478840c248eac7c2241aed3c87299ac8f7c438704125ac97834a3c98736bdbe8

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe
Size 220KB
Sample240604-d33dbabf9y
SHA256 478840c248eac7c2241aed3c87299ac8f7c438704125ac97834a3c98736bdbe8
MD5 938105f8ff32ee80432a1118a16c08e6
SHA1 859282f56373c50ba27fd5551d1b0d183775137d
SHA512 1dba665567f038061bf0d18aa7d9d518f9da30d40433c8d5827c3ebcc520d46224be8dd2ec7491c814c24e84ec0ed4fae22dedea36a2bd2c37a9fc34b4742d48
SSDEEP 3072:K28mmOh0WEE6RlUKlImnxWQYI1Rkz7Tnr+0xwRm44SX4Z:KGDh3EE6RlUKRnsocnr7agSIZ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe

Executes dropped EXE 17 IoCs

pid	Process
3224	javaSetup.exe
3608	unpack200.exe
1668	unpack200.exe
656	unpack200.exe
880	unpack200.exe
3216	unpack200.exe
940	unpack200.exe
468	unpack200.exe
1988	unpack200.exe
3644	javaw.exe
1524	javaws.exe
3464	javaw.exe
736	jp2launcher.exe
656	javaw.exe
2520	javaw.exe
2708	javaw.exe
3460	javaw.exe

Loads dropped DLL 55 IoCs

pid	Process
700	MsiExec.exe
1252	MsiExec.exe
3608	unpack200.exe
1668	unpack200.exe
656	unpack200.exe
880	unpack200.exe
3216	unpack200.exe
940	unpack200.exe
468	unpack200.exe
1988	unpack200.exe
3644	javaw.exe
3644	javaw.exe
3644	javaw.exe
3644	javaw.exe
3644	javaw.exe
1252	MsiExec.exe
1252	MsiExec.exe
1252	MsiExec.exe
1252	MsiExec.exe
1524	javaws.exe
3464	javaw.exe
3464	javaw.exe
3464	javaw.exe
3464	javaw.exe
3464	javaw.exe
736	jp2launcher.exe
736	jp2launcher.exe
736	jp2launcher.exe
736	jp2launcher.exe
736	jp2launcher.exe
736	jp2launcher.exe
736	jp2launcher.exe
736	jp2launcher.exe
736	jp2launcher.exe
736	jp2launcher.exe
656	javaw.exe
656	javaw.exe
656	javaw.exe
656	javaw.exe
656	javaw.exe
2520	javaw.exe
2520	javaw.exe
2520	javaw.exe
2520	javaw.exe
2520	javaw.exe
2708	javaw.exe
2708	javaw.exe
2708	javaw.exe
2708	javaw.exe
2708	javaw.exe
3460	javaw.exe
3460	javaw.exe
3460	javaw.exe
3460	javaw.exe
3460	javaw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Blocklisted process makes network request 2 IoCs

flow	pid	Process
68	4420	msiexec.exe
70	4420	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	MsiExec.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\javaws.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\javaw.exe	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Bogota	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Iqaluit	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\Reykjavik	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\axbridge.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jawt.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Bissau	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\rmiregistry.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Thule	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Kathmandu	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\Canary	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\decora-sse.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\nio.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Metlakatla	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Damascus	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Hovd	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Jayapura	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Chatham	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\ext\sunec.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Caracas	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Indianapolis	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Nassau	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\Madeira	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Zaporozhye	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\javacpl.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\kinit.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Bahia	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\splash.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Belize	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Eirunepe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Maceio	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT-3	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Amsterdam	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\README.txt	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\currency.data	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Niue	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\EST5EDT	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\ext\sunjce_provider.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Porto_Velho	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Pohnpei	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\dt_shmem.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Adak	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Macau	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Monrovia	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Moncton	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jpiexp.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\messages_fr.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\messages_ja.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\San_Luis	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\Tucuman	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Tallinn	MsiExec.exe
File created	C:\Program Files (x86)\Zona\uninstall.exe	javaw.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jpinscp.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\ext\sunpkcs11.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Almaty	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Jakarta	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Pontianak	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Rangoon	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\fxplugins.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\javafx-iio.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\pack200.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Taipei	MsiExec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F03217080FF}	msiexec.exe
File created	C:\Windows\Installer\e58da13.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE56B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF10.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58da0f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE144.tmp	msiexec.exe
File created	C:\Windows\Installer\e58da0f.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "51432224"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0075-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_47"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_45"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0065-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_65"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0079-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_21"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0028-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_43"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_50"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0039-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_63"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0091-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_56"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0050-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0052-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_22"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\ = "Java Plug-in 1.3.0_02"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_06"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0084-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_84"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_19"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0034-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0065-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_19"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0055-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0056-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_56"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0095-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0090-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0081-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0084-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_84"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0043-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_45"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_59"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_68"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0081-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0042-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0079-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_04"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0093-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_27"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0040-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_62"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0067-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0070-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\APPLICATION/X-JAVA-JNLP-FILE	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0052-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_11"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_01"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_76"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0077-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0086-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_86"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
736	jp2launcher.exe
736	jp2launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4468	msiexec.exe
Token: SeSecurityPrivilege	4420	msiexec.exe
Token: SeCreateTokenPrivilege	4468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4468	msiexec.exe
Token: SeLockMemoryPrivilege	4468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4468	msiexec.exe
Token: SeMachineAccountPrivilege	4468	msiexec.exe
Token: SeTcbPrivilege	4468	msiexec.exe
Token: SeSecurityPrivilege	4468	msiexec.exe
Token: SeTakeOwnershipPrivilege	4468	msiexec.exe
Token: SeLoadDriverPrivilege	4468	msiexec.exe
Token: SeSystemProfilePrivilege	4468	msiexec.exe
Token: SeSystemtimePrivilege	4468	msiexec.exe
Token: SeProfSingleProcessPrivilege	4468	msiexec.exe
Token: SeIncBasePriorityPrivilege	4468	msiexec.exe
Token: SeCreatePagefilePrivilege	4468	msiexec.exe
Token: SeCreatePermanentPrivilege	4468	msiexec.exe
Token: SeBackupPrivilege	4468	msiexec.exe
Token: SeRestorePrivilege	4468	msiexec.exe
Token: SeShutdownPrivilege	4468	msiexec.exe
Token: SeDebugPrivilege	4468	msiexec.exe
Token: SeAuditPrivilege	4468	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4468	msiexec.exe
Token: SeChangeNotifyPrivilege	4468	msiexec.exe
Token: SeRemoteShutdownPrivilege	4468	msiexec.exe
Token: SeUndockPrivilege	4468	msiexec.exe
Token: SeSyncAgentPrivilege	4468	msiexec.exe
Token: SeEnableDelegationPrivilege	4468	msiexec.exe
Token: SeManageVolumePrivilege	4468	msiexec.exe
Token: SeImpersonatePrivilege	4468	msiexec.exe
Token: SeCreateGlobalPrivilege	4468	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe
Token: SeRestorePrivilege	4420	msiexec.exe
Token: SeTakeOwnershipPrivilege	4420	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
736	jp2launcher.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 884	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	92
PID 1900 wrote to memory of 884	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	92
PID 1900 wrote to memory of 884	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	92
PID 1900 wrote to memory of 2260	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	94
PID 1900 wrote to memory of 2260	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	94
PID 1900 wrote to memory of 2260	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	94
PID 884 wrote to memory of 3224	884	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	105
PID 884 wrote to memory of 3224	884	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	105
PID 884 wrote to memory of 3224	884	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	105
PID 3224 wrote to memory of 4468	3224	javaSetup.exe	106
PID 3224 wrote to memory of 4468	3224	javaSetup.exe	106
PID 3224 wrote to memory of 4468	3224	javaSetup.exe	106
PID 4420 wrote to memory of 700	4420	msiexec.exe	108
PID 4420 wrote to memory of 700	4420	msiexec.exe	108
PID 4420 wrote to memory of 700	4420	msiexec.exe	108
PID 4420 wrote to memory of 1252	4420	msiexec.exe	109
PID 4420 wrote to memory of 1252	4420	msiexec.exe	109
PID 4420 wrote to memory of 1252	4420	msiexec.exe	109
PID 1252 wrote to memory of 3608	1252	MsiExec.exe	110
PID 1252 wrote to memory of 3608	1252	MsiExec.exe	110
PID 1252 wrote to memory of 3608	1252	MsiExec.exe	110
PID 1252 wrote to memory of 1668	1252	MsiExec.exe	111
PID 1252 wrote to memory of 1668	1252	MsiExec.exe	111
PID 1252 wrote to memory of 1668	1252	MsiExec.exe	111
PID 1252 wrote to memory of 656	1252	MsiExec.exe	124
PID 1252 wrote to memory of 656	1252	MsiExec.exe	124
PID 1252 wrote to memory of 656	1252	MsiExec.exe	124
PID 1252 wrote to memory of 880	1252	MsiExec.exe	113
PID 1252 wrote to memory of 880	1252	MsiExec.exe	113
PID 1252 wrote to memory of 880	1252	MsiExec.exe	113
PID 1252 wrote to memory of 3216	1252	MsiExec.exe	114
PID 1252 wrote to memory of 3216	1252	MsiExec.exe	114
PID 1252 wrote to memory of 3216	1252	MsiExec.exe	114
PID 1252 wrote to memory of 940	1252	MsiExec.exe	115
PID 1252 wrote to memory of 940	1252	MsiExec.exe	115
PID 1252 wrote to memory of 940	1252	MsiExec.exe	115
PID 1252 wrote to memory of 468	1252	MsiExec.exe	116
PID 1252 wrote to memory of 468	1252	MsiExec.exe	116
PID 1252 wrote to memory of 468	1252	MsiExec.exe	116
PID 1252 wrote to memory of 1988	1252	MsiExec.exe	117
PID 1252 wrote to memory of 1988	1252	MsiExec.exe	117
PID 1252 wrote to memory of 1988	1252	MsiExec.exe	117
PID 1252 wrote to memory of 3644	1252	MsiExec.exe	118
PID 1252 wrote to memory of 3644	1252	MsiExec.exe	118
PID 1252 wrote to memory of 3644	1252	MsiExec.exe	118
PID 1524 wrote to memory of 3464	1524	javaws.exe	122
PID 1524 wrote to memory of 3464	1524	javaws.exe	122
PID 1524 wrote to memory of 3464	1524	javaws.exe	122
PID 1524 wrote to memory of 736	1524	javaws.exe	123
PID 1524 wrote to memory of 736	1524	javaws.exe	123
PID 1524 wrote to memory of 736	1524	javaws.exe	123
PID 1900 wrote to memory of 656	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	124
PID 1900 wrote to memory of 656	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	124
PID 1900 wrote to memory of 656	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	124
PID 1900 wrote to memory of 2520	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	125
PID 1900 wrote to memory of 2520	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	125
PID 1900 wrote to memory of 2520	1900	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	125
PID 884 wrote to memory of 2708	884	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	126
PID 884 wrote to memory of 2708	884	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	126
PID 884 wrote to memory of 2708	884	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	126
PID 884 wrote to memory of 3460	884	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	127
PID 884 wrote to memory of 3460	884	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	127
PID 884 wrote to memory of 3460	884	938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe	127

C:\Users\Admin\AppData\Local\Temp\938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\938105f8ff32ee80432a1118a16c08e6_JaffaCakes118.exe" /asService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\javaSetup.exe" /s REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi" REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0 /qn METHOD=joff
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4468
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Local\Temp\Zona.7z" "C:\Program Files (x86)\Zona"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:2708
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Local\Temp\appdata.7z" "C:\Users\Admin\AppData\Roaming\Zona"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3460
- C:\Windows\SysWOW64\cscript.exe
  cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
  2⤵
  PID:2260
- C:\Program Files (x86)\Java\jre7\bin\javaw.exe
  "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" ru.megamakc.core.JavaVer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:656
- C:\Program Files (x86)\Java\jre7\bin\javaw.exe
  "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" ru.megamakc.core.JavaVer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3324

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A9C4038176EEB6155AE1211299E5CF3A
  2⤵
  - Loads dropped DLL
  PID:700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EF6BF19A27F46829687798580744CB0B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\rt.pack" "C:\Program Files (x86)\Java\jre7\lib\rt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3608
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\charsets.pack" "C:\Program Files (x86)\Java\jre7\lib\charsets.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1668
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\deploy.pack" "C:\Program Files (x86)\Java\jre7\lib\deploy.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:656
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\javaws.pack" "C:\Program Files (x86)\Java\jre7\lib\javaws.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:880
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\plugin.pack" "C:\Program Files (x86)\Java\jre7\lib\plugin.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3216
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jsse.pack" "C:\Program Files (x86)\Java\jre7\lib\jsse.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:940
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:468
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1988
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3644
- - C:\Program Files (x86)\Java\jre7\bin\javaws.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaws.exe" -fix -permissions -silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
      "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.JreLocator
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3464
  - - C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe
      "C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW5camF2YXcuZXhl -ma LWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58da12.rbs

Path C:\Config.Msi\e58da12.rbs
Size 10KB
SHA256 fcbaa96292395532b29059a80aaa8b8dc116b743cdfbba2d94e5334ec81bf2e0
MD5 5b3763ea38065e463e48af89fc992db5
SHA1 0b49e07df7327cb90e56e1a53ea8dca272e8834f
SHA512 cf6bffc89438d3ad6b1f7f26763df714068fe30890126d73f50ec4dcc76eb38a720824e2c4fcf792be7811a1024fe99a1ce7b2a955186dcf824112bf28c63e92
SSDEEP 192:fXaxCiGdAeAFKOuG0GoFKOuI0eazmZqpPihwba:fXsp/5Wh5wJmeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCR100.dll

Path C:\Program Files (x86)\Java\jre7\bin\MSVCR100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsAccessBridge-32.dll

Path C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge-32.dll
Size 95KB
SHA256 4010a3ec604a327861bedf01626c12eaded9d381b6e4f0e6f760895838834a21
MD5 1722510af00ea3c7406681b47bf442f7
SHA1 cafac266d52d78d3743c31ebef22a894781e0de5
SHA512 31a2ce3d5eb9828cbb82d2a7e29f2c5bf46528d38f25827329512cedde37bd03b3cfdba0aba3320b6c0e7779588958e83bff735f6059aad37172598e70e863eb
SSDEEP 1536:wOW8GIF0xqg9Wr0eQPgjiKMQxSo7H0IpSiXk/LPQlswj81NowG0W:zHCxqgA7QPgjiKMvo4IpSi6U6wKKxX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll
Size 3.4MB
SHA256 500d359211ece211cf672de328345876f016fb4a476b2a03cbc3b8b89023ae1f
MD5 27147e1e3faf9b5ccda882cd96f2a85c
SHA1 7103f60121727917f812bfc7cdff5347fc17cc8e
SHA512 0866c604911e243687e7fe721142eb882b19691c902736b59ba304933463d8c9154ecc319b91c9771cee8139e151cc2a2e960bc7a93ed97352cf5232a0964194
SSDEEP 49152:ZrZNQqi9xkS7HU5kf0a5m4mDfhoobdwQC+1F8E9EYm8cBwoHmFOy8CIIaB6wwzmW:7enY5WijhooGh8cGoHm6jvcv/GnUxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

deploy.dll

Path C:\Program Files (x86)\Java\jre7\bin\deploy.dll
Size 371KB
SHA256 352707a271a9ab5d0e190a539b6468d6c6c5ce9675b300acf2305aa1f30625d8
MD5 87ec9d4a00d34eb6a0f8f92e1d1cc08e
SHA1 bee4ecae201905096dd44d1d348ecb3556d90832
SHA512 5b7f9866168ad7948a5a80078b14ff747201d17922ca907072a081e0078f6ac68446ddd36b027b4a17f5afa7d1bb4962642cff28cf66867171ebb78735f242d2
SSDEEP 6144:ZtbYrD6qqtQgirH7/W4/SDMqiJjOBCCMEdvxIW1hN:ZtbYr4tG7/W4/SDMqa4vq+hN
MD5 SHA1 SHA512 SSDEEP

Submit Download

npdeployJava1.dll

Path C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
Size 864KB
SHA256 c029fd3c6ffd2158d0633fc122786838a6f5d3cc7ef78bbe934697015c8c63dd
MD5 bc3a575dfb1a58d35e8617f2966bf1ea
SHA1 6353630f62e246d7f462134e8d10a7a42935e20f
SHA512 c976da30d343f8e104bec72300dc0c17e582e380f0a3ae85b242dbf2d5b40459feb4a3b7789fb8d755b21cbaa0940038d20dbbf1296a48e77b461092abbbe514
SSDEEP 12288:vd4rPQxptuRWuSmOqPsz9YbUOLgsxel3nvb9N3YfG2JmekTvChbOso6CyQJueOdv:F4zWuSDOsz9g1Lgsxq9N3yX4USK
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.dll

Path C:\Program Files (x86)\Java\jre7\bin\java.dll
Size 117KB
SHA256 81ad5696a6fcad89127fc7a428636d431b446ff1ee0c37bf87e8d513a8bae7af
MD5 a258a133f7d565600647a248ab95792c
SHA1 1c6a855ca1fc04413b906b0b17609eff38317161
SHA512 bf9dd97947eb0c71243ae28255af54b06d9e17af7ade666538dd93f9fdf6d8fbc3855f48bfaf6522dbd9ce3c6cff655581f092709670606d033f2321b1f4a5e7
SSDEEP 3072:gnQmO7IlruvLXTYZKj8Jq1YwEyy4YtQNAoTX0D:4h3lKvL0Ztp4K3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files (x86)\Java\jre7\bin\java.exe
Size 171KB
SHA256 c7fd72a0730b377c6da5ac80cdaf5f4cca84cc999a563a4c420fe5a8576810f8
MD5 88651044108e995f9801e35d2582491c
SHA1 abbf404c0253d085223a64ab947e1057c4211c9c
SHA512 486b1d7ad7c3debcb8d70f9351adb08c8321c4cfb409a00ff818be1dacdc376a0eded630ccdc74aa99cc472589b88c9681989076fd78eb109759d33e7bf70543
SSDEEP 3072:KnwrusR90uNHgtMhsaR2fhvTxVwEPEoTBfmabjZqMN7GLi4:wwrusb07tMfRYTxVB8oTBpvqLH
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaw.exe
Size 171KB
SHA256 844ab2231f45fad60d81770ea36d9937da9aa72cd905ce06e7471ddf9d69263b
MD5 64e2bb67ea740860510dcc5c2b6ffa2d
SHA1 6c5996358264624cdb4a075acc4f0b46177cd259
SHA512 ed24331883ada44d8b034f5c8bc458e53234109d5cd02a27989972033f5b3305d23365106ce80be81caa16e472c14c103e457a1e0d138eb0d95036e58d877462
SSDEEP 3072:Yoc9DbDDUaDxmNhrS+eEcbren+W3hYTBfBX0jZqMNSKFg:jc9bDNxmzS+a3entRYTBKvt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaws.exe
Size 266KB
SHA256 841339373958786d9c93a7dad5de8fd213ed6b5ad69623f5a5762a453c48e0a5
MD5 2b4493bb1f94580c41def972ea9a887e
SHA1 880ca8b20c6df9a6a176b91cc50304cb0fe66d06
SHA512 b43e54f2c1f3e0a3c3d2fcee518e47d17476bb735606351e41b49e97e10af758ea9a539ac370a2d12cffa93e3e752e829db969968664c59386f65b732c29e40e
SSDEEP 6144:FHNCVyL+Br9XFt6KeorPZufQ4BIGQYqFkNOjvqR7:JNH6rVtdeobZ2IjYqtjv0
MD5 SHA1 SHA512 SSDEEP

Submit Download

unpack200.exe

Path C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
Size 145KB
SHA256 c89091f2a4de2fcf10b30e54a74ec5764e2dfc0577f4f1d879ac8816e3b08bcc
MD5 0d46182b6134aa9c7acd16133d67e4c3
SHA1 7b5be3d65e5e744723bf55a08f9dc1042585d5eb
SHA512 735b6c6bd69b22a71c15ae44c6fa1693700321dc3b4b2367ce05d5c37df62e45d1d3836c2c0f5e44be1036aeb11a533c2a4dbec55163b4a15adfa1c8ef75673b
SSDEEP 1536:orhTuv/39U7QVq15jIS1mlqct2ND8h+8zu17Oq4qnToIflGIO0IOY03Gk5J0X:oGe9FIFIV8/ulphTBflkaY0Wk5J0X
MD5 SHA1 SHA512 SSDEEP

Submit Download

verify.dll

Path C:\Program Files (x86)\Java\jre7\bin\verify.dll
Size 38KB
SHA256 87d8d59972e73700507c07cee8750b0053c6a0899410338722a00c2803d39ee6
MD5 cb89b1d71061f5ec52468528ecc0b1fc
SHA1 6feb23a8b5719c8997de92c7da644807fcba8819
SHA512 2ff0ed38c7f28eb7ea16f24a0841dfb3306c4fec48ded5fddec8c3140f1a425433a444fe6b6cc4c17b3a39841c8ab0c23d7c9525c119c1b9d6daac2c17a4e4b0
SSDEEP 768:gPGXoQMYf5rFV1wleN0gzhSlAHCf4ouRHJrf4t8fnd577Iq5z:gOXJMSrufMNf4wfvIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsdetect.dll

Path C:\Program Files (x86)\Java\jre7\bin\wsdetect.dll
Size 159KB
SHA256 2ef891881d506084ed182a0ac58b10dbe8c45877ef889ac9105f19431beee4ca
MD5 958bc8d82e4d0a5b51536bb4fc4fb6d6
SHA1 626312fa01c72ec5c85c9262ba0ae97a8b1f5b25
SHA512 fe17b58e3eed817619bebf6d091aee99fdc331c9c5a4163e9f5993b41b2e7362365da210e0636755ada6b8838012de1bc5435b8670aa12f378a3c9e3a9f5af04
SSDEEP 3072:gLutxFjfIlYey8KP0+KbMcfyMvc0crTwC7bd2:gLunFzIqey5P0bbVrchrTwC7x2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path C:\Program Files (x86)\Java\jre7\bin\zip.dll
Size 66KB
SHA256 35ce7ab154a38e97951714e17f7689873d89e8c01188de6e5cd741bc0ca3e384
MD5 1ecf056944068b933ba71cda3edc4a68
SHA1 2052b2138db0d9a368942470b41bb6fc5b1d4007
SHA512 cadf312841d392a9970cc068b72063e17454d5e6738b46ec9622257d9dfc0bcad0d9420352752bf7d8f8e8ceaf6aca97d83896f753dc12cfeac3e5efb5e1ab05
SSDEEP 1536:4UH9k47M2axhBBQq8SRlr8IOwIOpVnToIf1QfqPu:zl6u0xymp9TBf1QfqPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

charsets.pack

Path C:\Program Files (x86)\Java\jre7\lib\charsets.pack
Size 1.3MB
SHA256 8ea5af036ec067a0abcf87b8f5921e2281ff9d259e1d4c3bbe7fa9037cd87d02
MD5 549bbcd204914b543dafee670f110834
SHA1 012461935191a55482e8c3d453d245e965a10a2a
SHA512 b0346a2ec52ce47351286f27f347f5fea99e160aedde52bcf74e1629739704bd975c9c99d8db6be3b6bd45e7fa933616fa081eda49e9b911efcc031c7241400e
SSDEEP 12288:QcvuzHfxrXJEmb5yyWMOXpyDy64BqY0qohrn2Wz/n3OEDgsa1dQnBJ4F:QcWTd5EmbmXse/0/n2cn3QF
MD5 SHA1 SHA512 SSDEEP

Submit Download

classlist

Path C:\Program Files (x86)\Java\jre7\lib\classlist
Size 73KB
SHA256 3837e95826d2273a54e3869efcad1521e000215428a2c7ee9397b650834ebaf1
MD5 1a0b7592ab9c12aff1191dfd225154ca
SHA1 3d3fb5f326f2caea866028558834ae684a2fe09f
SHA512 b2932400b6d8c72d344cb0592f121623dd848dcdd341248cf18cd55cd0c4fbd7f923057d022f89586ec6062299d756a37b3ff4308f10865de6ba68b2ee530fe9
SSDEEP 1536:Erv75nC+l+IbYoce+aeVQfo/ohdAyPD+cJKslPKUhjK6gVXVLpKhbC/4Z+j7RFR2:OnCcYKe/Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

deploy.pack

Path C:\Program Files (x86)\Java\jre7\lib\deploy.pack
Size 1.7MB
SHA256 928f6b847f94b920c462a08c43f0dfd3f7c40076b1cd60545523a5c27a4870ca
MD5 b2a448112b7c886ccce9b6a3d5efd8a0
SHA1 660bc9efe960015b208a421b1a63443e7151024f
SHA512 871da63f4eaf16d77ba6c19c10d8ddd8e94f744c20a70e24793f837023d20e56698d85f67498bc06ec37b73a8f376c220afbe7f3884b00536b710ff49c339b3f
SSDEEP 24576:zdyq6mG9BvZSL4096jCVKTBtdjM8pOzoAGdoKW0IriN2:zMvO4dFWfic
MD5 SHA1 SHA512 SSDEEP

Submit Download

localedata.pack

Path C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack
Size 736KB
SHA256 da2803a283d28882182e1e280b4f25ee1579a5805e73fcc9882e63968f102a8f
MD5 c8dc1cfeaf0fefc39ed0f1de4eaa175c
SHA1 11cacbb9e5724d37789455de37a225d8e0c648a1
SHA512 6b419ba94ae90f8caa3a57690f2ec7e249c9fb8ab86819439621cde1243c7636ee76820622ce32ed483ce76976f7ced74778898fc2725b1a2407b039fb53508c
SSDEEP 12288:+FFkQLRQjAgM4fIuskrqTYSuGTwj0ehh/k9SoBUaBYu:BpAgXzOcSuUw4eh5iUAv
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.cfg

Path C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg
Size 686B
SHA256 c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88
MD5 5147cce789cd18ad6b2996eb89e5d866
SHA1 756f1fffe96ef581f0d4d47253523544c89a2622
SHA512 55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6
MD5 SHA1 SHA512

Submit Download

invalid32x32.gif

Path C:\Program Files (x86)\Java\jre7\lib\images\cursors\invalid32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
MD5 SHA1 SHA512

Submit Download

javaws.pack

Path C:\Program Files (x86)\Java\jre7\lib\javaws.pack
Size 205KB
SHA256 ee43869ee94eefe241d661101ff6a03cc276f8e558967b1b350ea088f1dad2e2
MD5 491bce42c6cd8af88a2e11f37711ed4f
SHA1 3de7c18fee44465a6afe34e068f2a64dea9fa324
SHA512 1e5f99466b77b5a82c23449434272acf5746811ef96b98105f89b3339ccd86734d7713c94b773755219345d673a761a356fbe846a38e7893bd8894e43cf102e4
SSDEEP 3072:r05V3g4qpeICnbOKxO6kzmioaxOuVhi8kV2MoOGN2jhKuCQ0nAsKu4iCp+vgn43:ruO30OekKioaQ8v29pCQivKXgO43
MD5 SHA1 SHA512 SSDEEP

Submit Download

jfxrt.pack

Path C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack
Size 3.2MB
SHA256 8c481a549acfa58b1bac0385906febe33a928d004a529fec505b6a9228678fed
MD5 dfaa6429468d56ef77932cf26a495f75
SHA1 8a21a29225640f1829ae328a24ef9cb5e215a4e0
SHA512 6c19ed573b111315648de0646441486729b304452c15b2282938460a2339db0be4e1eb19cf6f2bf17f73037811ca2553a15957ea96b9d9af64a93045407c1148
SSDEEP 49152:TIOCux2SzM48f4NCZdfyupJDyQz8YCIN5yOHgNN:BRp0ptz8YCIfHM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsse.pack

Path C:\Program Files (x86)\Java\jre7\lib\jsse.pack
Size 141KB
SHA256 9f031f2f1292bb311c400b0a93a11b78a08f013332b1263ea58617b6548862eb
MD5 31b4d9c29d29567b0ae3037fac9fbdc6
SHA1 8b5d1b1a309177466d71a742414d441f600ea38e
SHA512 b4a8a3a1e837f98a3164e19a6fe939819eb336892335de975822890b52b5923d85fee4c4e5464ccb0d46c847f37f7da98a839aadbf4d20fca355f396a53836c0
SSDEEP 3072:+btJdrAlQMcNuicXy7/Sa1hz3igGCCCCtgXiJTOyV:+RrrAlQMcN3Uy2abQ/Ok
MD5 SHA1 SHA512 SSDEEP

Submit Download

meta-index

Path C:\Program Files (x86)\Java\jre7\lib\meta-index
Size 2KB
SHA256 afb4850419612e0daf1876a5d61120ed0ccae241f188c25c014602007b3a765b
MD5 8bff510abed2b6fcc5a83eedb65b1766
SHA1 ba6d0cd7504a5baeb963501b8bdf315ec6cb355c
SHA512 8786bd672ce9c53f4c31f8206d621eb06ae7527f9adf3700955cc1cb928dde145b684666a5eb4ac11301541f585970ccd377ba144da351741e3cb5769b6ff522
MD5 SHA1 SHA512

Submit Download

plugin.pack

Path C:\Program Files (x86)\Java\jre7\lib\plugin.pack
Size 489KB
SHA256 93defaaf7f82e2e9565b27dd31a41c89e02d1b7719d0da0b940a55dcc75b91e5
MD5 47d6cfa1b01a6d41885504bbc3b1919a
SHA1 3838060f9d530c972d65f36fa38b265120a218aa
SHA512 b0df9b174624234aaeb2b50cf611f698377925a0ae5c5ee9da46c65fcecf4d28941d1bf2332316d9327981c1f8c6c4fecf750e013f04eef63f5df52d27593135
SSDEEP 6144:pPYDxiUn5kuS7ogVc4r+cWaTu8KPVzsRnVPI6oWnfmoNOz4KMWpeNi+:pgx57IcEvWeSVzpN0OOWcNV
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.jar

Path C:\Program Files (x86)\Java\jre7\lib\rt.jar
Size 49.4MB
SHA256 a85b24d93ceb6095691838dda51d31bc5e8dc94663514b46c48d7c41d351aad2
MD5 bac77d8d145bd553c7efdf7978d9dff0
SHA1 31da52beb0237a6ffd6ebc4a766d92f12a226fb6
SHA512 2aabc1986338a68cdecf6d46afd6492a90940d9412bf8f7ad7c6183091403a784244ecf1007dc3875a892c0b1c2557f5de31f387011ca8db657f4367f5fc86ba
SSDEEP 196608:KBGhB5BSlLdAL/XYYLEY5tz9YW4ZrsdkatGvr4dKUy05VtkR/xCIMS:z5BSlu7lLX/9f0rsdkatGvr4dKUn0x6S
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.pack

Path C:\Program Files (x86)\Java\jre7\lib\rt.pack
Size 13.1MB
SHA256 82dc6806d9ec9eb16604f90a5c78d0d882b69a0e718d8f6c3c6b7c9719887b7e
MD5 b6d75e8c90c79af1579769f10b1e5c88
SHA1 146cb3f05fa161885e8faf079fa2bbd89b5c5b18
SHA512 02cdd0c0d6e71bc09120db2cd3b9471c0176567d92bb74a08c13e82c1d23722eb4afac41583a11dee3fc531fd442754ee0f5cb964898ec036ddd432947996037
SSDEEP 196608:xHWBePZbgggLYJ4329rRizU/ULUh49TXY9o9W:DPZbgggLYJ4m9CehoTo9o9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

GMT

Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT
Size 27B
SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
MD5 7da9aa0de33b521b3399a4ffd4078bdb
SHA1 f188a712f77103d544d4acf91d13dbc664c67034
SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
MD5 SHA1 SHA512

Submit Download

GMT+5

Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+5
Size 27B
SHA256 27ba8b5814833b1e8e8b5d08246b383cb8a5fb7e74e237cdbcadf320e882ab78
MD5 a2abe32f03e019dbd5c21e71cc0f0db9
SHA1 25b042eb931fff4e815adcc2ddce3636debf0ae1
SHA512 197c065b9c17c6849a15f45ac69dafa68aaa0b792219fedb153d146f23997bfa4fbc4127b1d030a92a4d7103bded76a1389df715b9539ea23ea21e6a4bb65fb2
MD5 SHA1 SHA512

Submit Download

HST

Path C:\Program Files (x86)\Java\jre7\lib\zi\HST
Size 27B
SHA256 3144bc5353ebbd941cdccbbd9f5fb5a06f38abf5cc7b672111705c9778412d08
MD5 715dc3fcec7a4b845347b628caf46c84
SHA1 1b194cdd0a0dc5560680c33f19fc2e7c09523cd1
SHA512 72ab4b4ad0990cce0723a882652bf4f37aac09b32a8dd33b56b1fbf25ac56ae054328909efd68c8243e54e449d845fb9d53dd95f47eaaf5873762fcd55a39662
MD5 SHA1 SHA512

Submit Download

MST

Path C:\Program Files (x86)\Java\jre7\lib\zi\MST
Size 27B
SHA256 0e6a7f1ab731ae6840eacc36b37cbe3277a991720a7c779e116ab488e0eeed4e
MD5 11f8e73ad57571383afa5eaf6bc0456a
SHA1 65a736dddd8e9a3f1dd6fbe999b188910b5f7931
SHA512 578665a0897a2c05eda59fb6828f4a9f440fc784059a5f97c8484f164a5fcec95274159c6ff6336f4863b942129cb884110d14c9bd507a2d12d83a4e17f596d2
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 698B
SHA256 c39bd53b003fa563b5e417781fed340fd12ee840a9d50d2373bd9639a1b96a55
MD5 67c507c1e5812360234851fa19b6ab8c
SHA1 f8529f66ed2242d92d6a8205ce00c2a9a58034db
SHA512 314d5a6322785cdecc11be87bdeb88b41717f2f01e1a13f7200feba614d5163556a25d09048ce8e7ca61bec4c2184741ea442e74564e09fefde3e5972fd516cf
MD5 SHA1 SHA512

Submit Download

Data1.cab

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\Data1.cab
Size 5.8MB
SHA256 f16cf123cb24a38015064e1dd2599d9d2e276df4455a946cc16bc6b0646aa77a
MD5 8f7102beba0becefe8a1da6a1bdc9b2e
SHA1 e66b688cfb3b53eb471123cc23c03fda47ff0d3a
SHA512 a6772f4c69f1dd7822794b1373aa5ca88a2250f6442873c94d2324e1d6f76dbe2ae6a947bdd4f1880b2666b7e9a232da3ac04c05f357259dae0d6f85b11bab14
SSDEEP 98304:SQupIlM3ScZ/tU86qIovgGvHnDsXMUiLcej2lRlhkFtjlWCjfX9Z8RTxD0ArpD6J:S9ClWhZO5Fo4wj64ABRLK1jD+1nNWsMX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jre1.7.0_80.msi

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi
Size 898KB
SHA256 dbf28e21d55dd662cccf4d422a1a645a6a3dbfd6914942dde417d20c4d2fe01c
MD5 e24d9b483ce7a3a6a4406111883457f7
SHA1 0d5efff0d110c48f5e6f5d438967427f1e2dbf84
SHA512 b614b023ce683e78ee685be028fa06d7df90f10360d55de2a8c1214200b0b85998683502f377b01584bf23b72b168c33ef560a78d7abdf68aa3af87beca59398
SSDEEP 12288:JbSGg983mCR0sY9D4+doy8J5EMPhQmW9K+r:JbS1983zq4LbEI+S+r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 3KB
SHA256 8962e002f78b2dab64a4fac591b247d5ae059abe498bc813f42253a1d3f0a442
MD5 e9f86a1298511d345653f46c8e81d38b
SHA1 6a0be31ee4f648f9703bc7170445c4cd82e96347
SHA512 b7d51e226d706771feb27855159928d3d8db1d9e2b5d8d88fa90615a59e30dc2d6d9424692ade68abbd7ec491b846db8dfc5de803202977bea54ffd30cabe7c5
MD5 SHA1 SHA512

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 4KB
SHA256 a807f8952161e68e5f9a05bbd319a78ce8678d08f98e7a20f41233c4e035d06c
MD5 c3f3b0d50b60125267e8c7aa6a763e20
SHA1 b9cbd5eb2280f56a2a3fd4acaa84dc9e0dc661d4
SHA512 e51b33574254dd581d710b2def4ef103f351ac41f0e220bc35b3becb53e55f26ff09e962da46398e07f16f6723f9ea97e2d7326ecfbcf7ca9e58b5387ad36a85
SSDEEP 96:oGJuhTI2Iwogd2s2PiKf8RWOg51yMQzI3ZiYhV0V2VeWE:lNcN2PlVOg51i
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 844B
SHA256 dcc6ef9e0367ebdd85fa27095f46315e1e28f1f3117c7ac31f4a59d11b4a574a
MD5 22f90029714048958d48563a10774868
SHA1 9c7f32635692c76371972a5caa5b3fd96601cfb2
SHA512 38c85357e4351201a631d1312656d8f306bafb19b27b351adf4c2b19621799525351aebb577cce9719a6fbca951dab32f104a1ce16d62b1220b868f046ce0dad
MD5 SHA1 SHA512

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 2KB
SHA256 bea420a2ebcd9cc21a1a074a98d36280fa8f52b58dfecfa48415bbaf34e37d80
MD5 e4ae10d72c6a29c7dcfd783419cbbc52
SHA1 89a1bf3e732705c760233bd712b2798788a311bb
SHA512 2657d94aa16e903651e947103187fe7b48d489722517dd1382e6f46b4b8afe43df8142c583c2b99faeae5a893bcd57045cdac96cfe2da1e6df9a39c1b1ecfc0a
MD5 SHA1 SHA512

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 184B
SHA256 0c5e81cae3cee9a10f89bb20a948f6e5596391eae4f69deab753c5eae6d87c8e
MD5 10466272e1f4799583d71314db2ea690
SHA1 18c25916639d01127a3752d4b4f17ce7578b698e
SHA512 a5d4dfb3e3fbb26268c73c9d748ac9011c97721b493fd25cbdace65932512d5b06e2ffbb772fb8eaf36171154840a39924d9adbefe67f26e7478cae14e4326a8
MD5 SHA1 SHA512

Submit Download

hd.vbs

Path C:\Users\Admin\AppData\Local\Temp\hd.vbs
Size 245B
SHA256 4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
MD5 d8682d715a652f994dca50509fd09669
SHA1 bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA512 eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca
MD5 SHA1 SHA512

Submit Download

javaSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
Size 6.3MB
SHA256 99f278ba4fe8c0211e3474dc22ebe826757388f628086c7aa40ce34549a3971b
MD5 1c35470cf9dd0ee899a0b51297780067
SHA1 24b061076666c8cca1fd55692da280b9c17479a5
SHA512 aaab89936125a5c469c34fb1c73dfe9c0611d2541a8133cd67969f1647685eb15b46e2d412e83090548531cbfd30c6b3d2d95d33ebe5a1cf91b55317fe0b48e7
SSDEEP 98304:+23vjJPZE/mSQupIlM3ScZ/tU86qIovgGvHnDsXMUiLcej2lRlhkFtjlWCjfX9ZN:rvjJxuf9ClWhZO5Fo4wj64ABRLK1jD+q
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
Size 7.0MB
SHA256 78514037c0451396dc7785675670daad02f22a2d9f2309701cc6b5a108723c44
MD5 086e502a75504ddcd3a7f31dd2558b54
SHA1 3fc18732d2853d5a6295c57d79d0694181acc7c9
SHA512 d412ec3ac8e7d9c866911b48bb9425d5d8a5561ec811f00a536687895d3508e47b665fa4e417d97241100bd12c336431d36631e0bd560d0342d574661e351f5d
SSDEEP 196608:rvjJxuf9ClWhZO5Fo4wj64ABRLK1jD+1nNWY:rLJxuf9CUhZsoKK1mWY
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 22KB
SHA256 e0e88bda4bcbbcfadb1009060372744f8b3f3628ae29b1d310a99255ec76aa7a
MD5 525bf7f5b63ffd5e86fa3aee92551c21
SHA1 bf3cd939fe57f5076afbd231cb5b1b0ea03ba5d0
SHA512 825d048f8a3eb7ec88bda27eaf34b5c05a9545a12d48d29fc264aeae571fb2b4aa2957cd1b5459d53dc5d18b7968760d47136a6ec099c5612c3a7ab677b24d73
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TP:c8L6gWt4wnAQ7WTb6aotVhP
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 23KB
SHA256 f7468e1cf9cb05006bb7eebf4ce106f98828351ac7d8637486794ba90e5f5bc2
MD5 18f48d6714640435ab93cad409e10070
SHA1 fd33c178274fb08adb77cf5c695ce29ba32417bd
SHA512 632e4957e610ab787ed9a2cf3e8d988acb16e4cfc4d4df9b52682ca54fa4f7fed980b7b5dd69b1c4dd71554894ee5e5199da630b721f3c7403652f923a16dcc1
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXUO:c8L6gWt4wnAQ7WTb6aotVhkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 23KB
SHA256 3532daff57c2b70280ef79edf17af55d108b2d46b88bdbf248fab74db2a43d14
MD5 a2623660c345873243bb8f88145663b5
SHA1 d8cabac7b4057649bb6ca31504719fb0881c7190
SHA512 60dc96479ae28a9011dee7a2e8ff2cb60ab548a6164ba8f5562fcd1cb154362677a68c98c62aa62333ac9812d4ddb3e332957efdbc5acfb5eade18f111c21f6e
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1F:c8L6gWt4wnAQ7WTb6aotVhk2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 24KB
SHA256 1e1a1fcf7c15b8f6019b1696765c696e69a510bb25fd29daa4f8286b206e738a
MD5 e2aaff5f40ba3fbc2df129ed2157dd19
SHA1 8d6b9aeeae45922687e24365cecffdc0e4997f08
SHA512 e1e5a42c4b5bac65b4747b149a694d738fe7e4e7c5398ef564885796e4d9d3cf5ae4ef1cd2066dd6ba24463654c090d79ac84e0f1ad76575155deab8088e6843
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ6:c8L6gWt4wnAQ7WTb6aotVhk2m0
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 25KB
SHA256 648dac2d3607a22d24056d6d29f1e43343c0e812faffa92a381f627cc42789d4
MD5 d2c611a13ec2cd37d228aad0305dc734
SHA1 b7d5dd93fb333c96f9d0c516fc862a1f6dc31ae8
SHA512 5e73bcfaf14e4a45068a74623e9ed39276844efc6269604ea231f1457c5837605e34ebc7fbf106156b0d653c3a0ce90bf0817d09a44a7b268718747506da70d3
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ5SuR:c8L6gWt4wnAQ7WTb6aotVhk2mzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 25KB
SHA256 f46f4d796f236751d277dc24184765679d409c0e454ae07587ca09e0710a0f1f
MD5 250dd63c170bf6cc59e2a7a34edb348b
SHA1 da811a6038e340332de88fe1c2a574ee1bb8a8a8
SHA512 ffc14529043f3231ace3beda1cb14de9ef37d24221d462138eb8fe9cb255eacba42bb864e41a575b7c14773ae577f6e44afcd408f2415678f1019895e3c376c4
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ5SuJk:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aih
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 a0da062ab80c0dc8d84f51bd76faf53001cd4b48bcbc0ddae6d75e210ea92ccb
MD5 6395ef19c45e81bddd74837a1394acb5
SHA1 92a97d8fa5c76891d0df4b4d9812370ee85859b9
SHA512 5bb7439566d386aa46774e71378284fff75855f2b5971345d54e5142a23a9488a49b1de2a9533d37cb3f33c8d50cc64727daac7c96ca6dd3779144379a068fdb
SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4K:BL6g648Hs6aotE2mzViqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 2f0f162f348b4020566418fd30c090fac83883284dde7c163b923f68d0886c69
MD5 cc147c8509b89de26462cd73e51d3df4
SHA1 b37e85f40a18c1832530a760b309799378f7f6a9
SHA512 b8ef88fc7c91371605dc12a6fae41fa576836ad7eecbf728cd78ab5de9b235c221d5f43d2e9f9adc234f6ae5c3e823dd1b213aaa0340aa8d341015ad393a3e93
SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4Jt:BL6g648Hs6aotE2mzViqJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 154KB
SHA256 fa69ccbd24067deb0bdb358ca8fa54bbd7b59fd74c1a275d2ebc98cdfdab2b57
MD5 c636419de001996a641621f51ad35d9f
SHA1 f299fc6bbfdfc4e04a248fbf3a40e503fccbbf3c
SHA512 b9482c0e95e4ad263458d1464d5790948f500e56874782c0397337a912783435cbf782f7f1900dbee0b0d826fbe6e55014989de6cea8ac112d05298b9a8fe6fd
SSDEEP 3072:7Yxx+L9ThO+mqD4zSUXtOrmg7TJ442lyAMVjpK09qH:cyRC
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 153KB
SHA256 493a646df8c997b05a5a5d11fa68f66e2f7c7ea2009674e056c4ca4dd2ec72f8
MD5 b3398ccf35ead6e06f9c5eb8b863afcd
SHA1 95be73ad94d2cd7acbe560a715d2e19bb109be3e
SHA512 8f56b4996654eee61371f7a41c958c85080b5fac47cdcf02966f70de3727f4da59519c0ec44434d54b75630b834ff9c0e56192550e59641a31003e1621fe2eba
SSDEEP 3072:7Yxx+L9ThO+mqD4zSUXtOrmg7TJ442lyAMVjpK09o:cyRo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 153KB
SHA256 90c09660fc320d3be05c0b598abdd1259c9f4c632095b85ff6f7ce80a7b1da5f
MD5 7745b3cea25e2e1b15ee9ff72fab79fe
SHA1 718ad1be6be51f94aece7be6fe5e88b727aab003
SHA512 18f133a7ff86f957027b8ef3c84d5f9cd38593b3f2c4603ac1cbd7ae537e660eb44026888f52895c6fdc458dfcc5aac63519e2b36f4acedbd7fb124c29ceeea6
SSDEEP 3072:7Yxx+L9ThO+mqD4zSUXtOrmg7TJ442lyAMVjpK09Q:cyRQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

init.xml

Path C:\Users\Admin\AppData\Roaming\Zona\init.xml
Size 429B
SHA256 65d75dc574cdc94e99bcce6b8c69c85aae873a8916c2b02883bcc2550588a7fb
MD5 87345acd801693604fe5aa01a858c536
SHA1 bb9783e66bc1f7cd7ac13182a29919759476cbe5
SHA512 4d8efd36c8d31aaf19a19c9423da9dd68aed35fa4a12e47d1ca59854d22388bfb8f3839024791614cea4809cad2eb2dddcc819d41c6775d45de302edddc67d48
MD5 SHA1 SHA512

Submit Download

MSIDF10.tmp

Path C:\Windows\Installer\MSIDF10.tmp
Size 202KB
SHA256 bf4e4c75d148cb412e28a0b4e665919fd5ac6b9aa6bc3fa75401394759218d5e
MD5 9f84d910602183954bed6d9660600783
SHA1 82e3b122dc63e0a333bca531dd16667d5fafbf23
SHA512 09fb450e6c6f22a32d5e06f470070aab17d4973afe307b529093af7fa29ab96b61a89814e4964d005459f8ebb25716134a5e1c41f6ea7d260361b135306544b9
SSDEEP 3072:nCYl9W8fZ2MaPI/K4W7AfchMoCzWNb/sVq5+/DzaRspvh:nHlg8fZ2MfK4dUyoyu/x56u+hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/656-1551-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/736-1597-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download

memory/736-1558-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download

memory/736-1603-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download

memory/2708-1632-0x00000000011E0000-0x00000000011E1000-memory.dmp

Download

memory/2708-1641-0x00000000011E0000-0x00000000011E1000-memory.dmp

Download

memory/2708-1649-0x00000000011E0000-0x00000000011E1000-memory.dmp

Download

memory/3460-1678-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/3460-1704-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/3460-1732-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/3464-1428-0x000000003A200000-0x000000003A210000-memory.dmp

Download

memory/3464-1450-0x0000000002B80000-0x0000000002B81000-memory.dmp

Download

memory/3644-828-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download