Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 03:34

General

  • Target

    4e4100e7d15a2184509293fe98c45534_JaffaCakes118.exe

  • Size

    212KB

  • MD5

    4e4100e7d15a2184509293fe98c45534

  • SHA1

    9bf6c80f48fc32abbb0d009d9822ef3e5f5d9ade

  • SHA256

    88e71ed1f6dc946566fe18d5b8575a57c005c98c8920d3cea982de8e5f907cb3

  • SHA512

    f9f19eb9631888b9e8e661bed9691f2bae6662f18f4c42677f932f779e28124c7996d87875176df3af4ac165d843a689ecdf792a05483f4a32dcaef26506049b

  • SSDEEP

    3072:mmDvSy93/kZq3eGNEL3nC1sRj79n7maxwRm44SX4g3:mmDvh9vkZbGNEHDn7bagSIg3

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e4100e7d15a2184509293fe98c45534_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4e4100e7d15a2184509293fe98c45534_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\4e4100e7d15a2184509293fe98c45534_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\4e4100e7d15a2184509293fe98c45534_JaffaCakes118.exe" /asService
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\javaSetup.exe" /s REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3964
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi" REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0 /qn METHOD=joff
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3176
      • C:\Program Files (x86)\Java\jre7\bin\javaw.exe
        "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Local\Temp\Zona.7z" "C:\Program Files (x86)\Zona"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        PID:2960
      • C:\Program Files (x86)\Java\jre7\bin\javaw.exe
        "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Local\Temp\appdata.7z" "C:\Users\Admin\AppData\Roaming\Zona"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4808
      • C:\Program Files (x86)\Java\jre7\bin\javaw.exe
        "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Local\Temp\rambler_r33.7z" "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • Executes dropped EXE
        PID:1056
    • C:\Program Files (x86)\Java\jre7\bin\javaw.exe
      "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" ru.megamakc.core.JavaVer
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5100
    • C:\Program Files (x86)\Java\jre7\bin\javaw.exe
      "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" ru.megamakc.core.JavaVer
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:664
    • C:\Program Files (x86)\Zona\Zona.exe
      "C:\Program Files (x86)\Zona\Zona.exe" /copydll
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Program Files (x86)\Java\jre7\bin\javaw.exe
        "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1968
    • C:\Program Files (x86)\Zona\Zona.exe
      "C:\Program Files (x86)\Zona\Zona.exe" --readInitFile
      2⤵
      • Executes dropped EXE
      PID:3480
      • C:\Program Files (x86)\Java\jre7\bin\javaw.exe
        "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5044
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 521B1FA781FA78025BAC35A9A5ED6272
      2⤵
      • Loads dropped DLL
      PID:4752
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1ED2053FAD83CC45881584B0C5B058B8 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
        "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\rt.pack" "C:\Program Files (x86)\Java\jre7\lib\rt.jar"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3528
      • C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
        "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\charsets.pack" "C:\Program Files (x86)\Java\jre7\lib\charsets.jar"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3036
      • C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
        "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\deploy.pack" "C:\Program Files (x86)\Java\jre7\lib\deploy.jar"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2860
      • C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
        "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\javaws.pack" "C:\Program Files (x86)\Java\jre7\lib\javaws.jar"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3204
      • C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
        "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\plugin.pack" "C:\Program Files (x86)\Java\jre7\lib\plugin.jar"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2036
      • C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
        "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jsse.pack" "C:\Program Files (x86)\Java\jre7\lib\jsse.jar"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2740
      • C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
        "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1056
      • C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
        "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.jar"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2960
      • C:\Program Files (x86)\Java\jre7\bin\javaw.exe
        "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3416
      • C:\Program Files (x86)\Java\jre7\bin\javaws.exe
        "C:\Program Files (x86)\Java\jre7\bin\javaws.exe" -fix -permissions -silent
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:5436
        • C:\Program Files (x86)\Java\jre7\bin\javaw.exe
          "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.JreLocator
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5452
        • C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe
          "C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW5camF2YXcuZXhl -ma LWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:5608

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e57e235.rbs

          Filesize

          10KB

          MD5

          17b07e8a4e5b11ae9e4a0dc6e162aa4d

          SHA1

          13a75fe92e2c9b53188102d4a1e8882c909c9c91

          SHA256

          accfd59c62ec43a9f8c3a5aeabb4441541c76c727d87b7b986a57839f42d2803

          SHA512

          af71e67b45b5a048105bfaff780cdf9c44e83c8b93b1882a3999f51b5599db35a90e97d1be21d8b30fb5ad0734a0b11a5197f696f96d6144a40d01e799910370

        • C:\Program Files (x86)\Java\jre7\bin\MSVCR100.dll

          Filesize

          755KB

          MD5

          bf38660a9125935658cfa3e53fdc7d65

          SHA1

          0b51fb415ec89848f339f8989d323bea722bfd70

          SHA256

          60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

          SHA512

          25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

        • C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge-32.dll

          Filesize

          95KB

          MD5

          1722510af00ea3c7406681b47bf442f7

          SHA1

          cafac266d52d78d3743c31ebef22a894781e0de5

          SHA256

          4010a3ec604a327861bedf01626c12eaded9d381b6e4f0e6f760895838834a21

          SHA512

          31a2ce3d5eb9828cbb82d2a7e29f2c5bf46528d38f25827329512cedde37bd03b3cfdba0aba3320b6c0e7779588958e83bff735f6059aad37172598e70e863eb

        • C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll

          Filesize

          3.4MB

          MD5

          27147e1e3faf9b5ccda882cd96f2a85c

          SHA1

          7103f60121727917f812bfc7cdff5347fc17cc8e

          SHA256

          500d359211ece211cf672de328345876f016fb4a476b2a03cbc3b8b89023ae1f

          SHA512

          0866c604911e243687e7fe721142eb882b19691c902736b59ba304933463d8c9154ecc319b91c9771cee8139e151cc2a2e960bc7a93ed97352cf5232a0964194

        • C:\Program Files (x86)\Java\jre7\bin\deploy.dll

          Filesize

          371KB

          MD5

          87ec9d4a00d34eb6a0f8f92e1d1cc08e

          SHA1

          bee4ecae201905096dd44d1d348ecb3556d90832

          SHA256

          352707a271a9ab5d0e190a539b6468d6c6c5ce9675b300acf2305aa1f30625d8

          SHA512

          5b7f9866168ad7948a5a80078b14ff747201d17922ca907072a081e0078f6ac68446ddd36b027b4a17f5afa7d1bb4962642cff28cf66867171ebb78735f242d2

        • C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll

          Filesize

          864KB

          MD5

          bc3a575dfb1a58d35e8617f2966bf1ea

          SHA1

          6353630f62e246d7f462134e8d10a7a42935e20f

          SHA256

          c029fd3c6ffd2158d0633fc122786838a6f5d3cc7ef78bbe934697015c8c63dd

          SHA512

          c976da30d343f8e104bec72300dc0c17e582e380f0a3ae85b242dbf2d5b40459feb4a3b7789fb8d755b21cbaa0940038d20dbbf1296a48e77b461092abbbe514

        • C:\Program Files (x86)\Java\jre7\bin\java.dll

          Filesize

          117KB

          MD5

          a258a133f7d565600647a248ab95792c

          SHA1

          1c6a855ca1fc04413b906b0b17609eff38317161

          SHA256

          81ad5696a6fcad89127fc7a428636d431b446ff1ee0c37bf87e8d513a8bae7af

          SHA512

          bf9dd97947eb0c71243ae28255af54b06d9e17af7ade666538dd93f9fdf6d8fbc3855f48bfaf6522dbd9ce3c6cff655581f092709670606d033f2321b1f4a5e7

        • C:\Program Files (x86)\Java\jre7\bin\java.exe

          Filesize

          171KB

          MD5

          88651044108e995f9801e35d2582491c

          SHA1

          abbf404c0253d085223a64ab947e1057c4211c9c

          SHA256

          c7fd72a0730b377c6da5ac80cdaf5f4cca84cc999a563a4c420fe5a8576810f8

          SHA512

          486b1d7ad7c3debcb8d70f9351adb08c8321c4cfb409a00ff818be1dacdc376a0eded630ccdc74aa99cc472589b88c9681989076fd78eb109759d33e7bf70543

        • C:\Program Files (x86)\Java\jre7\bin\javaw.exe

          Filesize

          171KB

          MD5

          64e2bb67ea740860510dcc5c2b6ffa2d

          SHA1

          6c5996358264624cdb4a075acc4f0b46177cd259

          SHA256

          844ab2231f45fad60d81770ea36d9937da9aa72cd905ce06e7471ddf9d69263b

          SHA512

          ed24331883ada44d8b034f5c8bc458e53234109d5cd02a27989972033f5b3305d23365106ce80be81caa16e472c14c103e457a1e0d138eb0d95036e58d877462

        • C:\Program Files (x86)\Java\jre7\bin\javaws.exe

          Filesize

          266KB

          MD5

          2b4493bb1f94580c41def972ea9a887e

          SHA1

          880ca8b20c6df9a6a176b91cc50304cb0fe66d06

          SHA256

          841339373958786d9c93a7dad5de8fd213ed6b5ad69623f5a5762a453c48e0a5

          SHA512

          b43e54f2c1f3e0a3c3d2fcee518e47d17476bb735606351e41b49e97e10af758ea9a539ac370a2d12cffa93e3e752e829db969968664c59386f65b732c29e40e

        • C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

          Filesize

          145KB

          MD5

          0d46182b6134aa9c7acd16133d67e4c3

          SHA1

          7b5be3d65e5e744723bf55a08f9dc1042585d5eb

          SHA256

          c89091f2a4de2fcf10b30e54a74ec5764e2dfc0577f4f1d879ac8816e3b08bcc

          SHA512

          735b6c6bd69b22a71c15ae44c6fa1693700321dc3b4b2367ce05d5c37df62e45d1d3836c2c0f5e44be1036aeb11a533c2a4dbec55163b4a15adfa1c8ef75673b

        • C:\Program Files (x86)\Java\jre7\bin\verify.dll

          Filesize

          38KB

          MD5

          cb89b1d71061f5ec52468528ecc0b1fc

          SHA1

          6feb23a8b5719c8997de92c7da644807fcba8819

          SHA256

          87d8d59972e73700507c07cee8750b0053c6a0899410338722a00c2803d39ee6

          SHA512

          2ff0ed38c7f28eb7ea16f24a0841dfb3306c4fec48ded5fddec8c3140f1a425433a444fe6b6cc4c17b3a39841c8ab0c23d7c9525c119c1b9d6daac2c17a4e4b0

        • C:\Program Files (x86)\Java\jre7\bin\wsdetect.dll

          Filesize

          159KB

          MD5

          958bc8d82e4d0a5b51536bb4fc4fb6d6

          SHA1

          626312fa01c72ec5c85c9262ba0ae97a8b1f5b25

          SHA256

          2ef891881d506084ed182a0ac58b10dbe8c45877ef889ac9105f19431beee4ca

          SHA512

          fe17b58e3eed817619bebf6d091aee99fdc331c9c5a4163e9f5993b41b2e7362365da210e0636755ada6b8838012de1bc5435b8670aa12f378a3c9e3a9f5af04

        • C:\Program Files (x86)\Java\jre7\bin\zip.dll

          Filesize

          66KB

          MD5

          1ecf056944068b933ba71cda3edc4a68

          SHA1

          2052b2138db0d9a368942470b41bb6fc5b1d4007

          SHA256

          35ce7ab154a38e97951714e17f7689873d89e8c01188de6e5cd741bc0ca3e384

          SHA512

          cadf312841d392a9970cc068b72063e17454d5e6738b46ec9622257d9dfc0bcad0d9420352752bf7d8f8e8ceaf6aca97d83896f753dc12cfeac3e5efb5e1ab05

        • C:\Program Files (x86)\Java\jre7\lib\charsets.jar

          Filesize

          3.4MB

          MD5

          3f080df73b2d7cad61bddcf709aadc72

          SHA1

          616e9ec760722737f38213f43755131f836dd627

          SHA256

          dd213d0867714191e351f589dc709d6f3cafee819aafda8f8fe022d367ea189b

          SHA512

          733b65d3662f2eb9a8f64212e306d934929a05fd753040073f7e2769df77791c29aef9e35610b7b22597bbea6d805a8e04f93235fe761bf6bd5c5733c867025b

        • C:\Program Files (x86)\Java\jre7\lib\charsets.pack

          Filesize

          1.3MB

          MD5

          549bbcd204914b543dafee670f110834

          SHA1

          012461935191a55482e8c3d453d245e965a10a2a

          SHA256

          8ea5af036ec067a0abcf87b8f5921e2281ff9d259e1d4c3bbe7fa9037cd87d02

          SHA512

          b0346a2ec52ce47351286f27f347f5fea99e160aedde52bcf74e1629739704bd975c9c99d8db6be3b6bd45e7fa933616fa081eda49e9b911efcc031c7241400e

        • C:\Program Files (x86)\Java\jre7\lib\classlist

          Filesize

          73KB

          MD5

          1a0b7592ab9c12aff1191dfd225154ca

          SHA1

          3d3fb5f326f2caea866028558834ae684a2fe09f

          SHA256

          3837e95826d2273a54e3869efcad1521e000215428a2c7ee9397b650834ebaf1

          SHA512

          b2932400b6d8c72d344cb0592f121623dd848dcdd341248cf18cd55cd0c4fbd7f923057d022f89586ec6062299d756a37b3ff4308f10865de6ba68b2ee530fe9

        • C:\Program Files (x86)\Java\jre7\lib\deploy.pack

          Filesize

          1.7MB

          MD5

          b2a448112b7c886ccce9b6a3d5efd8a0

          SHA1

          660bc9efe960015b208a421b1a63443e7151024f

          SHA256

          928f6b847f94b920c462a08c43f0dfd3f7c40076b1cd60545523a5c27a4870ca

          SHA512

          871da63f4eaf16d77ba6c19c10d8ddd8e94f744c20a70e24793f837023d20e56698d85f67498bc06ec37b73a8f376c220afbe7f3884b00536b710ff49c339b3f

        • C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack

          Filesize

          736KB

          MD5

          c8dc1cfeaf0fefc39ed0f1de4eaa175c

          SHA1

          11cacbb9e5724d37789455de37a225d8e0c648a1

          SHA256

          da2803a283d28882182e1e280b4f25ee1579a5805e73fcc9882e63968f102a8f

          SHA512

          6b419ba94ae90f8caa3a57690f2ec7e249c9fb8ab86819439621cde1243c7636ee76820622ce32ed483ce76976f7ced74778898fc2725b1a2407b039fb53508c

        • C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg

          Filesize

          686B

          MD5

          5147cce789cd18ad6b2996eb89e5d866

          SHA1

          756f1fffe96ef581f0d4d47253523544c89a2622

          SHA256

          c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88

          SHA512

          55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6

        • C:\Program Files (x86)\Java\jre7\lib\images\cursors\invalid32x32.gif

          Filesize

          153B

          MD5

          1e9d8f133a442da6b0c74d49bc84a341

          SHA1

          259edc45b4569427e8319895a444f4295d54348f

          SHA256

          1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

          SHA512

          63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

        • C:\Program Files (x86)\Java\jre7\lib\javaws.pack

          Filesize

          205KB

          MD5

          491bce42c6cd8af88a2e11f37711ed4f

          SHA1

          3de7c18fee44465a6afe34e068f2a64dea9fa324

          SHA256

          ee43869ee94eefe241d661101ff6a03cc276f8e558967b1b350ea088f1dad2e2

          SHA512

          1e5f99466b77b5a82c23449434272acf5746811ef96b98105f89b3339ccd86734d7713c94b773755219345d673a761a356fbe846a38e7893bd8894e43cf102e4

        • C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack

          Filesize

          3.2MB

          MD5

          dfaa6429468d56ef77932cf26a495f75

          SHA1

          8a21a29225640f1829ae328a24ef9cb5e215a4e0

          SHA256

          8c481a549acfa58b1bac0385906febe33a928d004a529fec505b6a9228678fed

          SHA512

          6c19ed573b111315648de0646441486729b304452c15b2282938460a2339db0be4e1eb19cf6f2bf17f73037811ca2553a15957ea96b9d9af64a93045407c1148

        • C:\Program Files (x86)\Java\jre7\lib\jsse.pack

          Filesize

          141KB

          MD5

          31b4d9c29d29567b0ae3037fac9fbdc6

          SHA1

          8b5d1b1a309177466d71a742414d441f600ea38e

          SHA256

          9f031f2f1292bb311c400b0a93a11b78a08f013332b1263ea58617b6548862eb

          SHA512

          b4a8a3a1e837f98a3164e19a6fe939819eb336892335de975822890b52b5923d85fee4c4e5464ccb0d46c847f37f7da98a839aadbf4d20fca355f396a53836c0

        • C:\Program Files (x86)\Java\jre7\lib\meta-index

          Filesize

          2KB

          MD5

          8bff510abed2b6fcc5a83eedb65b1766

          SHA1

          ba6d0cd7504a5baeb963501b8bdf315ec6cb355c

          SHA256

          afb4850419612e0daf1876a5d61120ed0ccae241f188c25c014602007b3a765b

          SHA512

          8786bd672ce9c53f4c31f8206d621eb06ae7527f9adf3700955cc1cb928dde145b684666a5eb4ac11301541f585970ccd377ba144da351741e3cb5769b6ff522

        • C:\Program Files (x86)\Java\jre7\lib\plugin.pack

          Filesize

          489KB

          MD5

          47d6cfa1b01a6d41885504bbc3b1919a

          SHA1

          3838060f9d530c972d65f36fa38b265120a218aa

          SHA256

          93defaaf7f82e2e9565b27dd31a41c89e02d1b7719d0da0b940a55dcc75b91e5

          SHA512

          b0df9b174624234aaeb2b50cf611f698377925a0ae5c5ee9da46c65fcecf4d28941d1bf2332316d9327981c1f8c6c4fecf750e013f04eef63f5df52d27593135

        • C:\Program Files (x86)\Java\jre7\lib\rt.jar

          Filesize

          49.4MB

          MD5

          bac77d8d145bd553c7efdf7978d9dff0

          SHA1

          31da52beb0237a6ffd6ebc4a766d92f12a226fb6

          SHA256

          a85b24d93ceb6095691838dda51d31bc5e8dc94663514b46c48d7c41d351aad2

          SHA512

          2aabc1986338a68cdecf6d46afd6492a90940d9412bf8f7ad7c6183091403a784244ecf1007dc3875a892c0b1c2557f5de31f387011ca8db657f4367f5fc86ba

        • C:\Program Files (x86)\Java\jre7\lib\rt.pack

          Filesize

          13.1MB

          MD5

          b6d75e8c90c79af1579769f10b1e5c88

          SHA1

          146cb3f05fa161885e8faf079fa2bbd89b5c5b18

          SHA256

          82dc6806d9ec9eb16604f90a5c78d0d882b69a0e718d8f6c3c6b7c9719887b7e

          SHA512

          02cdd0c0d6e71bc09120db2cd3b9471c0176567d92bb74a08c13e82c1d23722eb4afac41583a11dee3fc531fd442754ee0f5cb964898ec036ddd432947996037

        • C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT

          Filesize

          27B

          MD5

          7da9aa0de33b521b3399a4ffd4078bdb

          SHA1

          f188a712f77103d544d4acf91d13dbc664c67034

          SHA256

          0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d

          SHA512

          9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6

        • C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+5

          Filesize

          27B

          MD5

          a2abe32f03e019dbd5c21e71cc0f0db9

          SHA1

          25b042eb931fff4e815adcc2ddce3636debf0ae1

          SHA256

          27ba8b5814833b1e8e8b5d08246b383cb8a5fb7e74e237cdbcadf320e882ab78

          SHA512

          197c065b9c17c6849a15f45ac69dafa68aaa0b792219fedb153d146f23997bfa4fbc4127b1d030a92a4d7103bded76a1389df715b9539ea23ea21e6a4bb65fb2

        • C:\Program Files (x86)\Java\jre7\lib\zi\HST

          Filesize

          27B

          MD5

          715dc3fcec7a4b845347b628caf46c84

          SHA1

          1b194cdd0a0dc5560680c33f19fc2e7c09523cd1

          SHA256

          3144bc5353ebbd941cdccbbd9f5fb5a06f38abf5cc7b672111705c9778412d08

          SHA512

          72ab4b4ad0990cce0723a882652bf4f37aac09b32a8dd33b56b1fbf25ac56ae054328909efd68c8243e54e449d845fb9d53dd95f47eaaf5873762fcd55a39662

        • C:\Program Files (x86)\Java\jre7\lib\zi\MST

          Filesize

          27B

          MD5

          11f8e73ad57571383afa5eaf6bc0456a

          SHA1

          65a736dddd8e9a3f1dd6fbe999b188910b5f7931

          SHA256

          0e6a7f1ab731ae6840eacc36b37cbe3277a991720a7c779e116ab488e0eeed4e

          SHA512

          578665a0897a2c05eda59fb6828f4a9f440fc784059a5f97c8484f164a5fcec95274159c6ff6336f4863b942129cb884110d14c9bd507a2d12d83a4e17f596d2

        • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

          Filesize

          1KB

          MD5

          0d14e9b93067064f9bcf04d53b02320d

          SHA1

          e8feea8662552ce33bfe76ca50ee038a441e4bf2

          SHA256

          fca5a09aeba94f0e004b65e347cd24ab4aaf3320a6e38c253b48668620c98498

          SHA512

          56162843643cbdef02da31cd7c1e69da644208ed8393a575ab70521a2a6b4ca143827b97f82b4748c9acdd6a9d85a249aa581681b1a0457dd4f9caf2c1709ea4

        • C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\Data1.cab

          Filesize

          24.6MB

          MD5

          003a488a2139105704566b47eb29520d

          SHA1

          52d672a592cd52ad5e2e7239421f2659e0d17afa

          SHA256

          a84262dd486cf59049d0d2d9a1b00dfb5aa5271592edd8de0e052f12496dec67

          SHA512

          ab34061f8e04bb1d59f1b35e0e1848a176f2b119095e79015130da3a4384c70fa35ecbe1625e07c0eb0de49c67bcdbba59f10fa1dfbbb2066dcb6ee6825215de

        • C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi

          Filesize

          898KB

          MD5

          e24d9b483ce7a3a6a4406111883457f7

          SHA1

          0d5efff0d110c48f5e6f5d438967427f1e2dbf84

          SHA256

          dbf28e21d55dd662cccf4d422a1a645a6a3dbfd6914942dde417d20c4d2fe01c

          SHA512

          b614b023ce683e78ee685be028fa06d7df90f10360d55de2a8c1214200b0b85998683502f377b01584bf23b72b168c33ef560a78d7abdf68aa3af87beca59398

        • C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

          Filesize

          1KB

          MD5

          c91c406a763fca34242a674163fe393d

          SHA1

          b69ffd76a72329c8905b426583d5a0280212f4c0

          SHA256

          86a252c5a1aa3e1d69187d06ec490db1d4dc0b5321ff83b8c6a9c991616d458f

          SHA512

          408157d17c66d458c55aae925d1fc258a8acce10e8994c000f76b034d1d446ea5792cb003ace9d0bc2a144344bbce6d492463f116063e4bbe618db1f9311e039

        • C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

          Filesize

          4KB

          MD5

          88917a017db57c61228c229b18bcc887

          SHA1

          0c6ee4b70113b79c20522399a142991eedb60e67

          SHA256

          a1ff53409125a247bf2f99b6f5b282011c898446f0a593fcbbf99ace63e27a95

          SHA512

          a3ddd067014468c9ba706fa830cc6cf86fcdff50e0e96db0ab9f0713205fa642047605c5df4dd4d7fc81632dc75a4c40d2d298433f5e5b66bdcfdb7f0859ff86

        • C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

          Filesize

          1KB

          MD5

          9365ba3425644a8f5dbe310ab831abe1

          SHA1

          e40884e48759f8f9b127f74ce5450cb22b4caee6

          SHA256

          dd40bf536beb40fc13d0830e5e964698b8cbff80574515f3eee938daa54a86fe

          SHA512

          7aec991ebbefb8ee27005fda1f3cfb53975658ece7256751948672cc4c4c6efc69663d37af31b209f6cb3ca13661fd72788ad971939a025c6a7a107f5b2e4aba

        • C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

          Filesize

          2KB

          MD5

          5df2c5d7a3af3984351bdaf5d3618b82

          SHA1

          5747790bb17c3a829076d1da3df336a1c5c69195

          SHA256

          8fece48542eaf4b7c915cae830daef4ff05636db862fe45f860b498922edb9b4

          SHA512

          1595a0c0171067a301df6436239149360cbeb7237de1b619591f9cd068531b1819bfcd7134cc40b27092994bb7a248ca33c9063ddc06a11d35c514af41a9be1c

        • C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

          Filesize

          964B

          MD5

          3578c328b10f0c8407e3a564f1ca52d3

          SHA1

          a78daa3f2450d702d686c83f8aa703d9596a8fc1

          SHA256

          c678e306bd9090012929ca4cfedd134b1c99e9f765adb1f35f307795758746a6

          SHA512

          ba884df334864eb2082b5d6b8a070075bb5d9afc2482ac2483b109872aefb9cd289fb151b3970211bb07c966fe45000f806a8a247a3a4d65fa855f246b4bdcaf

        • C:\Users\Admin\AppData\Local\Temp\javaSetup.exe

          Filesize

          28.1MB

          MD5

          f2fd417b6d5c7ffc501c7632cc811c3e

          SHA1

          305c1493fca53ab63ba1686c9afdfb65142e59d3

          SHA256

          a87adf22064e2f7fa6ef64b2513533bf02aa0bf5265670e95b301a79d7ca89d9

          SHA512

          289ee902156537e039636722ad5ac8b0592cf5cffda3d03cf22240003627b049382b95db1b24cf6a2f7134b0df93ede65a80a86381fc161b54c84a76ed04458b

        • C:\Users\Admin\AppData\Local\Temp\java_install.log

          Filesize

          22KB

          MD5

          525bf7f5b63ffd5e86fa3aee92551c21

          SHA1

          bf3cd939fe57f5076afbd231cb5b1b0ea03ba5d0

          SHA256

          e0e88bda4bcbbcfadb1009060372744f8b3f3628ae29b1d310a99255ec76aa7a

          SHA512

          825d048f8a3eb7ec88bda27eaf34b5c05a9545a12d48d29fc264aeae571fb2b4aa2957cd1b5459d53dc5d18b7968760d47136a6ec099c5612c3a7ab677b24d73

        • C:\Users\Admin\AppData\Local\Temp\java_install.log

          Filesize

          23KB

          MD5

          18f48d6714640435ab93cad409e10070

          SHA1

          fd33c178274fb08adb77cf5c695ce29ba32417bd

          SHA256

          f7468e1cf9cb05006bb7eebf4ce106f98828351ac7d8637486794ba90e5f5bc2

          SHA512

          632e4957e610ab787ed9a2cf3e8d988acb16e4cfc4d4df9b52682ca54fa4f7fed980b7b5dd69b1c4dd71554894ee5e5199da630b721f3c7403652f923a16dcc1

        • C:\Users\Admin\AppData\Local\Temp\java_install.log

          Filesize

          23KB

          MD5

          a2623660c345873243bb8f88145663b5

          SHA1

          d8cabac7b4057649bb6ca31504719fb0881c7190

          SHA256

          3532daff57c2b70280ef79edf17af55d108b2d46b88bdbf248fab74db2a43d14

          SHA512

          60dc96479ae28a9011dee7a2e8ff2cb60ab548a6164ba8f5562fcd1cb154362677a68c98c62aa62333ac9812d4ddb3e332957efdbc5acfb5eade18f111c21f6e

        • C:\Users\Admin\AppData\Local\Temp\java_install.log

          Filesize

          24KB

          MD5

          e2aaff5f40ba3fbc2df129ed2157dd19

          SHA1

          8d6b9aeeae45922687e24365cecffdc0e4997f08

          SHA256

          1e1a1fcf7c15b8f6019b1696765c696e69a510bb25fd29daa4f8286b206e738a

          SHA512

          e1e5a42c4b5bac65b4747b149a694d738fe7e4e7c5398ef564885796e4d9d3cf5ae4ef1cd2066dd6ba24463654c090d79ac84e0f1ad76575155deab8088e6843

        • C:\Users\Admin\AppData\Local\Temp\java_install.log

          Filesize

          25KB

          MD5

          d2c611a13ec2cd37d228aad0305dc734

          SHA1

          b7d5dd93fb333c96f9d0c516fc862a1f6dc31ae8

          SHA256

          648dac2d3607a22d24056d6d29f1e43343c0e812faffa92a381f627cc42789d4

          SHA512

          5e73bcfaf14e4a45068a74623e9ed39276844efc6269604ea231f1457c5837605e34ebc7fbf106156b0d653c3a0ce90bf0817d09a44a7b268718747506da70d3

        • C:\Users\Admin\AppData\Local\Temp\java_install.log

          Filesize

          25KB

          MD5

          250dd63c170bf6cc59e2a7a34edb348b

          SHA1

          da811a6038e340332de88fe1c2a574ee1bb8a8a8

          SHA256

          f46f4d796f236751d277dc24184765679d409c0e454ae07587ca09e0710a0f1f

          SHA512

          ffc14529043f3231ace3beda1cb14de9ef37d24221d462138eb8fe9cb255eacba42bb864e41a575b7c14773ae577f6e44afcd408f2415678f1019895e3c376c4

        • C:\Users\Admin\AppData\Local\Temp\java_install.log

          Filesize

          26KB

          MD5

          6395ef19c45e81bddd74837a1394acb5

          SHA1

          92a97d8fa5c76891d0df4b4d9812370ee85859b9

          SHA256

          a0da062ab80c0dc8d84f51bd76faf53001cd4b48bcbc0ddae6d75e210ea92ccb

          SHA512

          5bb7439566d386aa46774e71378284fff75855f2b5971345d54e5142a23a9488a49b1de2a9533d37cb3f33c8d50cc64727daac7c96ca6dd3779144379a068fdb

        • C:\Users\Admin\AppData\Local\Temp\java_install.log

          Filesize

          26KB

          MD5

          cc147c8509b89de26462cd73e51d3df4

          SHA1

          b37e85f40a18c1832530a760b309799378f7f6a9

          SHA256

          2f0f162f348b4020566418fd30c090fac83883284dde7c163b923f68d0886c69

          SHA512

          b8ef88fc7c91371605dc12a6fae41fa576836ad7eecbf728cd78ab5de9b235c221d5f43d2e9f9adc234f6ae5c3e823dd1b213aaa0340aa8d341015ad393a3e93

        • C:\Users\Admin\AppData\Local\Temp\java_install_reg.log

          Filesize

          3KB

          MD5

          a571a80e3e7f07d8d5318528ffcf057f

          SHA1

          e3ec23f4b500ff697f327a186c6b7a1d0203d242

          SHA256

          9bf99654183263090ac650e9f691e074a0de278848a0b618df2c074d9fac23e7

          SHA512

          70db57b8e9aafeaf7fb4e7c7bc4a7b91297b3e5ed7dbe683c63c8191bd98c0a92457d92ee4ee379eca4935c85362cbbfb1bc9fa4a00cc010afec40752d641be4

        • C:\Users\Admin\AppData\Local\Temp\jusched.log

          Filesize

          296KB

          MD5

          3b228a2b47a10a28ce6d191404f08185

          SHA1

          91a8c987a04095091946afa4ce81a93935a12422

          SHA256

          7ed1862ca70b8a4cbefcd672fc505af6570dcca6407b3d49adb5288708da3ec5

          SHA512

          0d8b976b8630c4097f5c4c29dcf7ed4958a1d15766362170de4980d41d3b390e0ecd65c8afab186c3e5026f76331ad621f16cc78dd8e36eb6ece8183587f7455

        • C:\Users\Admin\AppData\Local\Temp\jusched.log

          Filesize

          295KB

          MD5

          a9c898a9fe6ef9162aa22a174a33161e

          SHA1

          86c4a95ad64a53b393114c851e8594669ca6cb27

          SHA256

          54b9d4d1dbc543b68ce2d14c4b725e70f9522f26922f1df108ce33fd1d0f7806

          SHA512

          c5fcf0e070e7062e0d072b0840cdceadd9745b64382b185e68180bec7117661d9dfeeeaed6ffa4a4ac84f175f757104986df9b0017b6c29382d3321ff455047d

        • C:\Users\Admin\AppData\Local\Temp\jusched.log

          Filesize

          295KB

          MD5

          22205a2d921e63c45b16d19c3165d54f

          SHA1

          776d8551e9d926376e51dfc15a82d087f7888aea

          SHA256

          18a2ce0023a805fa274c150f01511553fe809874253a865a59015902dcc4f249

          SHA512

          51bb9efa0a473896c547e7982a0709d641d7f13667af5bf23644ee200d217c4b7bc3dfcd63c8c8d2781637a07e743c09c709956dacbb7585d0a4c0d7582614d1

        • C:\Users\Admin\AppData\Roaming\Zona\init.xml

          Filesize

          269B

          MD5

          3b8eca6f0fd80c4173a254feb6fe63b6

          SHA1

          d8a07b0b074b5d2ae8d884d5ee886333116bd052

          SHA256

          d45f2c486150b12ad13a64665bc452476feac6b30887c89fb2e21c526b3bd027

          SHA512

          527e3627be90cbc4ed218ff8d4244213b8656deb7d3539ee805d0e966dd45d2a4d5f883cbf0dd2057a58c2715f374984f27e63d3d5866f3492b8013505ed0ba4

        • C:\Users\Admin\AppData\Roaming\Zona\launch.log

          Filesize

          733B

          MD5

          90fbc76f17c40f14b31b31fe28c257fd

          SHA1

          d2756558c9b9f913094b23c159d409bbb75d3a84

          SHA256

          2ce66f07a838ca044e804caaa2597b73762f7e6533cbdbb60637d01b55d7e566

          SHA512

          27d8395be79e4bcdac2439aa7bb59aeabdcbf2b4384bbef20f2cf00ac7562f481759d14e46808a37d4fdd311a31cd3203848b4f3c4c04bf05ce38c1c3248819e

        • C:\Users\Admin\AppData\Roaming\Zona\launch.log

          Filesize

          2KB

          MD5

          2ac4f6695c40bc595d3d516c86267c2f

          SHA1

          77053d5a549373c4526e9d7f30b18a115db169bd

          SHA256

          a5a422c84e18934b909a0fc5ae46e5348c43741903fbd727098f2e1ca0ab2556

          SHA512

          52ef07418863d7c677377c193cc3964641b44b3919207348985aa0b2bd5de5931a43109dc7f05e0c1afc0109d9651daeb0414c69f69ddb9baaedf8a2bccd04b8

        • C:\Users\Admin\AppData\Roaming\Zona\launch.log

          Filesize

          3KB

          MD5

          26cd60edc48361888370f7c4acec4bfc

          SHA1

          ebf923c2f40fd6c469447d515f7a1c434e09c84b

          SHA256

          e70b0954fe3939f536002e7646535e45e9173509ab1b39ab28778318c922bde3

          SHA512

          7031c269879038a0a17b0998ad42521bc88642f25c67bb804928dae20df7c5623d52054cb1770d21885766329938e882cae7a62aa787be531f3c2f2c3157c8e6

        • C:\Users\Admin\AppData\Roaming\Zona\launch.log

          Filesize

          3KB

          MD5

          49347048d7f348da360727239166a04f

          SHA1

          6aed60afc7f892ed8ce83ccb65504dae82add664

          SHA256

          a56dbfb02350edcdacb4e28901f9de76bb05420141475859f101e17ccb26ea53

          SHA512

          da4654989867f2627792837319dcdd24888f2e77960571994de4069ddef82c9bf1259b57c77844f5ecf35e4629e94d648e1411004d1f6addcc24912b6233c932

        • C:\Users\Admin\AppData\Roaming\Zona\launch.log

          Filesize

          5KB

          MD5

          b28f338e9363ca3172a2f2aafde1c873

          SHA1

          97cbb64c2440678d9246684f526da108a2752a25

          SHA256

          a95b28ee5d801678d4a2fb84f1e05aaa535e5ecc7a55cc94677830f6ad488209

          SHA512

          a0d2da77cbc62c4fb9b24ac85d3cd7ba0fdbfb411fee2bf2f14e15f0936eb7ef7ab53ab7615bc21babcd583833fe97e3c7b0356a6c402d513c23a694008f7c6d

        • C:\Windows\Installer\MSIE493.tmp

          Filesize

          202KB

          MD5

          9f84d910602183954bed6d9660600783

          SHA1

          82e3b122dc63e0a333bca531dd16667d5fafbf23

          SHA256

          bf4e4c75d148cb412e28a0b4e665919fd5ac6b9aa6bc3fa75401394759218d5e

          SHA512

          09fb450e6c6f22a32d5e06f470070aab17d4973afe307b529093af7fa29ab96b61a89814e4964d005459f8ebb25716134a5e1c41f6ea7d260361b135306544b9

        • memory/664-1583-0x00000000023D0000-0x00000000023D1000-memory.dmp

          Filesize

          4KB

        • memory/1056-1880-0x0000000000D60000-0x0000000000D61000-memory.dmp

          Filesize

          4KB

        • memory/1056-1878-0x0000000000D60000-0x0000000000D61000-memory.dmp

          Filesize

          4KB

        • memory/1968-1774-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/2960-1634-0x0000000000E80000-0x0000000000E81000-memory.dmp

          Filesize

          4KB

        • memory/3416-817-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

          Filesize

          4KB

        • memory/4808-1663-0x0000000000A60000-0x0000000000A61000-memory.dmp

          Filesize

          4KB

        • memory/4808-1716-0x0000000000A60000-0x0000000000A61000-memory.dmp

          Filesize

          4KB

        • memory/5044-1849-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/5100-1554-0x0000000002530000-0x0000000002531000-memory.dmp

          Filesize

          4KB

        • memory/5452-1417-0x000000003A400000-0x000000003A410000-memory.dmp

          Filesize

          64KB

        • memory/5452-1439-0x0000000000690000-0x0000000000691000-memory.dmp

          Filesize

          4KB

        • memory/5608-1516-0x0000000000B40000-0x0000000000B41000-memory.dmp

          Filesize

          4KB

        • memory/5608-1525-0x0000000000B40000-0x0000000000B41000-memory.dmp

          Filesize

          4KB