b1cd60545523a5c27a4870ca
MD5 b2a448112b7c886ccce9b6a3d5efd8a0
SHA1 660bc9efe960015b208a421b1a63443e7151024f
SHA512 871da63f4eaf16d77ba6c19c10d8ddd8e94f744c20a70e24793f837023d20e56698d85f67498bc06ec37b73a8f376c220afbe7f3884b00536b710ff49c339b3f
SSDEEP 24576:zdyq6mG9BvZSL4096jCVKTBtdjM8pOzoAGdoKW0IriN2:zMvO4dFWfic
MD5 SHA1 SHA512 SSDEEP

Submit Download

localedata.pack

Path C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack
Size 381KB
SHA256 faadfd9d54675378896761e69dacbd9e7496efc223e3a33fa2fbe20a8f08b42d
MD5 1f50d22c402799cc9c50c00f8f9d4f7f
SHA1 8831229125febc903ab32187dddf448ce24bc84e
SHA512 8fef94ed99cc9f361323ef2f926fcde0826c255f2fd189189ff27f2e89e491266d77ca7f58b1d49bcc6f2f62664c57c1344a7b2a378a48252f70eead77b28dd3
SSDEEP 6144:NsQuibKkQWc6VtryMehQz88dU38isnXna9stO3xY0EMgS6t6uskrqTnl:+FFkQLRQjAgM4fIuskrqTl
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.cfg

Path C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg
Size 686B
SHA256 c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88
MD5 5147cce789cd18ad6b2996eb89e5d866
SHA1 756f1fffe96ef581f0d4d47253523544c89a2622
SHA512 55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6
MD5 SHA1 SHA512

Submit Download

invalid32x32.gif

Path C:\Program Files (x86)\Java\jre7\lib\images\cursors\invalid32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
MD5 SHA1 SHA512

Submit Download

javaws.pack

Path C:\Program Files (x86)\Java\jre7\lib\javaws.pack
Size 205KB
SHA256 ee43869ee94eefe241d661101ff6a03cc276f8e558967b1b350ea088f1dad2e2
MD5 491bce42c6cd8af88a2e11f37711ed4f
SHA1 3de7c18fee44465a6afe34e068f2a64dea9fa324
SHA512 1e5f99466b77b5a82c23449434272acf5746811ef96b98105f89b3339ccd86734d7713c94b773755219345d673a761a356fbe846a38e7893bd8894e43cf102e4
SSDEEP 3072:r05V3g4qpeICnbOKxO6kzmioaxOuVhi8kV2MoOGN2jhKuCQ0nAsKu4iCp+vgn43:ruO30OekKioaQ8v29pCQivKXgO43
MD5 SHA1 SHA512 SSDEEP

Submit Download

jfxrt.pack

Path C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack
Size 3.2MB
SHA256 8c481a549acfa58b1bac0385906febe33a928d004a529fec505b6a9228678fed
MD5 dfaa6429468d56ef77932cf26a495f75
SHA1 8a21a29225640f1829ae328a24ef9cb5e215a4e0
SHA512 6c19ed573b111315648de0646441486729b304452c15b2282938460a2339db0be4e1eb19cf6f2bf17f73037811ca2553a15957ea96b9d9af64a93045407c1148
SSDEEP 49152:TIOCux2SzM48f4NCZdfyupJDyQz8YCIN5yOHgNN:BRp0ptz8YCIfHM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsse.pack

Path C:\Program Files (x86)\Java\jre7\lib\jsse.pack
Size 141KB
SHA256 9f031f2f1292bb311c400b0a93a11b78a08f013332b1263ea58617b6548862eb
MD5 31b4d9c29d29567b0ae3037fac9fbdc6
SHA1 8b5d1b1a309177466d71a742414d441f600ea38e
SHA512 b4a8a3a1e837f98a3164e19a6fe939819eb336892335de975822890b52b5923d85fee4c4e5464ccb0d46c847f37f7da98a839aadbf4d20fca355f396a53836c0
SSDEEP 3072:+btJdrAlQMcNuicXy7/Sa1hz3igGCCCCtgXiJTOyV:+RrrAlQMcN3Uy2abQ/Ok
MD5 SHA1 SHA512 SSDEEP

Submit Download

plugin.pack

Path C:\Program Files (x86)\Java\jre7\lib\plugin.pack
Size 489KB
SHA256 93defaaf7f82e2e9565b27dd31a41c89e02d1b7719d0da0b940a55dcc75b91e5
MD5 47d6cfa1b01a6d41885504bbc3b1919a
SHA1 3838060f9d530c972d65f36fa38b265120a218aa
SHA512 b0df9b174624234aaeb2b50cf611f698377925a0ae5c5ee9da46c65fcecf4d28941d1bf2332316d9327981c1f8c6c4fecf750e013f04eef63f5df52d27593135
SSDEEP 6144:pPYDxiUn5kuS7ogVc4r+cWaTu8KPVzsRnVPI6oWnfmoNOz4KMWpeNi+:pgx57IcEvWeSVzpN0OOWcNV
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.pack

Path C:\Program Files (x86)\Java\jre7\lib\rt.pack
Size 13.1MB
SHA256 82dc6806d9ec9eb16604f90a5c78d0d882b69a0e718d8f6c3c6b7c9719887b7e
MD5 b6d75e8c90c79af1579769f10b1e5c88
SHA1 146cb3f05fa161885e8faf079fa2bbd89b5c5b18
SHA512 02cdd0c0d6e71bc09120db2cd3b9471c0176567d92bb74a08c13e82c1d23722eb4afac41583a11dee3fc531fd442754ee0f5cb964898ec036ddd432947996037
SSDEEP 196608:xHWBePZbgggLYJ4329rRizU/ULUh49TXY9o9W:DPZbgggLYJ4m9CehoTo9o9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

GMT

Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT
Size 27B
SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
MD5 7da9aa0de33b521b3399a4ffd4078bdb
SHA1 f188a712f77103d544d4acf91d13dbc664c67034
SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
MD5 SHA1 SHA512

Submit Download

GMT+5

Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+5
Size 27B
SHA256 27ba8b5814833b1e8e8b5d08246b383cb8a5fb7e74e237cdbcadf320e882ab78
MD5 a2abe32f03e019dbd5c21e71cc0f0db9
SHA1 25b042eb931fff4e815adcc2ddce3636debf0ae1
SHA512 197c065b9c17c6849a15f45ac69dafa68aaa0b792219fedb153d146f23997bfa4fbc4127b1d030a92a4d7103bded76a1389df715b9539ea23ea21e6a4bb65fb2
MD5 SHA1 SHA512

Submit Download

HST

Path C:\Program Files (x86)\Java\jre7\lib\zi\HST
Size 27B
SHA256 3144bc5353ebbd941cdccbbd9f5fb5a06f38abf5cc7b672111705c9778412d08
MD5 715dc3fcec7a4b845347b628caf46c84
SHA1 1b194cdd0a0dc5560680c33f19fc2e7c09523cd1
SHA512 72ab4b4ad0990cce0723a882652bf4f37aac09b32a8dd33b56b1fbf25ac56ae054328909efd68c8243e54e449d845fb9d53dd95f47eaaf5873762fcd55a39662
MD5 SHA1 SHA512

Submit Download

MST

Path C:\Program Files (x86)\Java\jre7\lib\zi\MST
Size 27B
SHA256 0e6a7f1ab731ae6840eacc36b37cbe3277a991720a7c779e116ab488e0eeed4e
MD5 11f8e73ad57571383afa5eaf6bc0456a
SHA1 65a736dddd8e9a3f1dd6fbe999b188910b5f7931
SHA512 578665a0897a2c05eda59fb6828f4a9f440fc784059a5f97c8484f164a5fcec95274159c6ff6336f4863b942129cb884110d14c9bd507a2d12d83a4e17f596d2
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 698B
SHA256 5994477fdda635c1bf4c7f1cd8588ada30285cd01d65b6ba61cc95efad616585
MD5 7b4c5c56faa1be78119bb867ce4ae189
SHA1 1ddcebb820f5727b6426010efca54bd922af520c
SHA512 e0a85569340eea829ec63a62ad3b3ee88ad8bce5a8db7a692ff098d0ba9de054cfe58c21d3ce858596da707ed98768d28093b1ab2869956971c9259c051a9281
MD5 SHA1 SHA512

Submit Download

Data1.cab

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\Data1.cab
Size 24.6MB
SHA256 a84262dd486cf59049d0d2d9a1b00dfb5aa5271592edd8de0e052f12496dec67
MD5 003a488a2139105704566b47eb29520d
SHA1 52d672a592cd52ad5e2e7239421f2659e0d17afa
SHA512 ab34061f8e04bb1d59f1b35e0e1848a176f2b119095e79015130da3a4384c70fa35ecbe1625e07c0eb0de49c67bcdbba59f10fa1dfbbb2066dcb6ee6825215de
SSDEEP 393216:S9CUhZsoKK1mWskttt7gAbDvaywLI2tt8wTYP/LQb3044DZkPybune:J2ZsoLm7kttLbfwfmwuf1kqbune
MD5 SHA1 SHA512 SSDEEP

Submit Download

jre1.7.0_80.msi

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi
Size 898KB
SHA256 dbf28e21d55dd662cccf4d422a1a645a6a3dbfd6914942dde417d20c4d2fe01c
MD5 e24d9b483ce7a3a6a4406111883457f7
SHA1 0d5efff0d110c48f5e6f5d438967427f1e2dbf84
SHA512 b614b023ce683e78ee685be028fa06d7df90f10360d55de2a8c1214200b0b85998683502f377b01584bf23b72b168c33ef560a78d7abdf68aa3af87beca59398
SSDEEP 12288:JbSGg983mCR0sY9D4+doy8J5EMPhQmW9K+r:JbS1983zq4LbEI+S+r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 4KB
SHA256 e1c74442d5ef077ec4efb40dba9331c76dd3e1e5b394c5360fa98593124b1d95
MD5 a97f623143cddbfd78bbfcda5a7757d5
SHA1 a5357a534d14f0c955a272c71f050171e9d53057
SHA512 12f40f64d406bff9986217ecb63e3589e347ea3ddab5b690f8de58fa8fe0daf2a2f8df46fb74d5ccb9a31dc24c93c5003937e4e45e9e95bd669f3c8aecc21f9b
SSDEEP 48:oIaCudUnk87pg8V2sV2h9F2Ta/vaSxji/sRVZHwb3vwnvuNeSxjlN6uY9/I:oIuOzlo2TEv1GsRHk3CvSRP69w
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 5KB
SHA256 a6aa90acf2473e3685d0db9f763fee1d7b2691e492f09d18cd645917357a2e32
MD5 9f83f01af9199da4b9de3a0d6447c044
SHA1 ad6212b60e15f63fdbef3485dd697dfb8abf6833
SHA512 e6dc105e64029c7446b33313d91f17cc452aaaf02d40558a0f5aa749ac7872fa70609eeba0abf5764244bcac5545d6bec2d324733b1617692be2f18bcd794e17
SSDEEP 96:oIuOzlo2TEv1GsRHk3CvSRP69R48+gGv/N:Tu12T3sRHMnRj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 1KB
SHA256 6d1d43ad6e75be6b3b122592f442d7792d39b87c18192a1701540ea6fa7395bd
MD5 427f5656369457ef5e2f85e18064032c
SHA1 0a285564daaffa5ae0bb3a3857b91259b0946a50
SHA512 92e60be301c0ef4da4fec76d3056cb1e774adba2ccd7eb345b97bb1986ab5e932d4cafc77784f14925ff7deba2133c10530f2ba05feae97133b26b4c2f5d7dac
MD5 SHA1 SHA512

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 6KB
SHA256 540d0631cbb5ef94a4e254ad17b9525a50a3fa4bd49a5e39f9ab91634aef6931
MD5 7f1ef4be6dabd038514af4b1f0ef7ea0
SHA1 f958e54b1a537ae30d27d278b0a8f110a78766d0
SHA512 e2df6cc6c4610b0cd33fff9a6b791a2b10db014fee4cf5b59906065527f2cc7d7de62d1767642cfb1ab8df40ff08197fdcbd971ec5a529a4be603922f4394166
SSDEEP 96:oIuOzlo2TEv1GsRHk3CvSRP69R48+gGv/UWVqNX:Tu12T3sRHMnRVK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 6KB
SHA256 623b269269402689b4237ee1609d1246d76b65491eb61623b00904d6b77147a9
MD5 c6c41982ec951eafd1d336386913bfab
SHA1 1eadd54eeb991924a0ccfd6979a56d3fbcfacea9
SHA512 226141737edae70aad8524ea9de1dd2c83058357003a641b0ce3ad57e437f5a11d31b6a27e4a7895d8f62f1bdc536eec7d9a4bac3cae473c1e5b9af27878c78b
SSDEEP 96:oIuOzlo2TEv1GsRHk3CvSRP69R48+gGv/UWVqN3j:Tu12T3sRHMnRVo
MD5 SHA1 SHA512 SSDEEP

Submit Download

hd.vbs

Path C:\Users\Admin\AppData\Local\Temp\hd.vbs
Size 245B
SHA256 4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
MD5 d8682d715a652f994dca50509fd09669
SHA1 bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA512 eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca
MD5 SHA1 SHA512

Submit Download

javaSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
Size 11.5MB
SHA256 1d7c333cde10fd9c3f04cbeecc771fba64c9799e80152851e4eb8f139605442c
MD5 f41778098ea0bcfbd8cec8c03866e286
SHA1 869b920110f7fabed9d0238ed370b3500951cca6
SHA512 3cd5ff7ae72a816fd1c90e98da88007e4878007781ca4a7de9e1b2041d4e93cda5bcd5b3a3df26f55db98cfd8805e7416a37899cc0aad48272f7d7c3b9feadef
SSDEEP 196608:rvjJxuf9ClWhZO5Fo4wj64ABRLK1jD+1nNWsM5s4tdAK/1GqUtel6ABhGrn:rLJxuf9CUhZsoKK1mWskttt7gAbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
Size 11.9MB
SHA256 a1a009a099e8dd08a3c8379ff78375671e2518e7295d35ebd034ace1d3ab4375
MD5 bbf4fd89032cae2e295082b8df1d344f
SHA1 329facd30a0524f0b51f152b3a9bd80c0ccc7932
SHA512 64db9f6c1d7b4097138a63c62a7053a10e8c507aad39f50de8840b0de2528f3bfe696398595daee60d40faae8577c3ccff9fe4f7e85cda6a32a8f3d8b7e2d72b
SSDEEP 196608:rvjJxuf9ClWhZO5Fo4wj64ABRLK1jD+1nNWsM5s4tdAK/1GqUtel6ABhGrBGo:rLJxuf9CUhZsoKK1mWskttt7gAbDo
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 22KB
SHA256 e0e88bda4bcbbcfadb1009060372744f8b3f3628ae29b1d310a99255ec76aa7a
MD5 525bf7f5b63ffd5e86fa3aee92551c21
SHA1 bf3cd939fe57f5076afbd231cb5b1b0ea03ba5d0
SHA512 825d048f8a3eb7ec88bda27eaf34b5c05a9545a12d48d29fc264aeae571fb2b4aa2957cd1b5459d53dc5d18b7968760d47136a6ec099c5612c3a7ab677b24d73
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TP:c8L6gWt4wnAQ7WTb6aotVhP
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 23KB
SHA256 f7468e1cf9cb05006bb7eebf4ce106f98828351ac7d8637486794ba90e5f5bc2
MD5 18f48d6714640435ab93cad409e10070
SHA1 fd33c178274fb08adb77cf5c695ce29ba32417bd
SHA512 632e4957e610ab787ed9a2cf3e8d988acb16e4cfc4d4df9b52682ca54fa4f7fed980b7b5dd69b1c4dd71554894ee5e5199da630b721f3c7403652f923a16dcc1
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXUO:c8L6gWt4wnAQ7WTb6aotVhkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 23KB
SHA256 3532daff57c2b70280ef79edf17af55d108b2d46b88bdbf248fab74db2a43d14
MD5 a2623660c345873243bb8f88145663b5
SHA1 d8cabac7b4057649bb6ca31504719fb0881c7190
SHA512 60dc96479ae28a9011dee7a2e8ff2cb60ab548a6164ba8f5562fcd1cb154362677a68c98c62aa62333ac9812d4ddb3e332957efdbc5acfb5eade18f111c21f6e
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1F:c8L6gWt4wnAQ7WTb6aotVhk2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 24KB
SHA256 1e1a1fcf7c15b8f6019b1696765c696e69a510bb25fd29daa4f8286b206e738a
MD5 e2aaff5f40ba3fbc2df129ed2157dd19
SHA1 8d6b9aeeae45922687e24365cecffdc0e4997f08
SHA512 e1e5a42c4b5bac65b4747b149a694d738fe7e4e7c5398ef564885796e4d9d3cf5ae4ef1cd2066dd6ba24463654c090d79ac84e0f1ad76575155deab8088e6843
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ6:c8L6gWt4wnAQ7WTb6aotVhk2m0
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 25KB
SHA256 648dac2d3607a22d24056d6d29f1e43343c0e812faffa92a381f627cc42789d4
MD5 d2c611a13ec2cd37d228aad0305dc734
SHA1 b7d5dd93fb333c96f9d0c516fc862a1f6dc31ae8
SHA512 5e73bcfaf14e4a45068a74623e9ed39276844efc6269604ea231f1457c5837605e34ebc7fbf106156b0d653c3a0ce90bf0817d09a44a7b268718747506da70d3
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ5SuR:c8L6gWt4wnAQ7WTb6aotVhk2mzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 25KB
SHA256 f46f4d796f236751d277dc24184765679d409c0e454ae07587ca09e0710a0f1f
MD5 250dd63c170bf6cc59e2a7a34edb348b
SHA1 da811a6038e340332de88fe1c2a574ee1bb8a8a8
SHA512 ffc14529043f3231ace3beda1cb14de9ef37d24221d462138eb8fe9cb255eacba42bb864e41a575b7c14773ae577f6e44afcd408f2415678f1019895e3c376c4
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ5SuJk:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aih
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 a0da062ab80c0dc8d84f51bd76faf53001cd4b48bcbc0ddae6d75e210ea92ccb
MD5 6395ef19c45e81bddd74837a1394acb5
SHA1 92a97d8fa5c76891d0df4b4d9812370ee85859b9
SHA512 5bb7439566d386aa46774e71378284fff75855f2b5971345d54e5142a23a9488a49b1de2a9533d37cb3f33c8d50cc64727daac7c96ca6dd3779144379a068fdb
SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4K:BL6g648Hs6aotE2mzViqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 2f0f162f348b4020566418fd30c090fac83883284dde7c163b923f68d0886c69
MD5 cc147c8509b89de26462cd73e51d3df4
SHA1 b37e85f40a18c1832530a760b309799378f7f6a9
SHA512 b8ef88fc7c91371605dc12a6fae41fa576836ad7eecbf728cd78ab5de9b235c221d5f43d2e9f9adc234f6ae5c3e823dd1b213aaa0340aa8d341015ad393a3e93
SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4Jt:BL6g648Hs6aotE2mzViqJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install_reg.log

Path C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
Size 3KB
SHA256 9bf99654183263090ac650e9f691e074a0de278848a0b618df2c074d9fac23e7
MD5 a571a80e3e7f07d8d5318528ffcf057f
SHA1 e3ec23f4b500ff697f327a186c6b7a1d0203d242
SHA512 70db57b8e9aafeaf7fb4e7c7bc4a7b91297b3e5ed7dbe683c63c8191bd98c0a92457d92ee4ee379eca4935c85362cbbfb1bc9fa4a00cc010afec40752d641be4
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 153KB
SHA256 db9a9d9f0e010627c4753ecd7ab58d23563174ffbd7acf51d764df87019ef6b2
MD5 9655055f319a79ff66f586b6552279be
SHA1 41d7a557f7d7585074d7d119c0c647c42d0e775c
SHA512 b56ed90a16ec3f51f17c0943c557579837df00aed1d7937e3fc0538aa50542aa30fc3ee203cf2809245306aedc1ffe2196d0604d8e0619a5fbc18dbadc2914f9
SSDEEP 3072:zMuV/+3WQbiRoMJZxVdyLhDxMg+hhvHm3P3O4qV/J33k+0K0J:tIue
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 154KB
SHA256 2860e3ec4f00ce3ebb9aaeba226c5c5c30b145e7311b5b7152bca3a2145cd803
MD5 c6a23a5bf32a9eb3b6f763377cddf6a4
SHA1 f9d2dcfe8b9559d2ee8533f68c0cd1b9581ebae8
SHA512 c7cf70152c892d29a3b93ad80719aa6d509862f93b47fb10f70bf197b18de13b61bc3a14d4021bbc89499640e1652058a7de62e34d3e215be68a209691da7df9
SSDEEP 3072:zMuV/+3WQbiRoMJZxVdyLhDxMg+hhvHm3P3O4qV/J33k+0K0t:tIua
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 154KB
SHA256 d356e43f5379044c904314a601c5d6ba86b62d36c918368dedb1f7dd4ffa6bd4
MD5 316aea2bd486038c138c01eab7f153c7
SHA1 02a2dc30c29a97e383ea9a03cc969c8d9dd4db6e
SHA512 6c37f1a2d4c907bf181c1b68690d2e9183ca2bd01f3aa8e212ef1b81137028419b6813dba942226bebbf81cd21676ea84fdfeece0fe4426d5282f0b5101db675
SSDEEP 3072:zMuV/+3WQbiRoMJZxVdyLhDxMg+hhvHm3P3O4qV/J33k+0K0p:tIue
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIBC3.tmp

Path C:\Windows\Installer\MSIBC3.tmp
Size 202KB
SHA256 bf4e4c75d148cb412e28a0b4e665919fd5ac6b9aa6bc3fa75401394759218d5e
MD5 9f84d910602183954bed6d9660600783
SHA1 82e3b122dc63e0a333bca531dd16667d5fafbf23
SHA512 09fb450e6c6f22a32d5e06f470070aab17d4973afe307b529093af7fa29ab96b61a89814e4964d005459f8ebb25716134a5e1c41f6ea7d260361b135306544b9
SSDEEP 3072:nCYl9W8fZ2MaPI/K4W7AfchMoCzWNb/sVq5+/DzaRspvh:nHlg8fZ2MfK4dUyoyu/x56u+hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-1626-0x0000000002FD0000-0x0000000002FF8000-memory.dmp

Download

memory/1048-1628-0x0000000003010000-0x0000000003018000-memory.dmp

Download

memory/1048-1627-0x0000000003008000-0x0000000003010000-memory.dmp

Download

memory/1048-1619-0x0000000002D50000-0x0000000002D51000-memory.dmp

Download

memory/2140-1499-0x0000000002840000-0x0000000004840000-memory.dmp

Download

memory/2140-1485-0x0000000002840000-0x0000000004840000-memory.dmp

Download

memory/2140-1673-0x0000000002840000-0x0000000004840000-memory.dmp

Download

memory/2140-1484-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/2140-1471-0x000000003A200000-0x000000003A210000-memory.dmp

Download

memory/2140-1498-0x0000000002878000-0x0000000002880000-memory.dmp

Download

memory/4180-1647-0x00000000004C0000-0x0000000000546000-memory.dmp

Download

memory/4180-71-0x00000000004C0000-0x0000000000546000-memory.dmp

Download

memory/4180-0-0x00000000004C0000-0x0000000000546000-memory.dmp

Download

memory/4184-76-0x00000000004C0000-0x0000000000546000-memory.dmp

Download

memory/4500-870-0x0000000002500000-0x0000000002501000-memory.dmp

Download

memory/4500-868-0x0000000002660000-0x0000000004660000-memory.dmp

Download

memory/4584-1694-0x0000000002480000-0x0000000004480000-memory.dmp

Download

memory/4584-1693-0x0000000002250000-0x0000000002251000-memory.dmp

Download

memory/4584-1695-0x0000000002480000-0x0000000004480000-memory.dmp

Download

memory/4584-1697-0x0000000002480000-0x0000000004480000-memory.dmp

Download

memory/4584-1692-0x0000000002480000-0x0000000004480000-memory.dmp

Download

memory/4584-1698-0x0000000002480000-0x0000000004480000-memory.dmp

Download

memory/4584-1691-0x0000000002480000-0x0000000004480000-memory.dmp

Download

memory/4584-1685-0x0000000002480000-0x0000000004480000-memory.dmp

Download

memory/4584-1700-0x0000000002480000-0x0000000004480000-memory.dmp

Download

memory/5012-1605-0x0000000002980000-0x0000000002981000-memory.dmp

Download

memory/5012-1645-0x0000000002ED8000-0x0000000002EE0000-memory.dmp

Download

memory/5012-1644-0x0000000002ED0000-0x0000000002ED8000-memory.dmp

Download

memory/5012-1648-0x0000000002EE8000-0x0000000002EF0000-memory.dmp

Download

memory/5012-1646-0x0000000002E40000-0x0000000004E40000-memory.dmp

Download

memory/5012-1643-0x0000000002E78000-0x0000000002E80000-memory.dmp

Download

memory/5012-1642-0x0000000002980000-0x0000000002981000-memory.dmp

Download

memory/5012-1623-0x0000000002E40000-0x0000000004E40000-memory.dmp

Download

memory/5012-1629-0x0000000002980000-0x0000000002981000-memory.dmp

Download

memory/5012-1624-0x0000000002980000-0x0000000002981000-memory.dmp

Download

memory/5012-1607-0x0000000002E40000-0x0000000004E40000-memory.dmp

Download

memory/5012-1576-0x0000000002980000-0x0000000002981000-memory.dmp

Download

memory/5012-1577-0x0000000002E40000-0x0000000004E40000-memory.dmp

Download

memory/5012-1552-0x0000000002E40000-0x0000000004E40000-memory.dmp

Download

memory/5012-1526-0x0000000002E40000-0x0000000004E40000-memory.dmp

Download