06cf4cdd61a0dd51afdd6b288c72cf8c6b7721cbff39091659c170fa7ee709a3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe
Size 129KB
Sample240506-d2t1jsaf25
SHA256 06cf4cdd61a0dd51afdd6b288c72cf8c6b7721cbff39091659c170fa7ee709a3
MD5 1a8d6c065ea9d7856febc6972baf8e52
SHA1 1d6ec1c4c24716f1ffe48edff8e47ea8eb78393e
SHA512 eb8bfb6b8eadbfff9fdcf39799602da8133f3f4fbc2eed3a5b6b4b4b31a96d1ba9eb6c5c33c3c2518a5940cc8c439bb64bfe4fb8348f3ca16c0a0f9175878b96
SSDEEP 3072:SOiyDxsHWq7IVNuutVY4t3hMafrZknlOwzmwNCdscout0Q74:hDDxsHnIJVY41hx9wtCdscoS0QE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe

Executes dropped EXE 15 IoCs

pid	Process
3388	javaSetup.exe
4784	unpack200.exe
4348	unpack200.exe
3160	unpack200.exe
3464	unpack200.exe
4148	unpack200.exe
2768	unpack200.exe
3408	unpack200.exe
2476	unpack200.exe
4872	javaw.exe
2320	javaws.exe
2724	javaw.exe
2056	jp2launcher.exe
2528	javaw.exe
1352	javaw.exe

Loads dropped DLL 45 IoCs

pid	Process
4964	MsiExec.exe
1800	MsiExec.exe
4784	unpack200.exe
4348	unpack200.exe
3160	unpack200.exe
3464	unpack200.exe
4148	unpack200.exe
2768	unpack200.exe
3408	unpack200.exe
2476	unpack200.exe
4872	javaw.exe
4872	javaw.exe
4872	javaw.exe
4872	javaw.exe
4872	javaw.exe
1800	MsiExec.exe
1800	MsiExec.exe
1800	MsiExec.exe
1800	MsiExec.exe
2320	javaws.exe
2724	javaw.exe
2724	javaw.exe
2724	javaw.exe
2724	javaw.exe
2724	javaw.exe
2056	jp2launcher.exe
2056	jp2launcher.exe
2056	jp2launcher.exe
2056	jp2launcher.exe
2056	jp2launcher.exe
2056	jp2launcher.exe
2056	jp2launcher.exe
2056	jp2launcher.exe
2056	jp2launcher.exe
2056	jp2launcher.exe
2528	javaw.exe
2528	javaw.exe
2528	javaw.exe
2528	javaw.exe
2528	javaw.exe
1352	javaw.exe
1352	javaw.exe
1352	javaw.exe
1352	javaw.exe
1352	javaw.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/348-0-0x0000000000A30000-0x0000000000A80000-memory.dmp	upx
behavioral2/memory/348-44-0x0000000000A30000-0x0000000000A80000-memory.dmp	upx
behavioral2/memory/2300-45-0x0000000000A30000-0x0000000000A80000-memory.dmp	upx

Blocklisted process makes network request 1 IoCs

flow	pid	Process
78	4780	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	MsiExec.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\javaw.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\javaws.exe	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Hermosillo	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Winamac	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Belgrade	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\ext\meta-index	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Atikokan	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Vincennes	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Baghdad	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Tokyo	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+10	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\messages_zh_TW.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\DumontDUrville	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\Syowa	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Bishkek	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Novokuznetsk	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Broken_Hill	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\ssvagent.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\keytool.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Regina	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\javafx-iio.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Noumea	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\cursors.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\Ushuaia	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Guatemala	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Colombo	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT-8	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Kaliningrad	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\MET	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\npt.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Windhoek	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Sofia	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\ssv.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\dtplugin\deployJava1.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\dt_socket.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jpiexp.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\kinit.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\ext\zipfs.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Santiago	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\decora-sse.dll	MsiExec.exe
File created	C:\Program Files (x86)\Zona\uninstall.exe	javaw.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Chuuk	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\sound.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Swift_Current	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\Canary	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+2	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Majuro	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Cancun	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\UCT	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\EST5EDT	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zona\Zona.7z.tmp	javaw.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Puerto_Rico	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Danmarkshavn	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+12	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Dublin	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Prague	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\Catamarca	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Makassar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Nicosia	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+6	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT-4	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\UTC	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Algiers	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\WET	MsiExec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5816ee.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI19FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F03217080FF}	msiexec.exe
File created	C:\Windows\Installer\e5816ee.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B93.tmp	msiexec.exe
File created	C:\Windows\Installer\e5816f2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2076.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "50841556"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_50"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0067-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0037-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0079-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0034-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_01"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0090-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_90"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_30"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_26"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0034-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_64"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_48"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_05"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.1_06"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0084-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0080-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_80"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0004-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0093-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_68"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_19"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0044-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0051-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0015-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0040-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_04"	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0044-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_01"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\ = "Executable Jar File"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_80"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0034-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0074-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.1_01"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0052-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_25"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_53"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_03"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0039-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0079-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0042-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0043-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0041-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_41"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0095-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_23"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0041-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0060-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0014-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0042-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_27"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_16"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_11"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_30"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0053-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0094-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_14"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_34"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0088-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0093-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0035-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0041-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2056	jp2launcher.exe
2056	jp2launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2436	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2436	msiexec.exe
Token: SeSecurityPrivilege	4780	msiexec.exe
Token: SeCreateTokenPrivilege	2436	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2436	msiexec.exe
Token: SeLockMemoryPrivilege	2436	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2436	msiexec.exe
Token: SeMachineAccountPrivilege	2436	msiexec.exe
Token: SeTcbPrivilege	2436	msiexec.exe
Token: SeSecurityPrivilege	2436	msiexec.exe
Token: SeTakeOwnershipPrivilege	2436	msiexec.exe
Token: SeLoadDriverPrivilege	2436	msiexec.exe
Token: SeSystemProfilePrivilege	2436	msiexec.exe
Token: SeSystemtimePrivilege	2436	msiexec.exe
Token: SeProfSingleProcessPrivilege	2436	msiexec.exe
Token: SeIncBasePriorityPrivilege	2436	msiexec.exe
Token: SeCreatePagefilePrivilege	2436	msiexec.exe
Token: SeCreatePermanentPrivilege	2436	msiexec.exe
Token: SeBackupPrivilege	2436	msiexec.exe
Token: SeRestorePrivilege	2436	msiexec.exe
Token: SeShutdownPrivilege	2436	msiexec.exe
Token: SeDebugPrivilege	2436	msiexec.exe
Token: SeAuditPrivilege	2436	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2436	msiexec.exe
Token: SeChangeNotifyPrivilege	2436	msiexec.exe
Token: SeRemoteShutdownPrivilege	2436	msiexec.exe
Token: SeUndockPrivilege	2436	msiexec.exe
Token: SeSyncAgentPrivilege	2436	msiexec.exe
Token: SeEnableDelegationPrivilege	2436	msiexec.exe
Token: SeManageVolumePrivilege	2436	msiexec.exe
Token: SeImpersonatePrivilege	2436	msiexec.exe
Token: SeCreateGlobalPrivilege	2436	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2056	jp2launcher.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 1416	348	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	83
PID 348 wrote to memory of 1416	348	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	83
PID 348 wrote to memory of 1416	348	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	83
PID 348 wrote to memory of 2300	348	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	86
PID 348 wrote to memory of 2300	348	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	86
PID 348 wrote to memory of 2300	348	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	86
PID 2300 wrote to memory of 3388	2300	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	101
PID 2300 wrote to memory of 3388	2300	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	101
PID 2300 wrote to memory of 3388	2300	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	101
PID 3388 wrote to memory of 2436	3388	javaSetup.exe	102
PID 3388 wrote to memory of 2436	3388	javaSetup.exe	102
PID 3388 wrote to memory of 2436	3388	javaSetup.exe	102
PID 4780 wrote to memory of 4964	4780	msiexec.exe	104
PID 4780 wrote to memory of 4964	4780	msiexec.exe	104
PID 4780 wrote to memory of 4964	4780	msiexec.exe	104
PID 4780 wrote to memory of 1800	4780	msiexec.exe	105
PID 4780 wrote to memory of 1800	4780	msiexec.exe	105
PID 4780 wrote to memory of 1800	4780	msiexec.exe	105
PID 1800 wrote to memory of 4784	1800	MsiExec.exe	106
PID 1800 wrote to memory of 4784	1800	MsiExec.exe	106
PID 1800 wrote to memory of 4784	1800	MsiExec.exe	106
PID 1800 wrote to memory of 4348	1800	MsiExec.exe	107
PID 1800 wrote to memory of 4348	1800	MsiExec.exe	107
PID 1800 wrote to memory of 4348	1800	MsiExec.exe	107
PID 1800 wrote to memory of 3160	1800	MsiExec.exe	108
PID 1800 wrote to memory of 3160	1800	MsiExec.exe	108
PID 1800 wrote to memory of 3160	1800	MsiExec.exe	108
PID 1800 wrote to memory of 3464	1800	MsiExec.exe	109
PID 1800 wrote to memory of 3464	1800	MsiExec.exe	109
PID 1800 wrote to memory of 3464	1800	MsiExec.exe	109
PID 1800 wrote to memory of 4148	1800	MsiExec.exe	110
PID 1800 wrote to memory of 4148	1800	MsiExec.exe	110
PID 1800 wrote to memory of 4148	1800	MsiExec.exe	110
PID 1800 wrote to memory of 2768	1800	MsiExec.exe	111
PID 1800 wrote to memory of 2768	1800	MsiExec.exe	111
PID 1800 wrote to memory of 2768	1800	MsiExec.exe	111
PID 1800 wrote to memory of 3408	1800	MsiExec.exe	112
PID 1800 wrote to memory of 3408	1800	MsiExec.exe	112
PID 1800 wrote to memory of 3408	1800	MsiExec.exe	112
PID 1800 wrote to memory of 2476	1800	MsiExec.exe	113
PID 1800 wrote to memory of 2476	1800	MsiExec.exe	113
PID 1800 wrote to memory of 2476	1800	MsiExec.exe	113
PID 1800 wrote to memory of 4872	1800	MsiExec.exe	114
PID 1800 wrote to memory of 4872	1800	MsiExec.exe	114
PID 1800 wrote to memory of 4872	1800	MsiExec.exe	114
PID 2320 wrote to memory of 2724	2320	javaws.exe	117
PID 2320 wrote to memory of 2724	2320	javaws.exe	117
PID 2320 wrote to memory of 2724	2320	javaws.exe	117
PID 2320 wrote to memory of 2056	2320	javaws.exe	119
PID 2320 wrote to memory of 2056	2320	javaws.exe	119
PID 2320 wrote to memory of 2056	2320	javaws.exe	119
PID 2300 wrote to memory of 2528	2300	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	121
PID 2300 wrote to memory of 2528	2300	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	121
PID 2300 wrote to memory of 2528	2300	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	121
PID 2300 wrote to memory of 1352	2300	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	122
PID 2300 wrote to memory of 1352	2300	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	122
PID 2300 wrote to memory of 1352	2300	1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\cscript.exe
  cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
  2⤵
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1a8d6c065ea9d7856febc6972baf8e52_JaffaCakes118.exe" /asService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\javaSetup.exe" /s REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi" REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0 /qn METHOD=joff
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Local\Temp\Zona.7z" "C:\Program Files (x86)\Zona"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:2528
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Local\Temp\appdata.7z" "C:\Users\Admin\AppData\Roaming\Zona"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1352

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1E5FAFD3F433DC197E70115D6801F0EF
  2⤵
  - Loads dropped DLL
  PID:4964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 28A92F521ACAA07251C65997E0B4CA0F E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\rt.pack" "C:\Program Files (x86)\Java\jre7\lib\rt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4784
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\charsets.pack" "C:\Program Files (x86)\Java\jre7\lib\charsets.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4348
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\deploy.pack" "C:\Program Files (x86)\Java\jre7\lib\deploy.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3160
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\javaws.pack" "C:\Program Files (x86)\Java\jre7\lib\javaws.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3464
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\plugin.pack" "C:\Program Files (x86)\Java\jre7\lib\plugin.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4148
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jsse.pack" "C:\Program Files (x86)\Java\jre7\lib\jsse.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2768
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3408
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2476
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4872
- - C:\Program Files (x86)\Java\jre7\bin\javaws.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaws.exe" -fix -permissions -silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
      "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.JreLocator
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2724
  - - C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe
      "C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW5camF2YXcuZXhl -ma LWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5816f1.rbs

Path C:\Config.Msi\e5816f1.rbs
Size 10KB
SHA256 7857c84562d7022c877fc7fccc1a18b84d8774fe203665aa12c37938fbac2d05
MD5 7f49d963f6dd2bd0652bd31d16f5a245
SHA1 991a62332a12ddb1a76c16687678c4d36a1471c5
SHA512 5b5fbfa4712877eb57f41054fd89aa2d148d4797fae80a28f106a89fccaba497fe45b20400abe01f177da6faa9aa8553d00cca41ba9a643116bed8517e8da8ef
SSDEEP 192:EXaxCiGdAesSKOuG0GoSKOuI0eazmZqpPihwba:EXsp38Wh8wJmeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCR100.dll

Path C:\Program Files (x86)\Java\jre7\bin\MSVCR100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsAccessBridge-32.dll

Path C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge-32.dll
Size 95KB
SHA256 4010a3ec604a327861bedf01626c12eaded9d381b6e4f0e6f760895838834a21
MD5 1722510af00ea3c7406681b47bf442f7
SHA1 cafac266d52d78d3743c31ebef22a894781e0de5
SHA512 31a2ce3d5eb9828cbb82d2a7e29f2c5bf46528d38f25827329512cedde37bd03b3cfdba0aba3320b6c0e7779588958e83bff735f6059aad37172598e70e863eb
SSDEEP 1536:wOW8GIF0xqg9Wr0eQPgjiKMQxSo7H0IpSiXk/LPQlswj81NowG0W:zHCxqgA7QPgjiKMvo4IpSi6U6wKKxX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll
Size 3.4MB
SHA256 500d359211ece211cf672de328345876f016fb4a476b2a03cbc3b8b89023ae1f
MD5 27147e1e3faf9b5ccda882cd96f2a85c
SHA1 7103f60121727917f812bfc7cdff5347fc17cc8e
SHA512 0866c604911e243687e7fe721142eb882b19691c902736b59ba304933463d8c9154ecc319b91c9771cee8139e151cc2a2e960bc7a93ed97352cf5232a0964194
SSDEEP 49152:ZrZNQqi9xkS7HU5kf0a5m4mDfhoobdwQC+1F8E9EYm8cBwoHmFOy8CIIaB6wwzmW:7enY5WijhooGh8cGoHm6jvcv/GnUxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

deploy.dll

Path C:\Program Files (x86)\Java\jre7\bin\deploy.dll
Size 371KB
SHA256 352707a271a9ab5d0e190a539b6468d6c6c5ce9675b300acf2305aa1f30625d8
MD5 87ec9d4a00d34eb6a0f8f92e1d1cc08e
SHA1 bee4ecae201905096dd44d1d348ecb3556d90832
SHA512 5b7f9866168ad7948a5a80078b14ff747201d17922ca907072a081e0078f6ac68446ddd36b027b4a17f5afa7d1bb4962642cff28cf66867171ebb78735f242d2
SSDEEP 6144:ZtbYrD6qqtQgirH7/W4/SDMqiJjOBCCMEdvxIW1hN:ZtbYr4tG7/W4/SDMqa4vq+hN
MD5 SHA1 SHA512 SSDEEP

Submit Download

npdeployJava1.dll

Path C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
Size 864KB
SHA256 c029fd3c6ffd2158d0633fc122786838a6f5d3cc7ef78bbe934697015c8c63dd
MD5 bc3a575dfb1a58d35e8617f2966bf1ea
SHA1 6353630f62e246d7f462134e8d10a7a42935e20f
SHA512 c976da30d343f8e104bec72300dc0c17e582e380f0a3ae85b242dbf2d5b40459feb4a3b7789fb8d755b21cbaa0940038d20dbbf1296a48e77b461092abbbe514
SSDEEP 12288:vd4rPQxptuRWuSmOqPsz9YbUOLgsxel3nvb9N3YfG2JmekTvChbOso6CyQJueOdv:F4zWuSDOsz9g1Lgsxq9N3yX4USK
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.dll

Path C:\Program Files (x86)\Java\jre7\bin\java.dll
Size 117KB
SHA256 81ad5696a6fcad89127fc7a428636d431b446ff1ee0c37bf87e8d513a8bae7af
MD5 a258a133f7d565600647a248ab95792c
SHA1 1c6a855ca1fc04413b906b0b17609eff38317161
SHA512 bf9dd97947eb0c71243ae28255af54b06d9e17af7ade666538dd93f9fdf6d8fbc3855f48bfaf6522dbd9ce3c6cff655581f092709670606d033f2321b1f4a5e7
SSDEEP 3072:gnQmO7IlruvLXTYZKj8Jq1YwEyy4YtQNAoTX0D:4h3lKvL0Ztp4K3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files (x86)\Java\jre7\bin\java.exe
Size 171KB
SHA256 c7fd72a0730b377c6da5ac80cdaf5f4cca84cc999a563a4c420fe5a8576810f8
MD5 88651044108e995f9801e35d2582491c
SHA1 abbf404c0253d085223a64ab947e1057c4211c9c
SHA512 486b1d7ad7c3debcb8d70f9351adb08c8321c4cfb409a00ff818be1dacdc376a0eded630ccdc74aa99cc472589b88c9681989076fd78eb109759d33e7bf70543
SSDEEP 3072:KnwrusR90uNHgtMhsaR2fhvTxVwEPEoTBfmabjZqMN7GLi4:wwrusb07tMfRYTxVB8oTBpvqLH
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaw.exe
Size 171KB
SHA256 844ab2231f45fad60d81770ea36d9937da9aa72cd905ce06e7471ddf9d69263b
MD5 64e2bb67ea740860510dcc5c2b6ffa2d
SHA1 6c5996358264624cdb4a075acc4f0b46177cd259
SHA512 ed24331883ada44d8b034f5c8bc458e53234109d5cd02a27989972033f5b3305d23365106ce80be81caa16e472c14c103e457a1e0d138eb0d95036e58d877462
SSDEEP 3072:Yoc9DbDDUaDxmNhrS+eEcbren+W3hYTBfBX0jZqMNSKFg:jc9bDNxmzS+a3entRYTBKvt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaws.exe
Size 266KB
SHA256 841339373958786d9c93a7dad5de8fd213ed6b5ad69623f5a5762a453c48e0a5
MD5 2b4493bb1f94580c41def972ea9a887e
SHA1 880ca8b20c6df9a6a176b91cc50304cb0fe66d06
SHA512 b43e54f2c1f3e0a3c3d2fcee518e47d17476bb735606351e41b49e97e10af758ea9a539ac370a2d12cffa93e3e752e829db969968664c59386f65b732c29e40e
SSDEEP 6144:FHNCVyL+Br9XFt6KeorPZufQ4BIGQYqFkNOjvqR7:JNH6rVtdeobZ2IjYqtjv0
MD5 SHA1 SHA512 SSDEEP

Submit Download

unpack200.exe

Path C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
Size 145KB
SHA256 c89091f2a4de2fcf10b30e54a74ec5764e2dfc0577f4f1d879ac8816e3b08bcc
MD5 0d46182b6134aa9c7acd16133d67e4c3
SHA1 7b5be3d65e5e744723bf55a08f9dc1042585d5eb
SHA512 735b6c6bd69b22a71c15ae44c6fa1693700321dc3b4b2367ce05d5c37df62e45d1d3836c2c0f5e44be1036aeb11a533c2a4dbec55163b4a15adfa1c8ef75673b
SSDEEP 1536:orhTuv/39U7QVq15jIS1mlqct2ND8h+8zu17Oq4qnToIflGIO0IOY03Gk5J0X:oGe9FIFIV8/ulphTBflkaY0Wk5J0X
MD5 SHA1 SHA512 SSDEEP

Submit Download

verify.dll

Path C:\Program Files (x86)\Java\jre7\bin\verify.dll
Size 38KB
SHA256 87d8d59972e73700507c07cee8750b0053c6a0899410338722a00c2803d39ee6
MD5 cb89b1d71061f5ec52468528ecc0b1fc
SHA1 6feb23a8b5719c8997de92c7da644807fcba8819
SHA512 2ff0ed38c7f28eb7ea16f24a0841dfb3306c4fec48ded5fddec8c3140f1a425433a444fe6b6cc4c17b3a39841c8ab0c23d7c9525c119c1b9d6daac2c17a4e4b0
SSDEEP 768:gPGXoQMYf5rFV1wleN0gzhSlAHCf4ouRHJrf4t8fnd577Iq5z:gOXJMSrufMNf4wfvIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsdetect.dll

Path C:\Program Files (x86)\Java\jre7\bin\wsdetect.dll
Size 159KB
SHA256 2ef891881d506084ed182a0ac58b10dbe8c45877ef889ac9105f19431beee4ca
MD5 958bc8d82e4d0a5b51536bb4fc4fb6d6
SHA1 626312fa01c72ec5c85c9262ba0ae97a8b1f5b25
SHA512 fe17b58e3eed817619bebf6d091aee99fdc331c9c5a4163e9f5993b41b2e7362365da210e0636755ada6b8838012de1bc5435b8670aa12f378a3c9e3a9f5af04
SSDEEP 3072:gLutxFjfIlYey8KP0+KbMcfyMvc0crTwC7bd2:gLunFzIqey5P0bbVrchrTwC7x2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path C:\Program Files (x86)\Java\jre7\bin\zip.dll
Size 66KB
SHA256 35ce7ab154a38e97951714e17f7689873d89e8c01188de6e5cd741bc0ca3e384
MD5 1ecf056944068b933ba71cda3edc4a68
SHA1 2052b2138db0d9a368942470b41bb6fc5b1d4007
SHA512 cadf312841d392a9970cc068b72063e17454d5e6738b46ec9622257d9dfc0bcad0d9420352752bf7d8f8e8ceaf6aca97d83896f753dc12cfeac3e5efb5e1ab05
SSDEEP 1536:4UH9k47M2axhBBQq8SRlr8IOwIOpVnToIf1QfqPu:zl6u0xymp9TBf1QfqPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

charsets.jar

Path C:\Program Files (x86)\Java\jre7\lib\charsets.jar
Size 3.4MB
SHA256 dd213d0867714191e351f589dc709d6f3cafee819aafda8f8fe022d367ea189b
MD5 3f080df73b2d7cad61bddcf709aadc72
SHA1 616e9ec760722737f38213f43755131f836dd627
SHA512 733b65d3662f2eb9a8f64212e306d934929a05fd753040073f7e2769df77791c29aef9e35610b7b22597bbea6d805a8e04f93235fe761bf6bd5c5733c867025b
SSDEEP 49152:j3Iihrz1nFtsMm4kCG6APPzmpGNfnvvqNlbIeDX:j3Ii9zNo0TwLdNfn3KlbICX
MD5 SHA1 SHA512 SSDEEP

Submit Download

charsets.pack

Path C:\Program Files (x86)\Java\jre7\lib\charsets.pack
Size 1.3MB
SHA256 8ea5af036ec067a0abcf87b8f5921e2281ff9d259e1d4c3bbe7fa9037cd87d02
MD5 549bbcd204914b543dafee670f110834
SHA1 012461935191a55482e8c3d453d245e965a10a2a
SHA512 b0346a2ec52ce47351286f27f347f5fea99e160aedde52bcf74e1629739704bd975c9c99d8db6be3b6bd45e7fa933616fa081eda49e9b911efcc031c7241400e
SSDEEP 12288:QcvuzHfxrXJEmb5yyWMOXpyDy64BqY0qohrn2Wz/n3OEDgsa1dQnBJ4F:QcWTd5EmbmXse/0/n2cn3QF
MD5 SHA1 SHA512 SSDEEP

Submit Download

classlist

Path C:\Program Files (x86)\Java\jre7\lib\classlist
Size 73KB
SHA256 3837e95826d2273a54e3869efcad1521e000215428a2c7ee9397b650834ebaf1
MD5 1a0b7592ab9c12aff1191dfd225154ca
SHA1 3d3fb5f326f2caea866028558834ae684a2fe09f
SHA512 b2932400b6d8c72d344cb0592f121623dd848dcdd341248cf18cd55cd0c4fbd7f923057d022f89586ec6062299d756a37b3ff4308f10865de6ba68b2ee530fe9
SSDEEP 1536:Erv75nC+l+IbYoce+aeVQfo/ohdAyPD+cJKslPKUhjK6gVXVLpKhbC/4Z+j7RFR2:OnCcYKe/Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

deploy.pack

Path C:\Program Files (x86)\Java\jre7\lib\deploy.pack
Size 1.7MB
SHA256 928f6b847f94b920c462a08c43f0dfd3f7c40076b1cd60545523a5c27a4870ca
MD5 b2a448112b7c886ccce9b6a3d5efd8a0
SHA1 660bc9efe960015b208a421b1a63443e7151024f
SHA512 871da63f4eaf16d77ba6c19c10d8ddd8e94f744c20a70e24793f837023d20e56698d85f67498bc06ec37b73a8f376c220afbe7f3884b00536b710ff49c339b3f
SSDEEP 24576:zdyq6mG9BvZSL4096jCVKTBtdjM8pOzoAGdoKW0IriN2:zMvO4dFWfic
MD5 SHA1 SHA512 SSDEEP

Submit Download

localedata.pack

Path C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack
Size 736KB
SHA256 da2803a283d28882182e1e280b4f25ee1579a5805e73fcc9882e63968f102a8f
MD5 c8dc1cfeaf0fefc39ed0f1de4eaa175c
SHA1 11cacbb9e5724d37789455de37a225d8e0c648a1
SHA512 6b419ba94ae90f8caa3a57690f2ec7e249c9fb8ab86819439621cde1243c7636ee76820622ce32ed483ce76976f7ced74778898fc2725b1a2407b039fb53508c
SSDEEP 12288:+FFkQLRQjAgM4fIuskrqTYSuGTwj0ehh/k9SoBUaBYu:BpAgXzOcSuUw4eh5iUAv
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.cfg

Path C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg
Size 686B
SHA256 c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88
MD5 5147cce789cd18ad6b2996eb89e5d866
SHA1 756f1fffe96ef581f0d4d47253523544c89a2622
SHA512 55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6
MD5 SHA1 SHA512

Submit Download

invalid32x32.gif

Path C:\Program Files (x86)\Java\jre7\lib\images\cursors\invalid32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
MD5 SHA1 SHA512

Submit Download

javaws.pack

Path C:\Program Files (x86)\Java\jre7\lib\javaws.pack
Size 205KB
SHA256 ee43869ee94eefe241d661101ff6a03cc276f8e558967b1b350ea088f1dad2e2
MD5 491bce42c6cd8af88a2e11f37711ed4f
SHA1 3de7c18fee44465a6afe34e068f2a64dea9fa324
SHA512 1e5f99466b77b5a82c23449434272acf5746811ef96b98105f89b3339ccd86734d7713c94b773755219345d673a761a356fbe846a38e7893bd8894e43cf102e4
SSDEEP 3072:r05V3g4qpeICnbOKxO6kzmioaxOuVhi8kV2MoOGN2jhKuCQ0nAsKu4iCp+vgn43:ruO30OekKioaQ8v29pCQivKXgO43
MD5 SHA1 SHA512 SSDEEP

Submit Download

jfxrt.pack

Path C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack
Size 3.2MB
SHA256 8c481a549acfa58b1bac0385906febe33a928d004a529fec505b6a9228678fed
MD5 dfaa6429468d56ef77932cf26a495f75
SHA1 8a21a29225640f1829ae328a24ef9cb5e215a4e0
SHA512 6c19ed573b111315648de0646441486729b304452c15b2282938460a2339db0be4e1eb19cf6f2bf17f73037811ca2553a15957ea96b9d9af64a93045407c1148
SSDEEP 49152:TIOCux2SzM48f4NCZdfyupJDyQz8YCIN5yOHgNN:BRp0ptz8YCIfHM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsse.pack

Path C:\Program Files (x86)\Java\jre7\lib\jsse.pack
Size 141KB
SHA256 9f031f2f1292bb311c400b0a93a11b78a08f013332b1263ea58617b6548862eb
MD5 31b4d9c29d29567b0ae3037fac9fbdc6
SHA1 8b5d1b1a309177466d71a742414d441f600ea38e
SHA512 b4a8a3a1e837f98a3164e19a6fe939819eb336892335de975822890b52b5923d85fee4c4e5464ccb0d46c847f37f7da98a839aadbf4d20fca355f396a53836c0
SSDEEP 3072:+btJdrAlQMcNuicXy7/Sa1hz3igGCCCCtgXiJTOyV:+RrrAlQMcN3Uy2abQ/Ok
MD5 SHA1 SHA512 SSDEEP

Submit Download

meta-index

Path C:\Program Files (x86)\Java\jre7\lib\meta-index
Size 2KB
SHA256 afb4850419612e0daf1876a5d61120ed0ccae241f188c25c014602007b3a765b
MD5 8bff510abed2b6fcc5a83eedb65b1766
SHA1 ba6d0cd7504a5baeb963501b8bdf315ec6cb355c
SHA512 8786bd672ce9c53f4c31f8206d621eb06ae7527f9adf3700955cc1cb928dde145b684666a5eb4ac11301541f585970ccd377ba144da351741e3cb5769b6ff522
MD5 SHA1 SHA512

Submit Download

plugin.pack

Path C:\Program Files (x86)\Java\jre7\lib\plugin.pack
Size 489KB
SHA256 93defaaf7f82e2e9565b27dd31a41c89e02d1b7719d0da0b940a55dcc75b91e5
MD5 47d6cfa1b01a6d41885504bbc3b1919a
SHA1 3838060f9d530c972d65f36fa38b265120a218aa
SHA512 b0df9b174624234aaeb2b50cf611f698377925a0ae5c5ee9da46c65fcecf4d28941d1bf2332316d9327981c1f8c6c4fecf750e013f04eef63f5df52d27593135
SSDEEP 6144:pPYDxiUn5kuS7ogVc4r+cWaTu8KPVzsRnVPI6oWnfmoNOz4KMWpeNi+:pgx57IcEvWeSVzpN0OOWcNV
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.jar

Path C:\Program Files (x86)\Java\jre7\lib\rt.jar
Size 49.4MB
SHA256 a85b24d93ceb6095691838dda51d31bc5e8dc94663514b46c48d7c41d351aad2
MD5 bac77d8d145bd553c7efdf7978d9dff0
SHA1 31da52beb0237a6ffd6ebc4a766d92f12a226fb6
SHA512 2aabc1986338a68cdecf6d46afd6492a90940d9412bf8f7ad7c6183091403a784244ecf1007dc3875a892c0b1c2557f5de31f387011ca8db657f4367f5fc86ba
SSDEEP 196608:KBGhB5BSlLdAL/XYYLEY5tz9YW4ZrsdkatGvr4dKUy05VtkR/xCIMS:z5BSlu7lLX/9f0rsdkatGvr4dKUn0x6S
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.pack

Path C:\Program Files (x86)\Java\jre7\lib\rt.pack
Size 13.1MB
SHA256 82dc6806d9ec9eb16604f90a5c78d0d882b69a0e718d8f6c3c6b7c9719887b7e
MD5 b6d75e8c90c79af1579769f10b1e5c88
SHA1 146cb3f05fa161885e8faf079fa2bbd89b5c5b18
SHA512 02cdd0c0d6e71bc09120db2cd3b9471c0176567d92bb74a08c13e82c1d23722eb4afac41583a11dee3fc531fd442754ee0f5cb964898ec036ddd432947996037
SSDEEP 196608:xHWBePZbgggLYJ4329rRizU/ULUh49TXY9o9W:DPZbgggLYJ4m9CehoTo9o9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

GMT

Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT
Size 27B
SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
MD5 7da9aa0de33b521b3399a4ffd4078bdb
SHA1 f188a712f77103d544d4acf91d13dbc664c67034
SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
MD5 SHA1 SHA512

Submit Download

GMT+5

Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+5
Size 27B
SHA256 27ba8b5814833b1e8e8b5d08246b383cb8a5fb7e74e237cdbcadf320e882ab78
MD5 a2abe32f03e019dbd5c21e71cc0f0db9
SHA1 25b042eb931fff4e815adcc2ddce3636debf0ae1
SHA512 197c065b9c17c6849a15f45ac69dafa68aaa0b792219fedb153d146f23997bfa4fbc4127b1d030a92a4d7103bded76a1389df715b9539ea23ea21e6a4bb65fb2
MD5 SHA1 SHA512

Submit Download

HST

Path C:\Program Files (x86)\Java\jre7\lib\zi\HST
Size 27B
SHA256 3144bc5353ebbd941cdccbbd9f5fb5a06f38abf5cc7b672111705c9778412d08
MD5 715dc3fcec7a4b845347b628caf46c84
SHA1 1b194cdd0a0dc5560680c33f19fc2e7c09523cd1
SHA512 72ab4b4ad0990cce0723a882652bf4f37aac09b32a8dd33b56b1fbf25ac56ae054328909efd68c8243e54e449d845fb9d53dd95f47eaaf5873762fcd55a39662
MD5 SHA1 SHA512

Submit Download

MST

Path C:\Program Files (x86)\Java\jre7\lib\zi\MST
Size 27B
SHA256 0e6a7f1ab731ae6840eacc36b37cbe3277a991720a7c779e116ab488e0eeed4e
MD5 11f8e73ad57571383afa5eaf6bc0456a
SHA1 65a736dddd8e9a3f1dd6fbe999b188910b5f7931
SHA512 578665a0897a2c05eda59fb6828f4a9f440fc784059a5f97c8484f164a5fcec95274159c6ff6336f4863b942129cb884110d14c9bd507a2d12d83a4e17f596d2
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 1KB
SHA256 6bdcdd7036a4a4e3fa3b28db8877a853582be6d8abf240d9d5cddca991b86600
MD5 96b03c46e82bdfac0f482dbe9f8cb717
SHA1 7bf759e16f2de8f3ff02657d24dcbc4a1f95a151
SHA512 04299fc4776572f2047fbb4efa89c3ebee9d06250b98f27fa81cca3da02d871b4cbba7275d48ecbac2ba528d3710b484957d35ab2d9b8984fc7aabdc4dca6759
MD5 SHA1 SHA512

Submit Download

Data1.cab

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\Data1.cab
Size 24.6MB
SHA256 a84262dd486cf59049d0d2d9a1b00dfb5aa5271592edd8de0e052f12496dec67
MD5 003a488a2139105704566b47eb29520d
SHA1 52d672a592cd52ad5e2e7239421f2659e0d17afa
SHA512 ab34061f8e04bb1d59f1b35e0e1848a176f2b119095e79015130da3a4384c70fa35ecbe1625e07c0eb0de49c67bcdbba59f10fa1dfbbb2066dcb6ee6825215de
SSDEEP 393216:S9CUhZsoKK1mWskttt7gAbDvaywLI2tt8wTYP/LQb3044DZkPybune:J2ZsoLm7kttLbfwfmwuf1kqbune
MD5 SHA1 SHA512 SSDEEP

Submit Download

jre1.7.0_80.msi

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi
Size 898KB
SHA256 dbf28e21d55dd662cccf4d422a1a645a6a3dbfd6914942dde417d20c4d2fe01c
MD5 e24d9b483ce7a3a6a4406111883457f7
SHA1 0d5efff0d110c48f5e6f5d438967427f1e2dbf84
SHA512 b614b023ce683e78ee685be028fa06d7df90f10360d55de2a8c1214200b0b85998683502f377b01584bf23b72b168c33ef560a78d7abdf68aa3af87beca59398
SSDEEP 12288:JbSGg983mCR0sY9D4+doy8J5EMPhQmW9K+r:JbS1983zq4LbEI+S+r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 1KB
SHA256 62be27a8a06f5c37ee1cdf253626a6fc713b2fa2e2e194adefa80134895c8966
MD5 15a50c6629b0faae820ca336853393ba
SHA1 86870af583a7cdcb3652711ed715df67d4b8f104
SHA512 92195c7039c9cdfa14df1a5e0e1197c24f1c2dec5b521c1b43ef4fe92300d818470a129a81c94803b5680bbc1553076256129b398510fc0a8fc4c0e7cb131015
MD5 SHA1 SHA512

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 4KB
SHA256 544f2e390d8f6d3df5ab5d5765c682b7daa2f861029f877ff7949bb2a391e0ae
MD5 dd24d5f647d8b9a61a523c5a0a737fc0
SHA1 c2a54bf635f71d16d3a634d29ad3403d1867c5a9
SHA512 3fb1f9b2a12d94aae4e79b300ba85afe143ca8c44f88cb28a13ff2c9b0b8b6679bb8b3d1acd0bc4f2cf775eaf7d9da23ebf2d8087e6076a5049b4c2d3830dcba
SSDEEP 96:ogYYNd3Tzdv8BQNuXvToiBheBFB6BYBd3gI203:BYYNN+xUihe7qsd3gBW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 4KB
SHA256 c275702974b4d91b3e75528e3655406ff8b2acfc40a64a7246e4f4155d905531
MD5 39a26b24c42f9e8d3285a2ff98b687c2
SHA1 57dd1bcedfa085f5b9e85ca24f8f2f7c1ea83306
SHA512 9a1ce84d1b9df60ac4134aa5c9003a8a6cf618778ea7a9523870cc80cf8c69c4eb8f77544eff1faded98fc0ae1235a1491a35f5eecd49a656a53b810df3408de
SSDEEP 96:ogYYNd3Tzdv8BQNuXvToiBheBFB6BYBd3gI2023U3a3cX:BYYNN+xUihe7qsd3gB1Eq2
MD5 SHA1 SHA512 SSDEEP

Submit Download

hd.vbs

Path C:\Users\Admin\AppData\Local\Temp\hd.vbs
Size 245B
SHA256 4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
MD5 d8682d715a652f994dca50509fd09669
SHA1 bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA512 eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca
MD5 SHA1 SHA512

Submit Download

javaSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
Size 28.1MB
SHA256 a87adf22064e2f7fa6ef64b2513533bf02aa0bf5265670e95b301a79d7ca89d9
MD5 f2fd417b6d5c7ffc501c7632cc811c3e
SHA1 305c1493fca53ab63ba1686c9afdfb65142e59d3
SHA512 289ee902156537e039636722ad5ac8b0592cf5cffda3d03cf22240003627b049382b95db1b24cf6a2f7134b0df93ede65a80a86381fc161b54c84a76ed04458b
SSDEEP 786432:rLJxuM2ZsoLm7kttLbfwfmwuf1kqbunTn:51ktdbGmwut/Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 22KB
SHA256 e0e88bda4bcbbcfadb1009060372744f8b3f3628ae29b1d310a99255ec76aa7a
MD5 525bf7f5b63ffd5e86fa3aee92551c21
SHA1 bf3cd939fe57f5076afbd231cb5b1b0ea03ba5d0
SHA512 825d048f8a3eb7ec88bda27eaf34b5c05a9545a12d48d29fc264aeae571fb2b4aa2957cd1b5459d53dc5d18b7968760d47136a6ec099c5612c3a7ab677b24d73
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TP:c8L6gWt4wnAQ7WTb6aotVhP
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 23KB
SHA256 f7468e1cf9cb05006bb7eebf4ce106f98828351ac7d8637486794ba90e5f5bc2
MD5 18f48d6714640435ab93cad409e10070
SHA1 fd33c178274fb08adb77cf5c695ce29ba32417bd
SHA512 632e4957e610ab787ed9a2cf3e8d988acb16e4cfc4d4df9b52682ca54fa4f7fed980b7b5dd69b1c4dd71554894ee5e5199da630b721f3c7403652f923a16dcc1
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXUO:c8L6gWt4wnAQ7WTb6aotVhkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 23KB
SHA256 3532daff57c2b70280ef79edf17af55d108b2d46b88bdbf248fab74db2a43d14
MD5 a2623660c345873243bb8f88145663b5
SHA1 d8cabac7b4057649bb6ca31504719fb0881c7190
SHA512 60dc96479ae28a9011dee7a2e8ff2cb60ab548a6164ba8f5562fcd1cb154362677a68c98c62aa62333ac9812d4ddb3e332957efdbc5acfb5eade18f111c21f6e
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1F:c8L6gWt4wnAQ7WTb6aotVhk2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 24KB
SHA256 1e1a1fcf7c15b8f6019b1696765c696e69a510bb25fd29daa4f8286b206e738a
MD5 e2aaff5f40ba3fbc2df129ed2157dd19
SHA1 8d6b9aeeae45922687e24365cecffdc0e4997f08
SHA512 e1e5a42c4b5bac65b4747b149a694d738fe7e4e7c5398ef564885796e4d9d3cf5ae4ef1cd2066dd6ba24463654c090d79ac84e0f1ad76575155deab8088e6843
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ6:c8L6gWt4wnAQ7WTb6aotVhk2m0
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 25KB
SHA256 648dac2d3607a22d24056d6d29f1e43343c0e812faffa92a381f627cc42789d4
MD5 d2c611a13ec2cd37d228aad0305dc734
SHA1 b7d5dd93fb333c96f9d0c516fc862a1f6dc31ae8
SHA512 5e73bcfaf14e4a45068a74623e9ed39276844efc6269604ea231f1457c5837605e34ebc7fbf106156b0d653c3a0ce90bf0817d09a44a7b268718747506da70d3
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ5SuR:c8L6gWt4wnAQ7WTb6aotVhk2mzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 a0da062ab80c0dc8d84f51bd76faf53001cd4b48bcbc0ddae6d75e210ea92ccb
MD5 6395ef19c45e81bddd74837a1394acb5
SHA1 92a97d8fa5c76891d0df4b4d9812370ee85859b9
SHA512 5bb7439566d386aa46774e71378284fff75855f2b5971345d54e5142a23a9488a49b1de2a9533d37cb3f33c8d50cc64727daac7c96ca6dd3779144379a068fdb
SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4K:BL6g648Hs6aotE2mzViqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 2f0f162f348b4020566418fd30c090fac83883284dde7c163b923f68d0886c69
MD5 cc147c8509b89de26462cd73e51d3df4
SHA1 b37e85f40a18c1832530a760b309799378f7f6a9
SHA512 b8ef88fc7c91371605dc12a6fae41fa576836ad7eecbf728cd78ab5de9b235c221d5f43d2e9f9adc234f6ae5c3e823dd1b213aaa0340aa8d341015ad393a3e93
SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4Jt:BL6g648Hs6aotE2mzViqJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install_reg.log

Path C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
Size 3KB
SHA256 9bf99654183263090ac650e9f691e074a0de278848a0b618df2c074d9fac23e7
MD5 a571a80e3e7f07d8d5318528ffcf057f
SHA1 e3ec23f4b500ff697f327a186c6b7a1d0203d242
SHA512 70db57b8e9aafeaf7fb4e7c7bc4a7b91297b3e5ed7dbe683c63c8191bd98c0a92457d92ee4ee379eca4935c85362cbbfb1bc9fa4a00cc010afec40752d641be4
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 296KB
SHA256 ecd59e99305668420393eeef89851b6a8d34a62311cb5d8e082ff5d6ba920653
MD5 347a69a152f35830f0870ca820c97cb1
SHA1 9cf1429971dd10040c58c176b3b84738f38ac481
SHA512 898d6154c868668c0b86a23962a42fb6f725250154dd9e2cbd0e5d41e6dd2f6826d488de4bf0cbee4cbb71f89d525cab42f86666a0c65864def91fab9bd82b54
SSDEEP 3072:cgidNIbgSc7FAwHFR75yNblPYBHyyADSwBj9jJn0vxfYgF9MbEeknnolBVB1uvBX:QAUJVDa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 295KB
SHA256 09d6874d6ffc2c7f776bbc2fb7e59591f811c6d3b236e68686f58cb0961decbb
MD5 36d0c3aac6942043fe5c036c7d1aa209
SHA1 5a0db2e23d6eba0055a51f37eea3e055070ff51c
SHA512 91e81bc975303679f65cdd32e6bc2f8582dd434eef8b38dd7d0ff948e75486d4c46bc2373cb142244c749c98af010d36ec3288043556ea0fca816cc33ea9618b
SSDEEP 3072:cgidNIbgSc7FAwHFR75yNblPYBHyyADSwBj9jJn0vxfYgF9MbEeknnolBVB1uvBn:QAUJVDa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 295KB
SHA256 94b5593f350a05a7e037e8159f1b72850c449bf2459b35a6424d23bedbd884e9
MD5 a4f3e925eef8f317980989f51445becc
SHA1 db60bd7d29be358abfc6367d38604f1bb8d37a57
SHA512 4816b367f6bfcc7fa1d860cb166d5c326f5e8a6d2e3b3bb212b5b63d6443a673a7cfd1113fcbe32c1d20deec9fccb62e6aac0034016eac2bea86e106360eb976
SSDEEP 3072:cgidNIbgSc7FAwHFR75yNblPYBHyyADSwBj9jJn0vxfYgF9MbEeknnolBVB1uvBH:QAUJVDaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

init.xml

Path C:\Users\Admin\AppData\Roaming\Zona\init.xml
Size 300B
SHA256 8ed77d57b4cb95d8587dc74ed6bf58f97891d71941aa0cdeb65ada23d09067ac
MD5 9e487faa3361606f5dbd5654cb2bd433
SHA1 deb671b47cef79311fc1bba4de7369be56fd739e
SHA512 d8cfd6c6373b5694709e053d1ec43d7efd2d839bcefbe56c7ea86e0cd408450b3186fd73ac980a12a1ed72fc69f2b7290fc160e6b07e529c2412380fe98ec62b
MD5 SHA1 SHA512

Submit Download

MSI19FB.tmp

Path C:\Windows\Installer\MSI19FB.tmp
Size 202KB
SHA256 bf4e4c75d148cb412e28a0b4e665919fd5ac6b9aa6bc3fa75401394759218d5e
MD5 9f84d910602183954bed6d9660600783
SHA1 82e3b122dc63e0a333bca531dd16667d5fafbf23
SHA512 09fb450e6c6f22a32d5e06f470070aab17d4973afe307b529093af7fa29ab96b61a89814e4964d005459f8ebb25716134a5e1c41f6ea7d260361b135306544b9
SSDEEP 3072:nCYl9W8fZ2MaPI/K4W7AfchMoCzWNb/sVq5+/DzaRspvh:nHlg8fZ2MfK4dUyoyu/x56u+hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/348-44-0x0000000000A30000-0x0000000000A80000-memory.dmp

Download

memory/348-0-0x0000000000A30000-0x0000000000A80000-memory.dmp

Download

memory/1352-1665-0x0000000001430000-0x0000000001431000-memory.dmp

Download

memory/2056-1570-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download

memory/2056-1576-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download

memory/2300-45-0x0000000000A30000-0x0000000000A80000-memory.dmp

Download

memory/2528-1631-0x00000000027A0000-0x00000000027A1000-memory.dmp

Download

memory/2724-1441-0x000000003AE00000-0x000000003AE10000-memory.dmp

Download

memory/2724-1463-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/4872-840-0x0000000001760000-0x0000000001761000-memory.dmp

Download