Analysis
-
max time kernel
181s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 13:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
possiblevirus.zip
Resource
win7-20240221-en
windows7-x64
25 signatures
150 seconds
General
-
Target
possiblevirus.zip
-
Size
203.3MB
-
MD5
3e628dc56284857b6a5f68153f0ee156
-
SHA1
8db5366976842c3ad3597fd4ba58b1aefa2d6562
-
SHA256
54cbc215df1b2e4a33f49a7bd498a9167e8a2c374cfaa990fd18417df056f13e
-
SHA512
18ebc25076dece0badc9593697d3965926be93350aeb75435e6eb410a71e7a426536bf76addedb5c45957eaa150c7dabd41dbe3af9fc487dd24883614ba8f472
-
SSDEEP
6291456:kAruI9iSD/RcG2Oxy0yERVDVzuSfnaxd1q3w4ZwIOhjIgz:FruIJDmGngiDbvoPq37Zmhtz
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0003000000021189-3316.dat acprotect -
Executes dropped EXE 28 IoCs
pid Process 2336 jdk.exe 1496 unpack200.exe 3064 unpack200.exe 404 unpack200.exe 1656 unpack200.exe 952 unpack200.exe 1724 unpack200.exe 1368 unpack200.exe 2124 unpack200.exe 1916 javaw.exe 1028 jre.exe 2204 installer.exe 1680 bspatch.exe 556 unpack200.exe 1436 unpack200.exe 1588 unpack200.exe 2288 unpack200.exe 2296 unpack200.exe 2412 unpack200.exe 584 unpack200.exe 1300 javaw.exe 1580 ssvagent.exe 1588 javaws.exe 2308 jp2launcher.exe 708 javaws.exe 840 jp2launcher.exe 2552 java.exe 1820 i4jdel0.exe -
Loads dropped DLL 64 IoCs
pid Process 2908 jdk.exe 3036 MsiExec.exe 3036 MsiExec.exe 3036 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1640 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1484 MsiExec.exe 1496 unpack200.exe 3064 unpack200.exe 404 unpack200.exe 1656 unpack200.exe 952 unpack200.exe 1724 unpack200.exe 1368 unpack200.exe 2124 unpack200.exe 1484 MsiExec.exe 1916 javaw.exe 1916 javaw.exe 1916 javaw.exe 1916 javaw.exe 1916 javaw.exe 2232 msiexec.exe 1916 MsiExec.exe 1916 MsiExec.exe 1916 MsiExec.exe 2204 installer.exe 1680 bspatch.exe 1680 bspatch.exe 1680 bspatch.exe 2204 installer.exe 556 unpack200.exe 1436 unpack200.exe 1588 unpack200.exe 2288 unpack200.exe 2296 unpack200.exe 2412 unpack200.exe 584 unpack200.exe 2204 installer.exe 2204 installer.exe 2204 installer.exe 1300 javaw.exe 1300 javaw.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2404 icacls.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0109-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0123-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0205-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0013-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0051-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0086-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0078-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0179-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0042-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0140-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0124-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0144-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0007-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0095-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0094-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0068-ABCDEFFEDCBC}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0152-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0103-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0015-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0105-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0180-ABCDEFFEDCBC}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0165-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0084-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0116-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0018-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBC}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0098-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0133-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0097-ABCDEFFEDCBC}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0127-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0165-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0125-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0131-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0138-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0155-ABCDEFFEDCBC}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0121-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0072-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0201-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0069-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0100-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0066-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0055-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0186-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0053-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe -
resource yara_rule behavioral1/memory/2864-3246-0x0000000015260000-0x00000000152CB000-memory.dmp upx behavioral1/memory/2864-3275-0x0000000015260000-0x00000000152CB000-memory.dmp upx behavioral1/memory/2864-3293-0x0000000015260000-0x00000000152CB000-memory.dmp upx behavioral1/files/0x0003000000021189-3316.dat upx behavioral1/memory/2864-3320-0x0000000015260000-0x00000000152CB000-memory.dmp upx behavioral1/memory/864-3362-0x0000000000F20000-0x0000000000F8B000-memory.dmp upx behavioral1/memory/864-3385-0x0000000000F20000-0x0000000000F8B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\"" msiexec.exe -
Blocklisted process makes network request 5 IoCs
flow pid Process 4 2232 msiexec.exe 6 2232 msiexec.exe 8 2232 msiexec.exe 10 2232 msiexec.exe 11 1836 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" installer.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsAccessBridge-64.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\WindowsAccessBridge-64.dll MsiExec.exe File created C:\Windows\SysWOW64\WindowsAccessBridge-32.dll installer.exe File created C:\Windows\SysWOW64\WindowsAccessBridge-64.dll installer.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar MsiExec.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\api-ms-win-crt-locale-l1-1-0.dll installer.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\jre\lib\deploy\messages_zh_HK.properties MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.2.174165\icons\send-email-16.png MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar MsiExec.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\j2pkcs11.dll installer.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\jre\lib\management\snmp.acl.template MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.2.174165.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.2.174165\icons\new-trigger-wiz.gif MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\bin\jhat.exe MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar MsiExec.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\api-ms-win-crt-stdio-l1-1-0.dll installer.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\nio.dll installer.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2launcher.exe installer.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\klist.exe MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\dropins\README.TXT MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.2.174165\html\dcommon\gifs\rightnav.gif MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar MsiExec.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\dt_shmem.dll installer.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.2.174165.jar MsiExec.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\plugin2\msvcr100.dll installer.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.2.174165\html\dcommon\gifs\masterix.gif MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.2.174165\schema\triggerConstraints.exsd MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\jre\lib\ext\sunmscapi.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\config\Modules\org-openide-explorer.xml MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\org-openide-explorer.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\dtplugin\npdeployJava1.dll MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar MsiExec.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\api-ms-win-crt-math-l1-1-0.dll installer.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\keytool.exe installer.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\glib-lite.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\client\jvm.dll installer.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\vcruntime140.dll installer.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar MsiExec.exe File created C:\Program Files (x86)\Java\jre1.8.0_191\bin\api-ms-win-core-rtlsupport-l1-1-0.dll installer.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.2.174165\icons\flight_recorder.png MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar MsiExec.exe File created C:\Program Files (x86)\Java\jdk1.8.0_191\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml MsiExec.exe -
Drops file in Windows directory 52 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIC512.tmp msiexec.exe File opened for modification C:\Windows\Installer\f77aa67.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFA8F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI420E.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f77aa64.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC5FF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB11A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB1F7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC445.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC542.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC672.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f77aa63.msi msiexec.exe File opened for modification C:\Windows\Installer\f77aa6a.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB14A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC64F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC660.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIB0CA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB0EA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC5DF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC62F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4780.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC661.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFB3D.tmp msiexec.exe File created C:\Windows\Installer\f77aa6c.msi msiexec.exe File created C:\Windows\Installer\f77aa6d.msi msiexec.exe File created C:\Windows\Installer\f77aa72.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB0AA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFAFD.tmp msiexec.exe File created C:\Windows\Installer\f77aa70.ipi msiexec.exe File opened for modification C:\Windows\Installer\f77aa70.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB267.tmp msiexec.exe File created C:\Windows\Installer\f77aa6a.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSIAE95.tmp msiexec.exe File created C:\Windows\Installer\f77aa67.msi msiexec.exe File created C:\Windows\Installer\f77aa63.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB17A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC671.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFB0D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB04B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB246.tmp msiexec.exe File created C:\Windows\Installer\f77aa66.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBDB0.tmp msiexec.exe File opened for modification C:\Windows\Installer\f77aa64.ipi msiexec.exe File opened for modification C:\Windows\Installer\f77aa6d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI43E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB2A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC4E2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI46E2.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\Policy = "3" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024" installer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main jre.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Windows\\SysWOW64" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppName = "jp2launcher.exe" installer.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0125-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0072-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0133-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0004-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0145-ABCDEFFEDCBC}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0079-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0113-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0170-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_77" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0168-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0076-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_48" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0114-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0135-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0191-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0168-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0188-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_188" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0039-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0042-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0092-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0178-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0091-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_91" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0186-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0120-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_120" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0147-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_50" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0040-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0072-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0110-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0106-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_14" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0012-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0036-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0141-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_141" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0166-ABCDEFFEDCBC} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0004-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0175-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0051-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0127-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0179-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0095-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0068-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0115-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0175-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0099-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0160-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0090-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0110-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0117-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0171-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0039-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBC}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0085-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0189-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0061-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0075-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0041-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0148-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0035-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0158-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_158" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0098-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0079-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_79" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0116-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_116" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0148-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBB} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0040-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0093-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA} ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0091-ABCDEFFEDCBC}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0162-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_35" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0064-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_64" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0067-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_67" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0081-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBA} ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0087-ABCDEFFEDCBC}\InprocServer32 ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0103-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0084-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_84" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0033-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_62" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0177-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0122-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0051-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0053-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_68" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0003-ABCDEFFEDCBB} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0025-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0100-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0061-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0077-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_77" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0020-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_20" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0183-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0137-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_191\\bin\\jp2iexp.dll" ssvagent.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 jre.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde jre.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1836 msiexec.exe 1836 msiexec.exe 1588 javaws.exe 2308 jp2launcher.exe 708 javaws.exe 840 jp2launcher.exe 1836 msiexec.exe 1836 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2232 msiexec.exe Token: SeIncreaseQuotaPrivilege 2232 msiexec.exe Token: SeRestorePrivilege 1836 msiexec.exe Token: SeTakeOwnershipPrivilege 1836 msiexec.exe Token: SeSecurityPrivilege 1836 msiexec.exe Token: SeCreateTokenPrivilege 2232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2232 msiexec.exe Token: SeLockMemoryPrivilege 2232 msiexec.exe Token: SeIncreaseQuotaPrivilege 2232 msiexec.exe Token: SeMachineAccountPrivilege 2232 msiexec.exe Token: SeTcbPrivilege 2232 msiexec.exe Token: SeSecurityPrivilege 2232 msiexec.exe Token: SeTakeOwnershipPrivilege 2232 msiexec.exe Token: SeLoadDriverPrivilege 2232 msiexec.exe Token: SeSystemProfilePrivilege 2232 msiexec.exe Token: SeSystemtimePrivilege 2232 msiexec.exe Token: SeProfSingleProcessPrivilege 2232 msiexec.exe Token: SeIncBasePriorityPrivilege 2232 msiexec.exe Token: SeCreatePagefilePrivilege 2232 msiexec.exe Token: SeCreatePermanentPrivilege 2232 msiexec.exe Token: SeBackupPrivilege 2232 msiexec.exe Token: SeRestorePrivilege 2232 msiexec.exe Token: SeShutdownPrivilege 2232 msiexec.exe Token: SeDebugPrivilege 2232 msiexec.exe Token: SeAuditPrivilege 2232 msiexec.exe Token: SeSystemEnvironmentPrivilege 2232 msiexec.exe Token: SeChangeNotifyPrivilege 2232 msiexec.exe Token: SeRemoteShutdownPrivilege 2232 msiexec.exe Token: SeUndockPrivilege 2232 msiexec.exe Token: SeSyncAgentPrivilege 2232 msiexec.exe Token: SeEnableDelegationPrivilege 2232 msiexec.exe Token: SeManageVolumePrivilege 2232 msiexec.exe Token: SeImpersonatePrivilege 2232 msiexec.exe Token: SeCreateGlobalPrivilege 2232 msiexec.exe Token: SeCreateTokenPrivilege 2232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2232 msiexec.exe Token: SeLockMemoryPrivilege 2232 msiexec.exe Token: SeIncreaseQuotaPrivilege 2232 msiexec.exe Token: SeMachineAccountPrivilege 2232 msiexec.exe Token: SeTcbPrivilege 2232 msiexec.exe Token: SeSecurityPrivilege 2232 msiexec.exe Token: SeTakeOwnershipPrivilege 2232 msiexec.exe Token: SeLoadDriverPrivilege 2232 msiexec.exe Token: SeSystemProfilePrivilege 2232 msiexec.exe Token: SeSystemtimePrivilege 2232 msiexec.exe Token: SeProfSingleProcessPrivilege 2232 msiexec.exe Token: SeIncBasePriorityPrivilege 2232 msiexec.exe Token: SeCreatePagefilePrivilege 2232 msiexec.exe Token: SeCreatePermanentPrivilege 2232 msiexec.exe Token: SeBackupPrivilege 2232 msiexec.exe Token: SeRestorePrivilege 2232 msiexec.exe Token: SeShutdownPrivilege 2232 msiexec.exe Token: SeDebugPrivilege 2232 msiexec.exe Token: SeAuditPrivilege 2232 msiexec.exe Token: SeSystemEnvironmentPrivilege 2232 msiexec.exe Token: SeChangeNotifyPrivilege 2232 msiexec.exe Token: SeRemoteShutdownPrivilege 2232 msiexec.exe Token: SeUndockPrivilege 2232 msiexec.exe Token: SeSyncAgentPrivilege 2232 msiexec.exe Token: SeEnableDelegationPrivilege 2232 msiexec.exe Token: SeManageVolumePrivilege 2232 msiexec.exe Token: SeImpersonatePrivilege 2232 msiexec.exe Token: SeCreateGlobalPrivilege 2232 msiexec.exe Token: SeCreateTokenPrivilege 2232 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2232 msiexec.exe 1028 jre.exe 2232 msiexec.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1028 jre.exe 1028 jre.exe 1028 jre.exe 1028 jre.exe 1028 jre.exe 1028 jre.exe 2308 jp2launcher.exe 840 jp2launcher.exe 2864 ERROR422.exe 2864 ERROR422.exe 864 ERROR422.exe 864 ERROR422.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2336 2908 jdk.exe 37 PID 2908 wrote to memory of 2336 2908 jdk.exe 37 PID 2908 wrote to memory of 2336 2908 jdk.exe 37 PID 2908 wrote to memory of 2336 2908 jdk.exe 37 PID 2908 wrote to memory of 2336 2908 jdk.exe 37 PID 2908 wrote to memory of 2336 2908 jdk.exe 37 PID 2908 wrote to memory of 2336 2908 jdk.exe 37 PID 2336 wrote to memory of 2232 2336 jdk.exe 38 PID 2336 wrote to memory of 2232 2336 jdk.exe 38 PID 2336 wrote to memory of 2232 2336 jdk.exe 38 PID 2336 wrote to memory of 2232 2336 jdk.exe 38 PID 2336 wrote to memory of 2232 2336 jdk.exe 38 PID 2336 wrote to memory of 2232 2336 jdk.exe 38 PID 2336 wrote to memory of 2232 2336 jdk.exe 38 PID 1836 wrote to memory of 3036 1836 msiexec.exe 40 PID 1836 wrote to memory of 3036 1836 msiexec.exe 40 PID 1836 wrote to memory of 3036 1836 msiexec.exe 40 PID 1836 wrote to memory of 3036 1836 msiexec.exe 40 PID 1836 wrote to memory of 3036 1836 msiexec.exe 40 PID 1836 wrote to memory of 3036 1836 msiexec.exe 40 PID 1836 wrote to memory of 3036 1836 msiexec.exe 40 PID 1836 wrote to memory of 1640 1836 msiexec.exe 44 PID 1836 wrote to memory of 1640 1836 msiexec.exe 44 PID 1836 wrote to memory of 1640 1836 msiexec.exe 44 PID 1836 wrote to memory of 1640 1836 msiexec.exe 44 PID 1836 wrote to memory of 1640 1836 msiexec.exe 44 PID 1836 wrote to memory of 1640 1836 msiexec.exe 44 PID 1836 wrote to memory of 1640 1836 msiexec.exe 44 PID 1836 wrote to memory of 1484 1836 msiexec.exe 45 PID 1836 wrote to memory of 1484 1836 msiexec.exe 45 PID 1836 wrote to memory of 1484 1836 msiexec.exe 45 PID 1836 wrote to memory of 1484 1836 msiexec.exe 45 PID 1836 wrote to memory of 1484 1836 msiexec.exe 45 PID 1836 wrote to memory of 1484 1836 msiexec.exe 45 PID 1836 wrote to memory of 1484 1836 msiexec.exe 45 PID 1484 wrote to memory of 1496 1484 MsiExec.exe 46 PID 1484 wrote to memory of 1496 1484 MsiExec.exe 46 PID 1484 wrote to memory of 1496 1484 MsiExec.exe 46 PID 1484 wrote to memory of 1496 1484 MsiExec.exe 46 PID 1484 wrote to memory of 3064 1484 MsiExec.exe 48 PID 1484 wrote to memory of 3064 1484 MsiExec.exe 48 PID 1484 wrote to memory of 3064 1484 MsiExec.exe 48 PID 1484 wrote to memory of 3064 1484 MsiExec.exe 48 PID 1484 wrote to memory of 404 1484 MsiExec.exe 50 PID 1484 wrote to memory of 404 1484 MsiExec.exe 50 PID 1484 wrote to memory of 404 1484 MsiExec.exe 50 PID 1484 wrote to memory of 404 1484 MsiExec.exe 50 PID 1484 wrote to memory of 1656 1484 MsiExec.exe 52 PID 1484 wrote to memory of 1656 1484 MsiExec.exe 52 PID 1484 wrote to memory of 1656 1484 MsiExec.exe 52 PID 1484 wrote to memory of 1656 1484 MsiExec.exe 52 PID 1484 wrote to memory of 952 1484 MsiExec.exe 54 PID 1484 wrote to memory of 952 1484 MsiExec.exe 54 PID 1484 wrote to memory of 952 1484 MsiExec.exe 54 PID 1484 wrote to memory of 952 1484 MsiExec.exe 54 PID 1484 wrote to memory of 1724 1484 MsiExec.exe 56 PID 1484 wrote to memory of 1724 1484 MsiExec.exe 56 PID 1484 wrote to memory of 1724 1484 MsiExec.exe 56 PID 1484 wrote to memory of 1724 1484 MsiExec.exe 56 PID 1484 wrote to memory of 1368 1484 MsiExec.exe 58 PID 1484 wrote to memory of 1368 1484 MsiExec.exe 58 PID 1484 wrote to memory of 1368 1484 MsiExec.exe 58 PID 1484 wrote to memory of 1368 1484 MsiExec.exe 58 PID 1484 wrote to memory of 2124 1484 MsiExec.exe 60 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\possiblevirus.zip1⤵PID:2932
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1812
-
C:\Users\Admin\Desktop\jdk.exe"C:\Users\Admin\Desktop\jdk.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\jds259488194.tmp\jdk.exe"C:\Users\Admin\AppData\Local\Temp\jds259488194.tmp\jdk.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\jdk1.8.0_191.msi" WRAPPER=13⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2232 -
C:\Program Files (x86)\Java\jdk1.8.0_191\jre.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\\jre.exe" LAUNCHEDFROMJDK=1 NOSTARTMENU=04⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1028
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A7D95E6EFCC4C37D43C9DCA8A52942DB C2⤵
- Loads dropped DLL
PID:3036
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5646E11BB6D95F514E85B2125CA482A12⤵
- Loads dropped DLL
PID:1640
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CFB70F578105C1487618A3032438A4AE M Global\MSI00002⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\lib/tools.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\lib/tools.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496
-
-
C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/plugin.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/plugin.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064
-
-
C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/javaws.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/javaws.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404
-
-
C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/deploy.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/deploy.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656
-
-
C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/rt.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/rt.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952
-
-
C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/jsse.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/jsse.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724
-
-
C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/charsets.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/charsets.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368
-
-
C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/ext/localedata.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/ext/localedata.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124
-
-
-
C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\javaw.exe"C:\Program Files (x86)\Java\jdk1.8.0_191\\jre\bin\javaw.exe" -Xshare:dump2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1C92FC27BBD724F4B1D0ADF6AD4EDEBA2⤵
- Loads dropped DLL
PID:1916
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\installer.exe"C:\Program Files (x86)\Java\jre1.8.0_191\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_191\\" NOSTARTMENU=0 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F32180191F0}2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2204 -
C:\ProgramData\Oracle\Java\installcache\259522030.tmp\bspatch.exe"bspatch.exe" baseimagefam8 newimage diff3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/plugin.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/plugin.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/javaws.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/javaws.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/deploy.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/deploy.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/rt.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/rt.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/jsse.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/jsse.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/charsets.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/charsets.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jre1.8.0_191\lib/ext/localedata.pack" "C:\Program Files (x86)\Java\jre1.8.0_191\lib/ext/localedata.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaw.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\ssvagent.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\ssvagent.exe" -doHKCUSSVSetup3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:1580
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1588 -
C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_191" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzE5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF8xOTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzE5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2308
-
-
-
C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:708 -
C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_191" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzE5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF8xOTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzE5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfMTkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:840
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1529ADED326C19F354DB7D240063E9C6 M Global\MSI00002⤵PID:1964
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F8F3A15227565ED0DF22DE8D59031AEB2⤵PID:2296
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5B51C9DB30858ECBCDF5C239AA9CD439 M Global\MSI00002⤵PID:2136
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:292
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000039C" "00000000000005A8"1⤵
- Drops file in Windows directory
PID:2556
-
C:\Users\Admin\Desktop\ERROR422.exe"C:\Users\Admin\Desktop\ERROR422.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2864 -
\??\c:\PROGRA~2\java\JRE18~1.0_1\bin\java.exec:\PROGRA~2\java\JRE18~1.0_1\bin\java.exe -version2⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
PID:2404
-
-
-
C:\Users\Admin\AppData\Local\Temp\i4jdel0.exeC:\Users\Admin\AppData\Local\Temp\i4jdel0.exe i4j2103185418786758747.tmp2⤵
- Executes dropped EXE
PID:1820
-
-
C:\Users\Admin\Desktop\ERROR422.exe"C:\Users\Admin\Desktop\ERROR422.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:864
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
File and Directory Permissions Modification
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD50d99ab8354c4acd26679bcd140c9271c
SHA11f2da58bb92661c20a02938614129cc7f8384437
SHA2567f5c12feb30f544b84fb2cc5539905aaf41eda63240531f2084c9722ea064c83
SHA512e1baa6b14abf36c025ce749bf1a4ca750183de1a07ef2c3bc3063037fd77435a9795ac45c4ee10fb41820d231c223aa6eae42d3d4f9d510ac1c8f1715015a3a7
-
Filesize
739KB
MD5749560c5359d37ccc75746c6ea6af900
SHA15e41f68bc56cea1f1c18290cea2f8ab5a1491695
SHA25662e420d893683db8cf590f8e1bda990ee1447ecf4905a27c0dd0708515a17bc8
SHA51262529a06ee247fcad2e2616ae6b886cb4e63d3104208fdebf97a80f287fbcb6e77447c6ea78970ecd4110e60a0e8b0b439bb07e50479838f22109261b4cde836
-
Filesize
7KB
MD5eef7850d793c5535abecb33401919d64
SHA16d5bb95df3dab5531cacda9ad9730550f4136368
SHA256141d5adf122cb60fac21abab3979423a3088e3b83a12db084f3aecb5bce7f1d2
SHA51249e5bb83f80ec12ef1cde4bbe87fc09c4d92ec785b86f59e487c1e9411ac6f9c8c9c8a7ab56e242ea9ca2a866a465eb9ffb835aec347d0f4cbc2e1696f4c541a
-
Filesize
187KB
MD584c2540cedb08c146d1ad06122e6cc12
SHA176e71ce35f5de6b23c5eeb4ec76c806c78b76e78
SHA25674c51f97510362f319a21ec98ad4d09099a81c6a2829aacb5e3ad21e573e3276
SHA512e43bc79ee0046112458141d0b534600b00ef06ea66a97c26b651e0d39f14288b15510b8db70433ae2ebaf9c7f5e094b1f9967d96f5154dc632c09d48c093944d
-
Filesize
157KB
MD5246c529b7689f21e7af745cfd30e8ae0
SHA17f3ec69458623951844dc3eb3a216e305e3cbe99
SHA25650132c406ebdac4dcca39a804d866c9bfc46ac5fcd784aaab0b53a6c245389f1
SHA512a85ab8bb017a4fd581a8579b4fb61e33d4c20257187e4613a8b2bcd389febc22b7b902b2f9accd3e5c77d117eed065a1a5e85148171f2b7cb1d6e02d7476ec85
-
C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
Filesize12KB
MD5b35adb5213ca9657e911e9befb180842
SHA18d80da0c92c1269b610b03cc8061556004898c85
SHA2569a96d0daf98aa6fb4aa530d399c742c66121b0bdae4a1f7ffa22d2135e1df7fd
SHA51282112691ba9b49c3e335e7eb7a426f5d24072c72424612b0d07863560fd37042b6408317db9bd973280eb17e100ec25d3ce18cc6eeedc57c27d338fa517ea6fa
-
C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
Filesize8KB
MD51fabf1d6edd14f933014d5557c7b7522
SHA167958aa114880c281036cc14a4e53fa123c4d9ad
SHA2565f7d79ccbca7bdd2d9e036984a8a60c6bb9051411a740dc538f36f882f983b6e
SHA5124c4f2caafc7ea9e97303f31c6f6a192a64fea4f24cc9d071b8339a519c1ea7f951e14571c9e9a23eee140fb676c7b213dc25828b274639046d9e01f6cd85dd3b
-
C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf
Filesize57B
MD5adf99b54fd6f317b611320564167c305
SHA1d3d80dd39b686e04bf31db6ac9335084e841ef73
SHA2561b68454d53e781f8793547fde8fcb2f3b03b5c8134f37b9d8c4045cb8a5473f3
SHA51265fb44cdaf01632d60ecf3b49ab1eb661982ee8b6a430dcf6d1e75789787c9e7356754cd071421ca44a1b32ab918be97a630b1b0ca722383eea56d40fa131642
-
C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA
Filesize7KB
MD536f381cc8f60a659777f1133a006de4f
SHA1b70e38fecb27a4de0776951a919bf072e601690e
SHA256a3f56fee6bf824076f7599298272225f054dabac6a45b517eedfedc1f37d3c16
SHA512dc1afd3b53c97c090c3baae27ef50531b27ce72509fbe2d3d4e53b99bcf7d555d13a7545a072c518e446bc433c2cf14300bb149e784a1db841ef9c3f3dd0efae
-
Filesize
903KB
MD5a7ac8b0a6af8e231691916e04b7c6c76
SHA13f9920d0af8e7a49a64071c5454f2b52ba596f86
SHA2564d8a8cb37ef56063275cc89505f6a63a93b54b2b68d51a34f7508a1f6ba748e0
SHA5128d319c220b25ad37cc95ee504fd18dd2d2123da93bef60eb0cd204e77264f9c40c2d66763acc9f37f1a3d5d6d6c90eac303756ccb6d2939f8548828a0af981f0
-
Filesize
72KB
MD593ac2627e46c745ecb3ef6254ff0a766
SHA1dfab6a056af2cd51210cab55008df5b2f88bf4fd
SHA256185a37b058233eb244cdae848cae70d0bc121c9a84904f956f340a9d15e4571d
SHA51255529b59e3707261c8fae767f0ecb20d5a698f58ff5d50c2ba9adef9aace51a0dc0e210fc2e4f16b314064715d08b9bb491b759813ce1b70a713373cf85c62c1
-
Filesize
293KB
MD5ee9b8795f3406088f917a1adf954ba18
SHA13f2aa657cf6e5a627251faf663b584a1e98506af
SHA256441fbffc24d77195478a6a44cfd71949403824079af9122d015e04869b00d11d
SHA5126fb836f04467bbd30bd1b0325f39082293b822571df4e4a4403f3dbecf2df3faa2c2f68c721278863aa4fa553659d8f55bf4075d7cb007fdad0f9d40f399e837
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
157KB
MD5f4eea0a4c94bec535c7f784acb10755f
SHA1bf6b27abde6411aeadefcd44814077a448b60c18
SHA256dbec210d8cb3da15bd62089ce7fc744adaba777c72c6fc130658f0823d001f3b
SHA5122347be3a2fee9f1562c6bbeec9db167686a83d456cb549c12dcea8a6fa548672777fe172c37528d6a42395ca91b339cab99d76dcaf3694ac3a0c3b827218896a
-
Filesize
153B
MD51e9d8f133a442da6b0c74d49bc84a341
SHA1259edc45b4569427e8319895a444f4295d54348f
SHA2561a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA51263d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
-
Filesize
174B
MD5d0a48bed029d91024cb63ba26db4f1dd
SHA10bed8560b2a7e8a289e5a614fc372e96b8b3ff86
SHA25680967b0f062f3f9bef405568a8fea23b7133d5ec90bca4e7f3e63867cf0973aa
SHA512e8f711b20a4f7f65fdcbd4029fad38cb2c331aaa6603d00b83a57d01c2d28ce02571899f03296773a261691439f8d82075f3162c1893566d595c242b6271d9db
-
Filesize
188B
MD5db58f9c4c049cb162f4426330998377d
SHA1b589963d6dd1a62ef592c9ad6db08564b489f395
SHA256751af3b68c7a03f259310f863a0c408c6491b4dd1a05aec658577598559e2359
SHA51280943161d9fe32bbac1de855f2e178d276c342d63b6f575c701fd51297b568dd7ae7e192f8a629fda22294745d1cdfdbf78a06601175fca51f5de1086a21ad15
-
Filesize
157B
MD541c13a9a5fd367e45c5d3f41e6fb58a0
SHA10ffb174824517bfd4b0ccc2cbb799c12b12cdff5
SHA25651aa064a2552dbe6e02a80bef5febb01ed14db92c3318d1ca331f1478620773a
SHA5125853dd004b69e64ba187a7b2cbaba31f801add59b1b65183887178940a5c0301ec8c1a1b6f3625107af67b6a4e4da7ef3ca476b73894f4b4ff7a3b69c3ab130d
-
Filesize
55B
MD5e7efb291d380f8909996928a86837f85
SHA1c85d600a5d719dd1f1a21078fbb18f64ccf9840a
SHA25616980d263a0156bbd80ba8bed4bb784fb7aae3139ae1ea5a80fb6b8562a00f94
SHA5129bac07c737c55bc6766382277263ae2de8f1695ab06bd9b0a03910c4cb75418c25c20e0fec0bd342198929b71a250b6cb8c71e958380291d151036bdfc86ecc8
-
Filesize
834B
MD5cbed24fd2b55aea95367efca5ee889de
SHA1946f48b5c344fd57113845cd483fed5fb9fa3e54
SHA2561dc8a0fcbe260b77adfe5ad9aaac543239b2a0d9f4e1f3c2657beee4376ffee4
SHA512c504a11ea576f8ce14de26a0617e22e71e14db0f1dadefc187ce94e4a35a83743c743824e3629899c262aae4772bb86a0ee5bb643db20645483f0c376215ec6b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_1958C8FC5F0E0F8549703D0A9B9309B5
Filesize1KB
MD5f4269fbe083d249ded77154478c0c320
SHA1f64343bd7c5d9758cb73a9a670407853722c1bd5
SHA256c95a89ff7595be5ae9b5b33365b71555acd7d0eacd0280b62e7c7609a502f02c
SHA512627dc4f08840502121caaa817f2d3dc194f279218a5e4a1adf6c2aefd71713be7439b85d05acafa35da1cf35c612fb962a0581fd24a42ccf044f7d45e25f8f88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
Filesize180B
MD597db24c836677c4f694a73e8dd03c0f8
SHA1187d4a4c7d27a96144f092750cc25b92aacf8e47
SHA256ee4c72773ade922363e0e138b0db1cd1a3d009a617ac980a765f38fc19681f91
SHA5126263fa53951c8893c99a40567a467673df722dee3f12ed23e6a38412b06e1a9e5ec3679faacdd04e958c9fa66b151823b2f4aa51c36573dda84e6c5a11bde9de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b660d19fd0938edc6411a0043ce0021
SHA1240028e41ed107bebaa1e52a801234d9b5709ded
SHA2567f5fe596cc653f6bf16eeda546c8524913f96bc76143cdea9cb0ae358d8e3f18
SHA5122915a03bb4428f03460f8b1b8edf22146d5670670654529bfd88ad43ca68f3b331c02e0c86e12ac52586c91a5aa2052bbeb8b9fa47220761bd13e64fccf039a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Filesize398B
MD5aa9d17635e8f9c79751ee9dfd4b711d7
SHA1a6cbf81ef66d425e5be18e1209f0510ee25cc1dc
SHA2565a1a8bc70cef81bdf048847889013f5267ce564e2244af15af32aca023b21960
SHA512ad1b71f8910371a71919350c799231e3653a08c28a6ee73704b2fe4e30b63cc3e239e6efcd647ae279a10adf7fdcc170284da04e1ee4e920da2da992e5b34988
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_1958C8FC5F0E0F8549703D0A9B9309B5
Filesize402B
MD5e5bb9aecf981231cee0e2331f4705174
SHA196d61ef664df98d80746a99b7f18cc8c40bdad0c
SHA2566e13232ad19c891cc817fd9dbe0436e8afb14de1bbeb60fa56c048925357afd8
SHA5120cb068af1b5d35357d302e714b0e8b66a8ee33d218e64b1a801c279b21ae1dfae0a131cfb329ad2de24112c82d27412ce9b802e8a380f26cb0ae1d713883ea97
-
Filesize
948KB
MD584f5b7ada4e0c06a2aae07a8419c9f64
SHA1ed8e9b61e4967b0608406f1255e3e2dbfee3cf0b
SHA256530f769f400f371383aa1ffaab30b46791a3bb5ea8e9304e3efe9ef419a7faa0
SHA51284a341cd6ad2e6b560f40792042e60d4d68cdc5cfefee7a85f28a55077aa872dcaa16e27b4a95bb7fe2516a4fe3b0e714c746b69cb826b5bddef8a659fcde38c
-
Filesize
18.8MB
MD513b35ab0d36be2f7c0f82de8beda0478
SHA104768f9d3affc6150bae2f6020072439cff65fe6
SHA2566ddf1feb791d0bcdedd835713f96e0f40bf69c49e2632c40a56696ee0618b2d9
SHA51254cf32cd5bf049cc24996b2f99dd27f0a349327f82ea669c673911d1697ca49a99bf099e9d7eb1089921a13ecc17dd8b6f8f136c452d0515d15a510815bfd6a0
-
Filesize
1KB
MD56ddd9f7229af91f72510332059768b7f
SHA12ca8b4863afc1d44352b35601dbfa652838baed2
SHA2563a8f0955ee74c76f0879bcc3eb2c56c573c59a37be1e725846858ecf6ae455ac
SHA5124351a88404f80cbb197dda565a27ea8e8e1d9a206207ff6469f1768080c5f8a00067488733f6470c028e6f15b9158ec47bc3052e1cab77ae7a8dc5358acaccd9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
188KB
MD5517d0f050ebbf8a7d2c6a4def78218dd
SHA1dbce970a2d4cf6485519ef1b730bd3246fa390d9
SHA256a81e22e91c831bf3d60569b6a1d9b0e9bab283e20be819da8117dcbb731e07a2
SHA512fc0bcb4cad490cf16239aaa381ba65817682bef36418347630df4d2df39c95b0280ecc2346baa561c5c4dcf6a952b315767276efc9c2969b6ea4e47ed0be945f
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
7.7MB
MD5d16c74868f44ed001fc408f96bd973d0
SHA1908dca097abb0ae8bc5557eca78f34dab8f25d35
SHA2566b8974f050ce043f81671728916999abe7c2b724616bb925069ba60c9d8fa646
SHA512a8d5e892d8ef51f7571d44596175ed99184487dda6e27cc4318e854c954c1c84ee5bec1c191cf9d6efa573e5fbc12ea28e834f9f1bc0bc30ae3e3befa2ab8182
-
Filesize
89KB
MD52bdf444ec496c783d7996c4ff76b52d5
SHA182ea8368efbbd49d097285a5bb07e04fd1ad9ae9
SHA2560ec8e67837faaf62653b1a28cea98008a27fa29a70c28a58fd123c3bce4c3238
SHA512e5cf8b6706e787c2092d0e5b60dbe53c173b5d80ea28786be444f14f3fbb0fddf7da0f1237b0f3e59d358f7e7fad3ed71a019e78e3ab00b1950d71b91cb4f334
-
Filesize
1KB
MD5162ea96ffa6786387e191907171698a6
SHA14b6d9d774e23f77488b660eb356755699ebac7a1
SHA256e1dea36493f9e4d43a78ed09ddef3debd649ae81c6614c7533052b8e484b3c8b
SHA51211a2f715b25d9a271f2e2d6abb63a5f1f7c8824fe233608ba8f3eb373522b4cb243bb246df888deb9394d4daaad26e2286253051cc1b332bab58e6ed7bee1d0d
-
Filesize
9KB
MD56721341c980baf3a44d5606686df6053
SHA1ae50b28d2e6d4c940359ee4c087b83044d72749f
SHA25603f0d5d10827e32cbd95bede7e3951fd08b8e2e9e9c1e06fa0b803d13f05b9e7
SHA512530f6e4c56eedb71d8de45b2df49287d48f62c32088299e7577b03d26948ee9109fa34b504b210d12b3c014a6902006a4b65bc94871a7d7c25ad634935e3ab9e
-
Filesize
7KB
MD529c56c93617bf04d2789f7c1b9767e74
SHA11a3c9810594f170ce5438b7702bd6dd0d6dc1abf
SHA25647a6818ffe2052cc9d7e97995682ac7001048a76841f739e31cfc2a5cbb590c8
SHA512cb6ba9bef1375dd2ee6fd396e334c0d046879df7dee0f23aa3b923a8536d8d6aa8db728a3df1c6c11038ec75bdfa8ea1287df4c94430ac339fedff9d092810ec
-
Filesize
9KB
MD53a520c92eea7dc19425c29d34cd4fd91
SHA13919360a0fb7a9c3899036462380a3d93e76da6e
SHA25603b7347f1ad190fc74d69c7c725264e92e6e920dc2b802d41b74b37528df2aa3
SHA512397c27e229231d02f3db0579bc1840888ffb1595c20e3276dcf28e5870e8bdb0ca8d2904094730ac2746fae0db11035ce08260278c5e2b4d84972b8c7c06f62a
-
Filesize
391KB
MD529740bb8a2ea3a2c72bd2b55a4db93e3
SHA1f78f0e16a676e4eb1a7f894c0add2b7ba6c03d32
SHA25612db59a9d2335c7781e717941822981bd0ebbd34ea7f274740f88fe11e0e9b82
SHA5120a43ecc7f5b59c6e83e490800c91a61931ab9ab048e05ce1db356ae5688fb89f2d9059698db28f5d47f887b47c050aeed016882619fad97f02022711263b60f0
-
Filesize
748KB
MD5f6f106f330c8734bb2618ee7e9b20db1
SHA1046283f19963dc94e7f9af7345c015cd959e20cd
SHA256cfcf43adbdb4d463fa9a50a4cbf32d997ea84162cab4c3832da5cff4a1d3df41
SHA5129be8f0e48ec80d85556b25eb80d0cdbcac17b866ce267bf1bd5dc2dd32309a5e23980c9025e20ad2b45ced5a24a48c1767c1313aea2c25a7be41e588b637562e
-
Filesize
565KB
MD54ca39f5a1af6d35e41170e8c30a8391e
SHA10ba37cf6d207c5401fc24687ae35fd6c93f10b79
SHA25632b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457
SHA512a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a
