139ee6fc065e526efac3cf24d50d0d95c78e1a10ff2cf40839cd4756fff43e71

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
965abae8ef3e9859e0e473c5f3cffccf.exe
Size 206KB
Sample240606-dafc3sfa8z
SHA256 139ee6fc065e526efac3cf24d50d0d95c78e1a10ff2cf40839cd4756fff43e71
MD5 965abae8ef3e9859e0e473c5f3cffccf
SHA1 6fb809712f1aa97ad226186702c6cc9528144b44
SHA512 3c040033cf886f1f272d2ba02c6bf2b1e294a8d7dd25286e201c43b4ac9ee7f3e78ee2e8c9c5a340c6a93711258936d23e0391aa62fb2536a58e973fb9e69262
SSDEEP 6144:q8+9tCJQBqCYaM+QcEdNc4fdem9UJNh+ytHFoSyG0:sf2aM+Qcn4V/8NhnpFoSyn
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	965abae8ef3e9859e0e473c5f3cffccf.exe

Executes dropped EXE 17 IoCs

pid	Process
4028	41javaSetup.exe
4008	unpack200.exe
3544	unpack200.exe
2720	unpack200.exe
3324	unpack200.exe
3212	unpack200.exe
4240	unpack200.exe
4852	unpack200.exe
440	unpack200.exe
1588	javaw.exe
5492	javaws.exe
5512	javaw.exe
5664	jp2launcher.exe
1844	javaw.exe
2772	javaw.exe
3020	javaw.exe
3396	javaw.exe

Loads dropped DLL 55 IoCs

pid	Process
4296	MsiExec.exe
2808	MsiExec.exe
4008	unpack200.exe
3544	unpack200.exe
2720	unpack200.exe
3324	unpack200.exe
3212	unpack200.exe
4240	unpack200.exe
4852	unpack200.exe
440	unpack200.exe
1588	javaw.exe
1588	javaw.exe
1588	javaw.exe
1588	javaw.exe
1588	javaw.exe
2808	MsiExec.exe
2808	MsiExec.exe
2808	MsiExec.exe
2808	MsiExec.exe
5492	javaws.exe
5512	javaw.exe
5512	javaw.exe
5512	javaw.exe
5512	javaw.exe
5512	javaw.exe
5664	jp2launcher.exe
5664	jp2launcher.exe
5664	jp2launcher.exe
5664	jp2launcher.exe
5664	jp2launcher.exe
5664	jp2launcher.exe
5664	jp2launcher.exe
5664	jp2launcher.exe
5664	jp2launcher.exe
5664	jp2launcher.exe
1844	javaw.exe
1844	javaw.exe
1844	javaw.exe
1844	javaw.exe
1844	javaw.exe
2772	javaw.exe
2772	javaw.exe
2772	javaw.exe
2772	javaw.exe
2772	javaw.exe
3020	javaw.exe
3020	javaw.exe
3020	javaw.exe
3020	javaw.exe
3020	javaw.exe
3396	javaw.exe
3396	javaw.exe
3396	javaw.exe
3396	javaw.exe
3396	javaw.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1140-0-0x0000000000F20000-0x0000000000FAC000-memory.dmp	upx
behavioral2/memory/1740-40-0x0000000000F20000-0x0000000000FAC000-memory.dmp	upx
behavioral2/memory/1140-75-0x0000000000F20000-0x0000000000FAC000-memory.dmp	upx
behavioral2/memory/1740-78-0x0000000000F20000-0x0000000000FAC000-memory.dmp	upx
behavioral2/memory/1140-1619-0x0000000000F20000-0x0000000000FAC000-memory.dmp	upx
behavioral2/memory/1140-1748-0x0000000000F20000-0x0000000000FAC000-memory.dmp	upx

Blocklisted process makes network request 1 IoCs

flow	pid	Process
40	4956	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	MsiExec.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\javaws.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\java.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\javaw.exe	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Petersburg	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Bishkek	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Moscow	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\release	MsiExec.exe
File created	C:\PROGRA~2\Zona\License_en.rtf	965abae8ef3e9859e0e473c5f3cffccf.exe
File created	C:\Program Files (x86)\Java\jre7\bin\dt_shmem.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Vancouver	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Volgograd	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Kosrae	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\ktab.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\messages_it.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Tripoli	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\deploy.jar	unpack200.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Chuuk	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Easter	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jawt.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\content-types.properties	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Swift_Current	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT-7	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Rome	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Niue	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Pangnirtung	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Athens	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\unpack.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\ffjcext.zip	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\ext\access-bridge.jar	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Barbados	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Guatemala	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Kentucky\Louisville	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Kiev	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Efate	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\Davis	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Almaty	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Choibalsan	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Tokyo	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Madrid	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\README.txt	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\charsets.jar	unpack200.exe
File created	C:\PROGRA~2\Zona\torrent.ico	javaw.exe
File created	C:\Program Files (x86)\Java\jre7\bin\npt.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Guayaquil	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Thule	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Thimphu	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\Bermuda	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Melbourne	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Monaco	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Prague	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jfxmedia.dll	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\servertool.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Creston	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Inuvik	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Whitehorse	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Riyadh89	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Rarotonga	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\jqs.exe	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Omsk	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Copenhagen	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Zurich	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Reunion	MsiExec.exe
File created	C:\Program Files (x86)\Java\jre7\bin\glass.dll	MsiExec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57abef.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F03217080FF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF1D.tmp	msiexec.exe
File created	C:\Windows\Installer\e57abef.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57abf3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD86.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "40945820"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_50"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0048-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0058-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_58"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_21"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0053-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0081-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0073-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0094-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_43"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0069-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0088-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_88"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_37"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_26"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0042-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0014-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_32"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0037-ABCDEFFEDCBA}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0093-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_93"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0004-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0031-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_16"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0041-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_72"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0029-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_29"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0078-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_23"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_50"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0057-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_29"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_38"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0049-ABCDEFFEDCBB}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_10"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_22"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_12"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_14"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_49"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_04"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0091-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0074-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBC}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jfrfile\shell\open\command	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0051-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_51"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0055-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBC}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_37"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_09"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0042-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_42"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.0_01"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBB}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBB}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\wsdetect.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_04"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBC}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5664	jp2launcher.exe
5664	jp2launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4764	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4764	msiexec.exe
Token: SeSecurityPrivilege	4956	msiexec.exe
Token: SeCreateTokenPrivilege	4764	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4764	msiexec.exe
Token: SeLockMemoryPrivilege	4764	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4764	msiexec.exe
Token: SeMachineAccountPrivilege	4764	msiexec.exe
Token: SeTcbPrivilege	4764	msiexec.exe
Token: SeSecurityPrivilege	4764	msiexec.exe
Token: SeTakeOwnershipPrivilege	4764	msiexec.exe
Token: SeLoadDriverPrivilege	4764	msiexec.exe
Token: SeSystemProfilePrivilege	4764	msiexec.exe
Token: SeSystemtimePrivilege	4764	msiexec.exe
Token: SeProfSingleProcessPrivilege	4764	msiexec.exe
Token: SeIncBasePriorityPrivilege	4764	msiexec.exe
Token: SeCreatePagefilePrivilege	4764	msiexec.exe
Token: SeCreatePermanentPrivilege	4764	msiexec.exe
Token: SeBackupPrivilege	4764	msiexec.exe
Token: SeRestorePrivilege	4764	msiexec.exe
Token: SeShutdownPrivilege	4764	msiexec.exe
Token: SeDebugPrivilege	4764	msiexec.exe
Token: SeAuditPrivilege	4764	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4764	msiexec.exe
Token: SeChangeNotifyPrivilege	4764	msiexec.exe
Token: SeRemoteShutdownPrivilege	4764	msiexec.exe
Token: SeUndockPrivilege	4764	msiexec.exe
Token: SeSyncAgentPrivilege	4764	msiexec.exe
Token: SeEnableDelegationPrivilege	4764	msiexec.exe
Token: SeManageVolumePrivilege	4764	msiexec.exe
Token: SeImpersonatePrivilege	4764	msiexec.exe
Token: SeCreateGlobalPrivilege	4764	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5664	jp2launcher.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1972	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	81
PID 1140 wrote to memory of 1972	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	81
PID 1140 wrote to memory of 1972	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	81
PID 1140 wrote to memory of 1740	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	86
PID 1140 wrote to memory of 1740	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	86
PID 1140 wrote to memory of 1740	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	86
PID 1740 wrote to memory of 4028	1740	965abae8ef3e9859e0e473c5f3cffccf.exe	95
PID 1740 wrote to memory of 4028	1740	965abae8ef3e9859e0e473c5f3cffccf.exe	95
PID 1740 wrote to memory of 4028	1740	965abae8ef3e9859e0e473c5f3cffccf.exe	95
PID 4028 wrote to memory of 4764	4028	41javaSetup.exe	96
PID 4028 wrote to memory of 4764	4028	41javaSetup.exe	96
PID 4028 wrote to memory of 4764	4028	41javaSetup.exe	96
PID 4956 wrote to memory of 4296	4956	msiexec.exe	99
PID 4956 wrote to memory of 4296	4956	msiexec.exe	99
PID 4956 wrote to memory of 4296	4956	msiexec.exe	99
PID 4956 wrote to memory of 2808	4956	msiexec.exe	100
PID 4956 wrote to memory of 2808	4956	msiexec.exe	100
PID 4956 wrote to memory of 2808	4956	msiexec.exe	100
PID 2808 wrote to memory of 4008	2808	MsiExec.exe	101
PID 2808 wrote to memory of 4008	2808	MsiExec.exe	101
PID 2808 wrote to memory of 4008	2808	MsiExec.exe	101
PID 2808 wrote to memory of 3544	2808	MsiExec.exe	102
PID 2808 wrote to memory of 3544	2808	MsiExec.exe	102
PID 2808 wrote to memory of 3544	2808	MsiExec.exe	102
PID 2808 wrote to memory of 2720	2808	MsiExec.exe	103
PID 2808 wrote to memory of 2720	2808	MsiExec.exe	103
PID 2808 wrote to memory of 2720	2808	MsiExec.exe	103
PID 2808 wrote to memory of 3324	2808	MsiExec.exe	104
PID 2808 wrote to memory of 3324	2808	MsiExec.exe	104
PID 2808 wrote to memory of 3324	2808	MsiExec.exe	104
PID 2808 wrote to memory of 3212	2808	MsiExec.exe	105
PID 2808 wrote to memory of 3212	2808	MsiExec.exe	105
PID 2808 wrote to memory of 3212	2808	MsiExec.exe	105
PID 2808 wrote to memory of 4240	2808	MsiExec.exe	106
PID 2808 wrote to memory of 4240	2808	MsiExec.exe	106
PID 2808 wrote to memory of 4240	2808	MsiExec.exe	106
PID 2808 wrote to memory of 4852	2808	MsiExec.exe	107
PID 2808 wrote to memory of 4852	2808	MsiExec.exe	107
PID 2808 wrote to memory of 4852	2808	MsiExec.exe	107
PID 2808 wrote to memory of 440	2808	MsiExec.exe	108
PID 2808 wrote to memory of 440	2808	MsiExec.exe	108
PID 2808 wrote to memory of 440	2808	MsiExec.exe	108
PID 2808 wrote to memory of 1588	2808	MsiExec.exe	109
PID 2808 wrote to memory of 1588	2808	MsiExec.exe	109
PID 2808 wrote to memory of 1588	2808	MsiExec.exe	109
PID 5492 wrote to memory of 5512	5492	javaws.exe	112
PID 5492 wrote to memory of 5512	5492	javaws.exe	112
PID 5492 wrote to memory of 5512	5492	javaws.exe	112
PID 5492 wrote to memory of 5664	5492	javaws.exe	113
PID 5492 wrote to memory of 5664	5492	javaws.exe	113
PID 5492 wrote to memory of 5664	5492	javaws.exe	113
PID 1140 wrote to memory of 1844	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	114
PID 1140 wrote to memory of 1844	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	114
PID 1140 wrote to memory of 1844	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	114
PID 1740 wrote to memory of 2772	1740	965abae8ef3e9859e0e473c5f3cffccf.exe	116
PID 1740 wrote to memory of 2772	1740	965abae8ef3e9859e0e473c5f3cffccf.exe	116
PID 1740 wrote to memory of 2772	1740	965abae8ef3e9859e0e473c5f3cffccf.exe	116
PID 1740 wrote to memory of 3020	1740	965abae8ef3e9859e0e473c5f3cffccf.exe	117
PID 1740 wrote to memory of 3020	1740	965abae8ef3e9859e0e473c5f3cffccf.exe	117
PID 1740 wrote to memory of 3020	1740	965abae8ef3e9859e0e473c5f3cffccf.exe	117
PID 1140 wrote to memory of 3396	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	118
PID 1140 wrote to memory of 3396	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	118
PID 1140 wrote to memory of 3396	1140	965abae8ef3e9859e0e473c5f3cffccf.exe	118

C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
"C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\cscript.exe
  cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
  "C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe" /asService /logPath "C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
    "C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe" /s REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi" REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0 /qn METHOD=joff
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Roaming\Zona\tmp\18467Zona.7z" "C:\PROGRA~2\Zona" "C:\Users\Admin\AppData\Local\Temp\zonaErr_core_-344761486.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:2772
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Roaming\Zona\tmp\6334appdata.7z" "C:\Users\Admin\AppData\Roaming\Zona" "C:\Users\Admin\AppData\Local\Temp\zonaErr_plugin_-344760423.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3020
- C:\Program Files (x86)\Java\jre7\bin\javaw.exe
  "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" ru.megamakc.core.JavaArch
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1844
- C:\Program Files (x86)\Java\jre7\bin\javaw.exe
  "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3396

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 922334B9F8AF25E00E571BB390D5B2C1
  2⤵
  - Loads dropped DLL
  PID:4296
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8C82930F9D6AD5F8CA3ADC2C2FFECF9B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\rt.pack" "C:\Program Files (x86)\Java\jre7\lib\rt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4008
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\charsets.pack" "C:\Program Files (x86)\Java\jre7\lib\charsets.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:3544
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\deploy.pack" "C:\Program Files (x86)\Java\jre7\lib\deploy.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:2720
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\javaws.pack" "C:\Program Files (x86)\Java\jre7\lib\javaws.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3324
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\plugin.pack" "C:\Program Files (x86)\Java\jre7\lib\plugin.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3212
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jsse.pack" "C:\Program Files (x86)\Java\jre7\lib\jsse.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4240
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4852
- - C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
    "C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:440
- - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1588
- - C:\Program Files (x86)\Java\jre7\bin\javaws.exe
    "C:\Program Files (x86)\Java\jre7\bin\javaws.exe" -fix -permissions -silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Program Files (x86)\Java\jre7\bin\javaw.exe
      "C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.JreLocator
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5512
  - - C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe
      "C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW5camF2YXcuZXhl -ma LWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57abf2.rbs

Path C:\Config.Msi\e57abf2.rbs
Size 10KB
SHA256 57e55d33ed9a5af4df3928ba86360e1c2143c509baa61a087d3c7852f2e5355c
MD5 0db6fc6985709fb1b8dd1add36dba11f
SHA1 87b5194f3351a45ce0bdf6c2154c65d5895d4e22
SHA512 52aed07a5ea23a61865efffda3342d129c8a73f5f82b57f7b57348e552aae19adbf71cf8dbb3cb00d7bec756a0bfb30e98d594100d8b2f4bbcd159658d2a7438
SSDEEP 192:ZeXaxCiGdAeeTKOuG0GoTKOuI0eazmZqpPihwba:cXspF/Wh/wJmeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCR100.dll

Path C:\Program Files (x86)\Java\jre7\bin\MSVCR100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsAccessBridge-32.dll

Path C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge-32.dll
Size 95KB
SHA256 4010a3ec604a327861bedf01626c12eaded9d381b6e4f0e6f760895838834a21
MD5 1722510af00ea3c7406681b47bf442f7
SHA1 cafac266d52d78d3743c31ebef22a894781e0de5
SHA512 31a2ce3d5eb9828cbb82d2a7e29f2c5bf46528d38f25827329512cedde37bd03b3cfdba0aba3320b6c0e7779588958e83bff735f6059aad37172598e70e863eb
SSDEEP 1536:wOW8GIF0xqg9Wr0eQPgjiKMQxSo7H0IpSiXk/LPQlswj81NowG0W:zHCxqgA7QPgjiKMvo4IpSi6U6wKKxX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll
Size 3.4MB
SHA256 500d359211ece211cf672de328345876f016fb4a476b2a03cbc3b8b89023ae1f
MD5 27147e1e3faf9b5ccda882cd96f2a85c
SHA1 7103f60121727917f812bfc7cdff5347fc17cc8e
SHA512 0866c604911e243687e7fe721142eb882b19691c902736b59ba304933463d8c9154ecc319b91c9771cee8139e151cc2a2e960bc7a93ed97352cf5232a0964194
SSDEEP 49152:ZrZNQqi9xkS7HU5kf0a5m4mDfhoobdwQC+1F8E9EYm8cBwoHmFOy8CIIaB6wwzmW:7enY5WijhooGh8cGoHm6jvcv/GnUxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

deploy.dll

Path C:\Program Files (x86)\Java\jre7\bin\deploy.dll
Size 371KB
SHA256 352707a271a9ab5d0e190a539b6468d6c6c5ce9675b300acf2305aa1f30625d8
MD5 87ec9d4a00d34eb6a0f8f92e1d1cc08e
SHA1 bee4ecae201905096dd44d1d348ecb3556d90832
SHA512 5b7f9866168ad7948a5a80078b14ff747201d17922ca907072a081e0078f6ac68446ddd36b027b4a17f5afa7d1bb4962642cff28cf66867171ebb78735f242d2
SSDEEP 6144:ZtbYrD6qqtQgirH7/W4/SDMqiJjOBCCMEdvxIW1hN:ZtbYr4tG7/W4/SDMqa4vq+hN
MD5 SHA1 SHA512 SSDEEP

Submit Download

npdeployJava1.dll

Path C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
Size 864KB
SHA256 c029fd3c6ffd2158d0633fc122786838a6f5d3cc7ef78bbe934697015c8c63dd
MD5 bc3a575dfb1a58d35e8617f2966bf1ea
SHA1 6353630f62e246d7f462134e8d10a7a42935e20f
SHA512 c976da30d343f8e104bec72300dc0c17e582e380f0a3ae85b242dbf2d5b40459feb4a3b7789fb8d755b21cbaa0940038d20dbbf1296a48e77b461092abbbe514
SSDEEP 12288:vd4rPQxptuRWuSmOqPsz9YbUOLgsxel3nvb9N3YfG2JmekTvChbOso6CyQJueOdv:F4zWuSDOsz9g1Lgsxq9N3yX4USK
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.dll

Path C:\Program Files (x86)\Java\jre7\bin\java.dll
Size 117KB
SHA256 81ad5696a6fcad89127fc7a428636d431b446ff1ee0c37bf87e8d513a8bae7af
MD5 a258a133f7d565600647a248ab95792c
SHA1 1c6a855ca1fc04413b906b0b17609eff38317161
SHA512 bf9dd97947eb0c71243ae28255af54b06d9e17af7ade666538dd93f9fdf6d8fbc3855f48bfaf6522dbd9ce3c6cff655581f092709670606d033f2321b1f4a5e7
SSDEEP 3072:gnQmO7IlruvLXTYZKj8Jq1YwEyy4YtQNAoTX0D:4h3lKvL0Ztp4K3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files (x86)\Java\jre7\bin\java.exe
Size 171KB
SHA256 c7fd72a0730b377c6da5ac80cdaf5f4cca84cc999a563a4c420fe5a8576810f8
MD5 88651044108e995f9801e35d2582491c
SHA1 abbf404c0253d085223a64ab947e1057c4211c9c
SHA512 486b1d7ad7c3debcb8d70f9351adb08c8321c4cfb409a00ff818be1dacdc376a0eded630ccdc74aa99cc472589b88c9681989076fd78eb109759d33e7bf70543
SSDEEP 3072:KnwrusR90uNHgtMhsaR2fhvTxVwEPEoTBfmabjZqMN7GLi4:wwrusb07tMfRYTxVB8oTBpvqLH
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaw.exe
Size 171KB
SHA256 844ab2231f45fad60d81770ea36d9937da9aa72cd905ce06e7471ddf9d69263b
MD5 64e2bb67ea740860510dcc5c2b6ffa2d
SHA1 6c5996358264624cdb4a075acc4f0b46177cd259
SHA512 ed24331883ada44d8b034f5c8bc458e53234109d5cd02a27989972033f5b3305d23365106ce80be81caa16e472c14c103e457a1e0d138eb0d95036e58d877462
SSDEEP 3072:Yoc9DbDDUaDxmNhrS+eEcbren+W3hYTBfBX0jZqMNSKFg:jc9bDNxmzS+a3entRYTBKvt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files (x86)\Java\jre7\bin\javaws.exe
Size 266KB
SHA256 841339373958786d9c93a7dad5de8fd213ed6b5ad69623f5a5762a453c48e0a5
MD5 2b4493bb1f94580c41def972ea9a887e
SHA1 880ca8b20c6df9a6a176b91cc50304cb0fe66d06
SHA512 b43e54f2c1f3e0a3c3d2fcee518e47d17476bb735606351e41b49e97e10af758ea9a539ac370a2d12cffa93e3e752e829db969968664c59386f65b732c29e40e
SSDEEP 6144:FHNCVyL+Br9XFt6KeorPZufQ4BIGQYqFkNOjvqR7:JNH6rVtdeobZ2IjYqtjv0
MD5 SHA1 SHA512 SSDEEP

Submit Download

unpack200.exe

Path C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
Size 145KB
SHA256 c89091f2a4de2fcf10b30e54a74ec5764e2dfc0577f4f1d879ac8816e3b08bcc
MD5 0d46182b6134aa9c7acd16133d67e4c3
SHA1 7b5be3d65e5e744723bf55a08f9dc1042585d5eb
SHA512 735b6c6bd69b22a71c15ae44c6fa1693700321dc3b4b2367ce05d5c37df62e45d1d3836c2c0f5e44be1036aeb11a533c2a4dbec55163b4a15adfa1c8ef75673b
SSDEEP 1536:orhTuv/39U7QVq15jIS1mlqct2ND8h+8zu17Oq4qnToIflGIO0IOY03Gk5J0X:oGe9FIFIV8/ulphTBflkaY0Wk5J0X
MD5 SHA1 SHA512 SSDEEP

Submit Download

verify.dll

Path C:\Program Files (x86)\Java\jre7\bin\verify.dll
Size 38KB
SHA256 87d8d59972e73700507c07cee8750b0053c6a0899410338722a00c2803d39ee6
MD5 cb89b1d71061f5ec52468528ecc0b1fc
SHA1 6feb23a8b5719c8997de92c7da644807fcba8819
SHA512 2ff0ed38c7f28eb7ea16f24a0841dfb3306c4fec48ded5fddec8c3140f1a425433a444fe6b6cc4c17b3a39841c8ab0c23d7c9525c119c1b9d6daac2c17a4e4b0
SSDEEP 768:gPGXoQMYf5rFV1wleN0gzhSlAHCf4ouRHJrf4t8fnd577Iq5z:gOXJMSrufMNf4wfvIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsdetect.dll

Path C:\Program Files (x86)\Java\jre7\bin\wsdetect.dll
Size 159KB
SHA256 2ef891881d506084ed182a0ac58b10dbe8c45877ef889ac9105f19431beee4ca
MD5 958bc8d82e4d0a5b51536bb4fc4fb6d6
SHA1 626312fa01c72ec5c85c9262ba0ae97a8b1f5b25
SHA512 fe17b58e3eed817619bebf6d091aee99fdc331c9c5a4163e9f5993b41b2e7362365da210e0636755ada6b8838012de1bc5435b8670aa12f378a3c9e3a9f5af04
SSDEEP 3072:gLutxFjfIlYey8KP0+KbMcfyMvc0crTwC7bd2:gLunFzIqey5P0bbVrchrTwC7x2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path C:\Program Files (x86)\Java\jre7\bin\zip.dll
Size 66KB
SHA256 35ce7ab154a38e97951714e17f7689873d89e8c01188de6e5cd741bc0ca3e384
MD5 1ecf056944068b933ba71cda3edc4a68
SHA1 2052b2138db0d9a368942470b41bb6fc5b1d4007
SHA512 cadf312841d392a9970cc068b72063e17454d5e6738b46ec9622257d9dfc0bcad0d9420352752bf7d8f8e8ceaf6aca97d83896f753dc12cfeac3e5efb5e1ab05
SSDEEP 1536:4UH9k47M2axhBBQq8SRlr8IOwIOpVnToIf1QfqPu:zl6u0xymp9TBf1QfqPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

charsets.pack

Path C:\Program Files (x86)\Java\jre7\lib\charsets.pack
Size 1.3MB
SHA256 8ea5af036ec067a0abcf87b8f5921e2281ff9d259e1d4c3bbe7fa9037cd87d02
MD5 549bbcd204914b543dafee670f110834
SHA1 012461935191a55482e8c3d453d245e965a10a2a
SHA512 b0346a2ec52ce47351286f27f347f5fea99e160aedde52bcf74e1629739704bd975c9c99d8db6be3b6bd45e7fa933616fa081eda49e9b911efcc031c7241400e
SSDEEP 12288:QcvuzHfxrXJEmb5yyWMOXpyDy64BqY0qohrn2Wz/n3OEDgsa1dQnBJ4F:QcWTd5EmbmXse/0/n2cn3QF
MD5 SHA1 SHA512 SSDEEP

Submit Download

deploy.pack

Path C:\Program Files (x86)\Java\jre7\lib\deploy.pack
Size 1.7MB
SHA256 928f6b847f94b920c462a08c43f0dfd3f7c40076b1cd60545523a5c27a4870ca
MD5 b2a448112b7c886ccce9b6a3d5efd8a0
SHA1 660bc9efe960015b208a421b1a63443e7151024f
SHA512 871da63f4eaf16d77ba6c19c10d8ddd8e94f744c20a70e24793f837023d20e56698d85f67498bc06ec37b73a8f376c220afbe7f3884b00536b710ff49c339b3f
SSDEEP 24576:zdyq6mG9BvZSL4096jCVKTBtdjM8pOzoAGdoKW0IriN2:zMvO4dFWfic
MD5 SHA1 SHA512 SSDEEP

Submit Download

localedata.pack

Path C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack
Size 736KB
SHA256 da2803a283d28882182e1e280b4f25ee1579a5805e73fcc9882e63968f102a8f
MD5 c8dc1cfeaf0fefc39ed0f1de4eaa175c
SHA1 11cacbb9e5724d37789455de37a225d8e0c648a1
SHA512 6b419ba94ae90f8caa3a57690f2ec7e249c9fb8ab86819439621cde1243c7636ee76820622ce32ed483ce76976f7ced74778898fc2725b1a2407b039fb53508c
SSDEEP 12288:+FFkQLRQjAgM4fIuskrqTYSuGTwj0ehh/k9SoBUaBYu:BpAgXzOcSuUw4eh5iUAv
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.cfg

Path C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg
Size 686B
SHA256 c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88
MD5 5147cce789cd18ad6b2996eb89e5d866
SHA1 756f1fffe96ef581f0d4d47253523544c89a2622
SHA512 55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6
MD5 SHA1 SHA512

Submit Download

invalid32x32.gif

Path C:\Program Files (x86)\Java\jre7\lib\images\cursors\invalid32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
MD5 SHA1 SHA512

Submit Download

javaws.pack

Path C:\Program Files (x86)\Java\jre7\lib\javaws.pack
Size 205KB
SHA256 ee43869ee94eefe241d661101ff6a03cc276f8e558967b1b350ea088f1dad2e2
MD5 491bce42c6cd8af88a2e11f37711ed4f
SHA1 3de7c18fee44465a6afe34e068f2a64dea9fa324
SHA512 1e5f99466b77b5a82c23449434272acf5746811ef96b98105f89b3339ccd86734d7713c94b773755219345d673a761a356fbe846a38e7893bd8894e43cf102e4
SSDEEP 3072:r05V3g4qpeICnbOKxO6kzmioaxOuVhi8kV2MoOGN2jhKuCQ0nAsKu4iCp+vgn43:ruO30OekKioaQ8v29pCQivKXgO43
MD5 SHA1 SHA512 SSDEEP

Submit Download

jfxrt.pack

Path C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack
Size 3.2MB
SHA256 8c481a549acfa58b1bac0385906febe33a928d004a529fec505b6a9228678fed
MD5 dfaa6429468d56ef77932cf26a495f75
SHA1 8a21a29225640f1829ae328a24ef9cb5e215a4e0
SHA512 6c19ed573b111315648de0646441486729b304452c15b2282938460a2339db0be4e1eb19cf6f2bf17f73037811ca2553a15957ea96b9d9af64a93045407c1148
SSDEEP 49152:TIOCux2SzM48f4NCZdfyupJDyQz8YCIN5yOHgNN:BRp0ptz8YCIfHM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsse.pack

Path C:\Program Files (x86)\Java\jre7\lib\jsse.pack
Size 141KB
SHA256 9f031f2f1292bb311c400b0a93a11b78a08f013332b1263ea58617b6548862eb
MD5 31b4d9c29d29567b0ae3037fac9fbdc6
SHA1 8b5d1b1a309177466d71a742414d441f600ea38e
SHA512 b4a8a3a1e837f98a3164e19a6fe939819eb336892335de975822890b52b5923d85fee4c4e5464ccb0d46c847f37f7da98a839aadbf4d20fca355f396a53836c0
SSDEEP 3072:+btJdrAlQMcNuicXy7/Sa1hz3igGCCCCtgXiJTOyV:+RrrAlQMcN3Uy2abQ/Ok
MD5 SHA1 SHA512 SSDEEP

Submit Download

plugin.pack

Path C:\Program Files (x86)\Java\jre7\lib\plugin.pack
Size 489KB
SHA256 93defaaf7f82e2e9565b27dd31a41c89e02d1b7719d0da0b940a55dcc75b91e5
MD5 47d6cfa1b01a6d41885504bbc3b1919a
SHA1 3838060f9d530c972d65f36fa38b265120a218aa
SHA512 b0df9b174624234aaeb2b50cf611f698377925a0ae5c5ee9da46c65fcecf4d28941d1bf2332316d9327981c1f8c6c4fecf750e013f04eef63f5df52d27593135
SSDEEP 6144:pPYDxiUn5kuS7ogVc4r+cWaTu8KPVzsRnVPI6oWnfmoNOz4KMWpeNi+:pgx57IcEvWeSVzpN0OOWcNV
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.pack

Path C:\Program Files (x86)\Java\jre7\lib\rt.pack
Size 13.1MB
SHA256 82dc6806d9ec9eb16604f90a5c78d0d882b69a0e718d8f6c3c6b7c9719887b7e
MD5 b6d75e8c90c79af1579769f10b1e5c88
SHA1 146cb3f05fa161885e8faf079fa2bbd89b5c5b18
SHA512 02cdd0c0d6e71bc09120db2cd3b9471c0176567d92bb74a08c13e82c1d23722eb4afac41583a11dee3fc531fd442754ee0f5cb964898ec036ddd432947996037
SSDEEP 196608:xHWBePZbgggLYJ4329rRizU/ULUh49TXY9o9W:DPZbgggLYJ4m9CehoTo9o9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

GMT

Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT
Size 27B
SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
MD5 7da9aa0de33b521b3399a4ffd4078bdb
SHA1 f188a712f77103d544d4acf91d13dbc664c67034
SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
MD5 SHA1 SHA512

Submit Download

GMT+5

Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+5
Size 27B
SHA256 27ba8b5814833b1e8e8b5d08246b383cb8a5fb7e74e237cdbcadf320e882ab78
MD5 a2abe32f03e019dbd5c21e71cc0f0db9
SHA1 25b042eb931fff4e815adcc2ddce3636debf0ae1
SHA512 197c065b9c17c6849a15f45ac69dafa68aaa0b792219fedb153d146f23997bfa4fbc4127b1d030a92a4d7103bded76a1389df715b9539ea23ea21e6a4bb65fb2
MD5 SHA1 SHA512

Submit Download

HST

Path C:\Program Files (x86)\Java\jre7\lib\zi\HST
Size 27B
SHA256 3144bc5353ebbd941cdccbbd9f5fb5a06f38abf5cc7b672111705c9778412d08
MD5 715dc3fcec7a4b845347b628caf46c84
SHA1 1b194cdd0a0dc5560680c33f19fc2e7c09523cd1
SHA512 72ab4b4ad0990cce0723a882652bf4f37aac09b32a8dd33b56b1fbf25ac56ae054328909efd68c8243e54e449d845fb9d53dd95f47eaaf5873762fcd55a39662
MD5 SHA1 SHA512

Submit Download

MST

Path C:\Program Files (x86)\Java\jre7\lib\zi\MST
Size 27B
SHA256 0e6a7f1ab731ae6840eacc36b37cbe3277a991720a7c779e116ab488e0eeed4e
MD5 11f8e73ad57571383afa5eaf6bc0456a
SHA1 65a736dddd8e9a3f1dd6fbe999b188910b5f7931
SHA512 578665a0897a2c05eda59fb6828f4a9f440fc784059a5f97c8484f164a5fcec95274159c6ff6336f4863b942129cb884110d14c9bd507a2d12d83a4e17f596d2
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 1KB
SHA256 7eda3d7e60a37179b0cc547a45ffc8edafd58bd34f46890ffd80ad824a671acb
MD5 69795e2843a3a2a15df219c756aa9096
SHA1 51fc6847c39591ceb4715f3c8375e16fecd93f9b
SHA512 ed3358ac2d404cda798fac77e7b754088c67e952171c1d4975a28566d4e1a278c2865e981219e9191d64f276438ba6fae62f6f53f61ba2de5e734ddad7cdda21
MD5 SHA1 SHA512

Submit Download

Data1.cab

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\Data1.cab
Size 24.6MB
SHA256 a84262dd486cf59049d0d2d9a1b00dfb5aa5271592edd8de0e052f12496dec67
MD5 003a488a2139105704566b47eb29520d
SHA1 52d672a592cd52ad5e2e7239421f2659e0d17afa
SHA512 ab34061f8e04bb1d59f1b35e0e1848a176f2b119095e79015130da3a4384c70fa35ecbe1625e07c0eb0de49c67bcdbba59f10fa1dfbbb2066dcb6ee6825215de
SSDEEP 393216:S9CUhZsoKK1mWskttt7gAbDvaywLI2tt8wTYP/LQb3044DZkPybune:J2ZsoLm7kttLbfwfmwuf1kqbune
MD5 SHA1 SHA512 SSDEEP

Submit Download

jre1.7.0_80.msi

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi
Size 898KB
SHA256 dbf28e21d55dd662cccf4d422a1a645a6a3dbfd6914942dde417d20c4d2fe01c
MD5 e24d9b483ce7a3a6a4406111883457f7
SHA1 0d5efff0d110c48f5e6f5d438967427f1e2dbf84
SHA512 b614b023ce683e78ee685be028fa06d7df90f10360d55de2a8c1214200b0b85998683502f377b01584bf23b72b168c33ef560a78d7abdf68aa3af87beca59398
SSDEEP 12288:JbSGg983mCR0sY9D4+doy8J5EMPhQmW9K+r:JbS1983zq4LbEI+S+r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 4KB
SHA256 a566c120fe07749007630b60aba7f57cd07ad91a0e07c8f3b5a22a7270a2985a
MD5 fd9c39459b205c1d8863960781bf909f
SHA1 552ecdda856962907bace657f1d7cd32c5d5b20d
SHA512 349767c513eb5a0937af276fb9c90df7cda44adbff20355ec9d94329c349792a95d64d26a4a9f9bb832ac9ea0fe0282ec7d879d39602ed4ba9d19ce1c8a9aaf5
SSDEEP 96:ouEMh6jdN0dlJPjkNKBKvy+6hWFUXkn37vgf7+40:zEMh6jdyd8MBY6hsUUn3dH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 5KB
SHA256 2a5a44a81fdc227e710416ec370038febb6230612a759c3e61fa5fd908ffcb79
MD5 a7a11024e605d6fed36ad8122406e104
SHA1 6a3291a54e675369e4a107188dbd92a415ec8c7b
SHA512 9dde700c70c6ff197bda82e3bc74036d1a7ee58f3f79330cb65eaa1ee9fdf522cc7b87e0f9692a1ac9111dcb0eeb43994861cd545d1ea0c0c620b0d21458af99
SSDEEP 96:ouEMh6jdN0dlJPjkNKBKvy+6hWFUXkn37vgf7+4gE1Cq+I116vjN:zEMh6jdyd8MBY6hsUUn3d8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 1KB
SHA256 7080f4e664cf85dc99af45954fa97045446ac69be5c40e0e4006f17ab6f34dd6
MD5 f893cd9c2c5bb1cbd54941935947df07
SHA1 2a98889dcdde0b2ed51ce25a1ee5e8ca6078f6b8
SHA512 5a72316bace2f91f2b139c74711f543040cf1cfc31990d0a3bdfafff997c7f3c2b873113758c5d33142f333448d655a7c64058e9c5664ce1cece28e523084808
MD5 SHA1 SHA512

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 7KB
SHA256 212862099c6fb3275fa6224053860f856b514185d2b7d725bee8fe966e807995
MD5 97834c258a01b9e204a6c93accd66e7d
SHA1 71bd001bb9e8af08bd78a5c44015e43b064c42bb
SHA512 6d5f99d76cea7727fd2295a90884e872369ddf12f78c34af2129245f7b258573b60f428328e022914e8c2a8934fb19ac16ce9e474a09d8d0b6bbe6b74ef2f0bd
SSDEEP 96:ouEMh6jdN0dlJPjkNKBKvy+6hWFUXkn37vgf7+4gE1Cq+I116vjR+ZZV+q6jU3:zEMh6jdyd8MBY6hsUUn3d8XU9a
MD5 SHA1 SHA512 SSDEEP

Submit Download

hd.vbs

Path C:\Users\Admin\AppData\Local\Temp\hd.vbs
Size 245B
SHA256 4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
MD5 d8682d715a652f994dca50509fd09669
SHA1 bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA512 eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca
MD5 SHA1 SHA512

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 22KB
SHA256 e0e88bda4bcbbcfadb1009060372744f8b3f3628ae29b1d310a99255ec76aa7a
MD5 525bf7f5b63ffd5e86fa3aee92551c21
SHA1 bf3cd939fe57f5076afbd231cb5b1b0ea03ba5d0
SHA512 825d048f8a3eb7ec88bda27eaf34b5c05a9545a12d48d29fc264aeae571fb2b4aa2957cd1b5459d53dc5d18b7968760d47136a6ec099c5612c3a7ab677b24d73
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TP:c8L6gWt4wnAQ7WTb6aotVhP
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 23KB
SHA256 f7468e1cf9cb05006bb7eebf4ce106f98828351ac7d8637486794ba90e5f5bc2
MD5 18f48d6714640435ab93cad409e10070
SHA1 fd33c178274fb08adb77cf5c695ce29ba32417bd
SHA512 632e4957e610ab787ed9a2cf3e8d988acb16e4cfc4d4df9b52682ca54fa4f7fed980b7b5dd69b1c4dd71554894ee5e5199da630b721f3c7403652f923a16dcc1
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXUO:c8L6gWt4wnAQ7WTb6aotVhkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 23KB
SHA256 3532daff57c2b70280ef79edf17af55d108b2d46b88bdbf248fab74db2a43d14
MD5 a2623660c345873243bb8f88145663b5
SHA1 d8cabac7b4057649bb6ca31504719fb0881c7190
SHA512 60dc96479ae28a9011dee7a2e8ff2cb60ab548a6164ba8f5562fcd1cb154362677a68c98c62aa62333ac9812d4ddb3e332957efdbc5acfb5eade18f111c21f6e
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1F:c8L6gWt4wnAQ7WTb6aotVhk2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 24KB
SHA256 1e1a1fcf7c15b8f6019b1696765c696e69a510bb25fd29daa4f8286b206e738a
MD5 e2aaff5f40ba3fbc2df129ed2157dd19
SHA1 8d6b9aeeae45922687e24365cecffdc0e4997f08
SHA512 e1e5a42c4b5bac65b4747b149a694d738fe7e4e7c5398ef564885796e4d9d3cf5ae4ef1cd2066dd6ba24463654c090d79ac84e0f1ad76575155deab8088e6843
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ6:c8L6gWt4wnAQ7WTb6aotVhk2m0
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 25KB
SHA256 648dac2d3607a22d24056d6d29f1e43343c0e812faffa92a381f627cc42789d4
MD5 d2c611a13ec2cd37d228aad0305dc734
SHA1 b7d5dd93fb333c96f9d0c516fc862a1f6dc31ae8
SHA512 5e73bcfaf14e4a45068a74623e9ed39276844efc6269604ea231f1457c5837605e34ebc7fbf106156b0d653c3a0ce90bf0817d09a44a7b268718747506da70d3
SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ5SuR:c8L6gWt4wnAQ7WTb6aotVhk2mzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 a0da062ab80c0dc8d84f51bd76faf53001cd4b48bcbc0ddae6d75e210ea92ccb
MD5 6395ef19c45e81bddd74837a1394acb5
SHA1 92a97d8fa5c76891d0df4b4d9812370ee85859b9
SHA512 5bb7439566d386aa46774e71378284fff75855f2b5971345d54e5142a23a9488a49b1de2a9533d37cb3f33c8d50cc64727daac7c96ca6dd3779144379a068fdb
SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4K:BL6g648Hs6aotE2mzViqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install.log

Path C:\Users\Admin\AppData\Local\Temp\java_install.log
Size 26KB
SHA256 2f0f162f348b4020566418fd30c090fac83883284dde7c163b923f68d0886c69
MD5 cc147c8509b89de26462cd73e51d3df4
SHA1 b37e85f40a18c1832530a760b309799378f7f6a9
SHA512 b8ef88fc7c91371605dc12a6fae41fa576836ad7eecbf728cd78ab5de9b235c221d5f43d2e9f9adc234f6ae5c3e823dd1b213aaa0340aa8d341015ad393a3e93
SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4Jt:BL6g648Hs6aotE2mzViqJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

java_install_reg.log

Path C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
Size 3KB
SHA256 9bf99654183263090ac650e9f691e074a0de278848a0b618df2c074d9fac23e7
MD5 a571a80e3e7f07d8d5318528ffcf057f
SHA1 e3ec23f4b500ff697f327a186c6b7a1d0203d242
SHA512 70db57b8e9aafeaf7fb4e7c7bc4a7b91297b3e5ed7dbe683c63c8191bd98c0a92457d92ee4ee379eca4935c85362cbbfb1bc9fa4a00cc010afec40752d641be4
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 295KB
SHA256 5fb545b43868bd8ba7dc06f544fcfd80b9f56c1cd55977c910165cb1c5886bbb
MD5 e71f82c618f6de2ece3d6db4967c1f92
SHA1 d1599989b68177726b96e5c73a1dcf49c8ec43cf
SHA512 198338f1882aac76f18ba975a1bd0a5ff1566b0d700a1f75820d5d942cecfa31c1148e7b7e0c301146744ce4fd0937f87cdcea7b1adeac9fe513449960cf0302
SSDEEP 3072:XEr5Q59RbuzzI4NZVpt+/pXVG6M77t8nlhSL0o9ZxhUpJCjBL5fdDJ4Bu8VLmj+w:FhGTBv1
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 296KB
SHA256 24792ba08ddf29061a3ffbbebb7f2295b41eb22b9ac02f1f64c9b7c53b728079
MD5 bd04e83d828faf9ff3145153bfb08854
SHA1 9cf40f99467792aae287bc8b4fbadfe59e1c9188
SHA512 6399ec06c729a22e151f4b6f1c7f970adcc8f369e81bd53c921fcfaaf244e66d8bafc282d1cebc86b3119c6cecaa74ad6593f854d1b5a152f61d6ebebb2bb7ea
SSDEEP 3072:XEr5Q59RbuzzI4NZVpt+/pXVG6M77t8nlhSL0o9ZxhUpJCjBL5fdDJ4Bu8VLmj+D:FhGTBvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 295KB
SHA256 6bc4ada4d5ed8c676e0c84d070bf6b1c710dfa214000eeec36f8b06cdb4ae1c0
MD5 bbc3bdd2812b542ab532db58bb1e8daa
SHA1 9f7fe530df2263399f47d091fae41bc00cd877b4
SHA512 1080b98b80d47c18c048e39ea07fac12e55452c76eb9df2a1abe49fbf34a94cae6b62c2c74f032d33d722442d359c8563d09a89a5f5ebf2d82d0b92078c66fcf
SSDEEP 3072:XEr5Q59RbuzzI4NZVpt+/pXVG6M77t8nlhSL0o9ZxhUpJCjBL5fdDJ4Bu8VLmj+c:FhGTBvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

41javaSetup.exe

Path C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
Size 28.1MB
SHA256 a87adf22064e2f7fa6ef64b2513533bf02aa0bf5265670e95b301a79d7ca89d9
MD5 f2fd417b6d5c7ffc501c7632cc811c3e
SHA1 305c1493fca53ab63ba1686c9afdfb65142e59d3
SHA512 289ee902156537e039636722ad5ac8b0592cf5cffda3d03cf22240003627b049382b95db1b24cf6a2f7134b0df93ede65a80a86381fc161b54c84a76ed04458b
SSDEEP 786432:rLJxuM2ZsoLm7kttLbfwfmwuf1kqbunTn:51ktdbGmwut/Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIAD86.tmp

Path C:\Windows\Installer\MSIAD86.tmp
Size 202KB
SHA256 bf4e4c75d148cb412e28a0b4e665919fd5ac6b9aa6bc3fa75401394759218d5e
MD5 9f84d910602183954bed6d9660600783
SHA1 82e3b122dc63e0a333bca531dd16667d5fafbf23
SHA512 09fb450e6c6f22a32d5e06f470070aab17d4973afe307b529093af7fa29ab96b61a89814e4964d005459f8ebb25716134a5e1c41f6ea7d260361b135306544b9
SSDEEP 3072:nCYl9W8fZ2MaPI/K4W7AfchMoCzWNb/sVq5+/DzaRspvh:nHlg8fZ2MfK4dUyoyu/x56u+hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1140-1619-0x0000000000F20000-0x0000000000FAC000-memory.dmp

Download

memory/1140-1748-0x0000000000F20000-0x0000000000FAC000-memory.dmp

Download

memory/1140-75-0x0000000000F20000-0x0000000000FAC000-memory.dmp

Download

memory/1140-0-0x0000000000F20000-0x0000000000FAC000-memory.dmp

Download

memory/1588-865-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/1740-78-0x0000000000F20000-0x0000000000FAC000-memory.dmp

Download

memory/1740-40-0x0000000000F20000-0x0000000000FAC000-memory.dmp

Download

memory/1844-1605-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/2772-1666-0x00000000012B0000-0x00000000012B1000-memory.dmp

Download

memory/2772-1664-0x00000000012B0000-0x00000000012B1000-memory.dmp

Download

memory/3020-1704-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Download

memory/3020-1708-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Download

memory/3396-1739-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download

memory/5512-1487-0x0000000000A70000-0x0000000000A71000-memory.dmp

Download

memory/5512-1465-0x000000003A200000-0x000000003A210000-memory.dmp

Download

memory/5664-1618-0x0000000001240000-0x0000000001241000-memory.dmp

Download

memory/5664-1612-0x0000000001240000-0x0000000001241000-memory.dmp

Download