Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\msiexec.exe	N/A

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\O:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\P:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Q:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\T:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\V:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\A:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\B:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\N:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\S:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\W:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\X:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\K:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\M:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\R:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\U:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Y:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\E:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\G:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\H:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Z:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\I:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\J:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\L:	C:\Windows\system32\msiexec.exe	N/A

Installs/modifies Browser Helper Object

stealer adware

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	C:\Windows\syswow64\MsiExec.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Windows\SysWOW64\javaws.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Windows\SysWOW64\java.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File opened for modification	C:\Windows\SysWOW64\java.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Windows\SysWOW64\javaw.exe	C:\Windows\syswow64\MsiExec.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Petersburg	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Bishkek	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Moscow	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\release	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\PROGRA~2\Zona\License_en.rtf	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\dt_shmem.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Vancouver	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Volgograd	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Kosrae	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\ktab.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\messages_it.properties	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Tripoli	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\deploy.jar	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Chuuk	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Easter	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\jawt.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\content-types.properties	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Swift_Current	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT-7	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Rome	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Niue	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Pangnirtung	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Athens	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\unpack.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\deploy\ffjcext.zip	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\ext\access-bridge.jar	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Barbados	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Guatemala	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Kentucky\Louisville	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Kiev	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Efate	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\Davis	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Almaty	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Choibalsan	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Tokyo	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Madrid	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\README.txt	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\charsets.jar	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
File created	C:\PROGRA~2\Zona\torrent.ico	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\npt.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Guayaquil	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Thule	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Thimphu	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\Bermuda	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Melbourne	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Monaco	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Prague	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\jfxmedia.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\servertool.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Creston	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Inuvik	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Whitehorse	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Riyadh89	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Rarotonga	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\jqs.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Omsk	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Copenhagen	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Zurich	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Reunion	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\glass.dll	C:\Windows\syswow64\MsiExec.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\Installer\e57abef.msi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F03217080FF}	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSIAF1D.tmp	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\e57abef.msi	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\e57abf3.msi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSIB1AE.tmp	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSIAD86.tmp	C:\Windows\system32\msiexec.exe	N/A

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Windows\system32\msiexec.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Windows\system32\msiexec.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "40945820"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	C:\Windows\syswow64\MsiExec.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_50"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0048-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0058-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_58"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_21"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0053-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0081-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0073-ABCDEFFEDCBC}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBC}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0094-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_43"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0069-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0088-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_88"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_37"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_26"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0042-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0014-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_32"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0037-ABCDEFFEDCBA}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0093-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_93"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0004-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0031-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_16"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0041-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_72"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0029-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_29"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBC}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0078-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_23"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_50"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0057-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_29"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_38"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0049-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_10"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_22"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_12"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_14"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_49"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_04"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0091-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0074-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBC}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jfrfile\shell\open\command	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0051-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_51"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0055-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBC}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_37"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_09"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0042-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_42"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.0_01"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\wsdetect.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_04"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeCreateTokenPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeAssignPrimaryTokenPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeMachineAccountPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeTcbPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeCreatePermanentPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSyncAgentPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeEnableDelegationPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeImpersonatePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1140 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Windows\SysWOW64\cscript.exe
PID 1140 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Windows\SysWOW64\cscript.exe
PID 1140 wrote to memory of 1972	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Windows\SysWOW64\cscript.exe
PID 1140 wrote to memory of 1740	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 1140 wrote to memory of 1740	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 1140 wrote to memory of 1740	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 1740 wrote to memory of 4028	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 1740 wrote to memory of 4028	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 1740 wrote to memory of 4028	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 4028 wrote to memory of 4764	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4028 wrote to memory of 4764	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4028 wrote to memory of 4764	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 4956 wrote to memory of 4296	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 4296	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 4296	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 2808	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 2808	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 4956 wrote to memory of 2808	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 2808 wrote to memory of 4008	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 4008	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 4008	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 3544	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 3544	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 3544	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 2720	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 2720	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 2720	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 3324	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 3324	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 3324	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 3212	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 3212	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 3212	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 4240	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 4240	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 4240	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 4852	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 4852	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 4852	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 440	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 440	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 440	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2808 wrote to memory of 1588	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 2808 wrote to memory of 1588	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 2808 wrote to memory of 1588	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 5492 wrote to memory of 5512	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 5492 wrote to memory of 5512	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 5492 wrote to memory of 5512	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 5492 wrote to memory of 5664	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe
PID 5492 wrote to memory of 5664	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe
PID 5492 wrote to memory of 5664	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe
PID 1140 wrote to memory of 1844	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1140 wrote to memory of 1844	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1140 wrote to memory of 1844	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1740 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1740 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1740 wrote to memory of 2772	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1740 wrote to memory of 3020	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1740 wrote to memory of 3020	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1740 wrote to memory of 3020	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1140 wrote to memory of 3396	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1140 wrote to memory of 3396	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PID 1140 wrote to memory of 3396	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Program Files (x86)\Java\jre7\bin\javaw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe

"C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe"

C:\Windows\SysWOW64\cscript.exe

cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs

C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe

"C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe" /asService /logPath "C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log"

C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe

"C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe" /s REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi" REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0 /qn METHOD=joff

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 922334B9F8AF25E00E571BB390D5B2C1

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 8C82930F9D6AD5F8CA3ADC2C2FFECF9B E Global\MSI0000

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\rt.pack" "C:\Program Files (x86)\Java\jre7\lib\rt.jar"

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\charsets.pack" "C:\Program Files (x86)\Java\jre7\lib\charsets.jar"

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\deploy.pack" "C:\Program Files (x86)\Java\jre7\lib\deploy.jar"

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\javaws.pack" "C:\Program Files (x86)\Java\jre7\lib\javaws.jar"

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\plugin.pack" "C:\Program Files (x86)\Java\jre7\lib\plugin.jar"

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jsse.pack" "C:\Program Files (x86)\Java\jre7\lib\jsse.jar"

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar"

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.jar"

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump

C:\Program Files (x86)\Java\jre7\bin\javaws.exe

"C:\Program Files (x86)\Java\jre7\bin\javaws.exe" -fix -permissions -silent

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.JreLocator

C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe

"C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW5camF2YXcuZXhl -ma LWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" ru.megamakc.core.JavaArch

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Roaming\Zona\tmp\18467Zona.7z" "C:\PROGRA~2\Zona" "C:\Users\Admin\AppData\Local\Temp\zonaErr_core_-344761486.log"

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Roaming\Zona\tmp\6334appdata.7z" "C:\Users\Admin\AppData\Roaming\Zona" "C:\Users\Admin\AppData\Local\Temp\zonaErr_plugin_-344760423.log"

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	i3.x8.net	udp
US	8.8.8.8:53	stat.miniload.org	udp
RU	178.218.223.40:80	i3.x8.net	tcp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	71.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	dl.zona.ru	udp
RU	46.254.16.107:80	dl.zona.ru	tcp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	107.16.254.46.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	stat.miniload.org	udp
US	8.8.8.8:53	stat.miniload.org	udp
RU	178.218.223.40:80	i3.x8.net	tcp
US	8.8.8.8:53	javadl-esd-secure.oracle.com	udp
GB	2.22.96.153:443	javadl-esd-secure.oracle.com	tcp
US	8.8.8.8:53	rps-svcs.sun.com	udp
BE	2.17.107.137:80	rps-svcs.sun.com	tcp
US	8.8.8.8:53	153.96.22.2.in-addr.arpa	udp
US	8.8.8.8:53	javadl.oracle.com	udp
GB	2.22.96.153:80	javadl.oracle.com	tcp
GB	2.22.96.153:443	javadl.oracle.com	tcp
US	8.8.8.8:53	137.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	74.19.199.152.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	sjremetrics.java.com	udp
IE	66.235.152.225:443	sjremetrics.java.com	tcp
US	8.8.8.8:53	225.152.235.66.in-addr.arpa	udp
RU	178.218.223.40:80	i3.x8.net	tcp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

memory/1140-0-0x0000000000F20000-0x0000000000FAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	f893cd9c2c5bb1cbd54941935947df07
SHA1	2a98889dcdde0b2ed51ce25a1ee5e8ca6078f6b8
SHA256	7080f4e664cf85dc99af45954fa97045446ac69be5c40e0e4006f17ab6f34dd6
SHA512	5a72316bace2f91f2b139c74711f543040cf1cfc31990d0a3bdfafff997c7f3c2b873113758c5d33142f333448d655a7c64058e9c5664ce1cece28e523084808

C:\Users\Admin\AppData\Local\Temp\hd.vbs

MD5	d8682d715a652f994dca50509fd09669
SHA1	bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA256	4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
SHA512	eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca

memory/1740-40-0x0000000000F20000-0x0000000000FAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	fd9c39459b205c1d8863960781bf909f
SHA1	552ecdda856962907bace657f1d7cd32c5d5b20d
SHA256	a566c120fe07749007630b60aba7f57cd07ad91a0e07c8f3b5a22a7270a2985a
SHA512	349767c513eb5a0937af276fb9c90df7cda44adbff20355ec9d94329c349792a95d64d26a4a9f9bb832ac9ea0fe0282ec7d879d39602ed4ba9d19ce1c8a9aaf5

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	a7a11024e605d6fed36ad8122406e104
SHA1	6a3291a54e675369e4a107188dbd92a415ec8c7b
SHA256	2a5a44a81fdc227e710416ec370038febb6230612a759c3e61fa5fd908ffcb79
SHA512	9dde700c70c6ff197bda82e3bc74036d1a7ee58f3f79330cb65eaa1ee9fdf522cc7b87e0f9692a1ac9111dcb0eeb43994861cd545d1ea0c0c620b0d21458af99

memory/1140-75-0x0000000000F20000-0x0000000000FAC000-memory.dmp

memory/1740-78-0x0000000000F20000-0x0000000000FAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	97834c258a01b9e204a6c93accd66e7d
SHA1	71bd001bb9e8af08bd78a5c44015e43b064c42bb
SHA256	212862099c6fb3275fa6224053860f856b514185d2b7d725bee8fe966e807995
SHA512	6d5f99d76cea7727fd2295a90884e872369ddf12f78c34af2129245f7b258573b60f428328e022914e8c2a8934fb19ac16ce9e474a09d8d0b6bbe6b74ef2f0bd

C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe

MD5	f2fd417b6d5c7ffc501c7632cc811c3e
SHA1	305c1493fca53ab63ba1686c9afdfb65142e59d3
SHA256	a87adf22064e2f7fa6ef64b2513533bf02aa0bf5265670e95b301a79d7ca89d9
SHA512	289ee902156537e039636722ad5ac8b0592cf5cffda3d03cf22240003627b049382b95db1b24cf6a2f7134b0df93ede65a80a86381fc161b54c84a76ed04458b

C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi

MD5	e24d9b483ce7a3a6a4406111883457f7
SHA1	0d5efff0d110c48f5e6f5d438967427f1e2dbf84
SHA256	dbf28e21d55dd662cccf4d422a1a645a6a3dbfd6914942dde417d20c4d2fe01c
SHA512	b614b023ce683e78ee685be028fa06d7df90f10360d55de2a8c1214200b0b85998683502f377b01584bf23b72b168c33ef560a78d7abdf68aa3af87beca59398

C:\Windows\Installer\MSIAD86.tmp

MD5	9f84d910602183954bed6d9660600783
SHA1	82e3b122dc63e0a333bca531dd16667d5fafbf23
SHA256	bf4e4c75d148cb412e28a0b4e665919fd5ac6b9aa6bc3fa75401394759218d5e
SHA512	09fb450e6c6f22a32d5e06f470070aab17d4973afe307b529093af7fa29ab96b61a89814e4964d005459f8ebb25716134a5e1c41f6ea7d260361b135306544b9

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5	e71f82c618f6de2ece3d6db4967c1f92
SHA1	d1599989b68177726b96e5c73a1dcf49c8ec43cf
SHA256	5fb545b43868bd8ba7dc06f544fcfd80b9f56c1cd55977c910165cb1c5886bbb
SHA512	198338f1882aac76f18ba975a1bd0a5ff1566b0d700a1f75820d5d942cecfa31c1148e7b7e0c301146744ce4fd0937f87cdcea7b1adeac9fe513449960cf0302

C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\Data1.cab

MD5	003a488a2139105704566b47eb29520d
SHA1	52d672a592cd52ad5e2e7239421f2659e0d17afa
SHA256	a84262dd486cf59049d0d2d9a1b00dfb5aa5271592edd8de0e052f12496dec67
SHA512	ab34061f8e04bb1d59f1b35e0e1848a176f2b119095e79015130da3a4384c70fa35ecbe1625e07c0eb0de49c67bcdbba59f10fa1dfbbb2066dcb6ee6825215de

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

MD5	0d46182b6134aa9c7acd16133d67e4c3
SHA1	7b5be3d65e5e744723bf55a08f9dc1042585d5eb
SHA256	c89091f2a4de2fcf10b30e54a74ec5764e2dfc0577f4f1d879ac8816e3b08bcc
SHA512	735b6c6bd69b22a71c15ae44c6fa1693700321dc3b4b2367ce05d5c37df62e45d1d3836c2c0f5e44be1036aeb11a533c2a4dbec55163b4a15adfa1c8ef75673b

C:\Program Files (x86)\Java\jre7\bin\MSVCR100.dll

MD5	bf38660a9125935658cfa3e53fdc7d65
SHA1	0b51fb415ec89848f339f8989d323bea722bfd70
SHA256	60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
SHA512	25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

C:\Program Files (x86)\Java\jre7\lib\rt.pack

MD5	b6d75e8c90c79af1579769f10b1e5c88
SHA1	146cb3f05fa161885e8faf079fa2bbd89b5c5b18
SHA256	82dc6806d9ec9eb16604f90a5c78d0d882b69a0e718d8f6c3c6b7c9719887b7e
SHA512	02cdd0c0d6e71bc09120db2cd3b9471c0176567d92bb74a08c13e82c1d23722eb4afac41583a11dee3fc531fd442754ee0f5cb964898ec036ddd432947996037

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	525bf7f5b63ffd5e86fa3aee92551c21
SHA1	bf3cd939fe57f5076afbd231cb5b1b0ea03ba5d0
SHA256	e0e88bda4bcbbcfadb1009060372744f8b3f3628ae29b1d310a99255ec76aa7a
SHA512	825d048f8a3eb7ec88bda27eaf34b5c05a9545a12d48d29fc264aeae571fb2b4aa2957cd1b5459d53dc5d18b7968760d47136a6ec099c5612c3a7ab677b24d73

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	18f48d6714640435ab93cad409e10070
SHA1	fd33c178274fb08adb77cf5c695ce29ba32417bd
SHA256	f7468e1cf9cb05006bb7eebf4ce106f98828351ac7d8637486794ba90e5f5bc2
SHA512	632e4957e610ab787ed9a2cf3e8d988acb16e4cfc4d4df9b52682ca54fa4f7fed980b7b5dd69b1c4dd71554894ee5e5199da630b721f3c7403652f923a16dcc1

C:\Program Files (x86)\Java\jre7\lib\charsets.pack

MD5	549bbcd204914b543dafee670f110834
SHA1	012461935191a55482e8c3d453d245e965a10a2a
SHA256	8ea5af036ec067a0abcf87b8f5921e2281ff9d259e1d4c3bbe7fa9037cd87d02
SHA512	b0346a2ec52ce47351286f27f347f5fea99e160aedde52bcf74e1629739704bd975c9c99d8db6be3b6bd45e7fa933616fa081eda49e9b911efcc031c7241400e

C:\Program Files (x86)\Java\jre7\lib\deploy.pack

MD5	b2a448112b7c886ccce9b6a3d5efd8a0
SHA1	660bc9efe960015b208a421b1a63443e7151024f
SHA256	928f6b847f94b920c462a08c43f0dfd3f7c40076b1cd60545523a5c27a4870ca
SHA512	871da63f4eaf16d77ba6c19c10d8ddd8e94f744c20a70e24793f837023d20e56698d85f67498bc06ec37b73a8f376c220afbe7f3884b00536b710ff49c339b3f

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	a2623660c345873243bb8f88145663b5
SHA1	d8cabac7b4057649bb6ca31504719fb0881c7190
SHA256	3532daff57c2b70280ef79edf17af55d108b2d46b88bdbf248fab74db2a43d14
SHA512	60dc96479ae28a9011dee7a2e8ff2cb60ab548a6164ba8f5562fcd1cb154362677a68c98c62aa62333ac9812d4ddb3e332957efdbc5acfb5eade18f111c21f6e

C:\Program Files (x86)\Java\jre7\lib\plugin.pack

MD5	47d6cfa1b01a6d41885504bbc3b1919a
SHA1	3838060f9d530c972d65f36fa38b265120a218aa
SHA256	93defaaf7f82e2e9565b27dd31a41c89e02d1b7719d0da0b940a55dcc75b91e5
SHA512	b0df9b174624234aaeb2b50cf611f698377925a0ae5c5ee9da46c65fcecf4d28941d1bf2332316d9327981c1f8c6c4fecf750e013f04eef63f5df52d27593135

C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack

MD5	c8dc1cfeaf0fefc39ed0f1de4eaa175c
SHA1	11cacbb9e5724d37789455de37a225d8e0c648a1
SHA256	da2803a283d28882182e1e280b4f25ee1579a5805e73fcc9882e63968f102a8f
SHA512	6b419ba94ae90f8caa3a57690f2ec7e249c9fb8ab86819439621cde1243c7636ee76820622ce32ed483ce76976f7ced74778898fc2725b1a2407b039fb53508c

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	6395ef19c45e81bddd74837a1394acb5
SHA1	92a97d8fa5c76891d0df4b4d9812370ee85859b9
SHA256	a0da062ab80c0dc8d84f51bd76faf53001cd4b48bcbc0ddae6d75e210ea92ccb
SHA512	5bb7439566d386aa46774e71378284fff75855f2b5971345d54e5142a23a9488a49b1de2a9533d37cb3f33c8d50cc64727daac7c96ca6dd3779144379a068fdb

C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack

MD5	dfaa6429468d56ef77932cf26a495f75
SHA1	8a21a29225640f1829ae328a24ef9cb5e215a4e0
SHA256	8c481a549acfa58b1bac0385906febe33a928d004a529fec505b6a9228678fed
SHA512	6c19ed573b111315648de0646441486729b304452c15b2282938460a2339db0be4e1eb19cf6f2bf17f73037811ca2553a15957ea96b9d9af64a93045407c1148

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	cc147c8509b89de26462cd73e51d3df4
SHA1	b37e85f40a18c1832530a760b309799378f7f6a9
SHA256	2f0f162f348b4020566418fd30c090fac83883284dde7c163b923f68d0886c69
SHA512	b8ef88fc7c91371605dc12a6fae41fa576836ad7eecbf728cd78ab5de9b235c221d5f43d2e9f9adc234f6ae5c3e823dd1b213aaa0340aa8d341015ad393a3e93

C:\Program Files (x86)\Java\jre7\lib\jsse.pack

MD5	31b4d9c29d29567b0ae3037fac9fbdc6
SHA1	8b5d1b1a309177466d71a742414d441f600ea38e
SHA256	9f031f2f1292bb311c400b0a93a11b78a08f013332b1263ea58617b6548862eb
SHA512	b4a8a3a1e837f98a3164e19a6fe939819eb336892335de975822890b52b5923d85fee4c4e5464ccb0d46c847f37f7da98a839aadbf4d20fca355f396a53836c0

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5	bbc3bdd2812b542ab532db58bb1e8daa
SHA1	9f7fe530df2263399f47d091fae41bc00cd877b4
SHA256	6bc4ada4d5ed8c676e0c84d070bf6b1c710dfa214000eeec36f8b06cdb4ae1c0
SHA512	1080b98b80d47c18c048e39ea07fac12e55452c76eb9df2a1abe49fbf34a94cae6b62c2c74f032d33d722442d359c8563d09a89a5f5ebf2d82d0b92078c66fcf

C:\Users\Admin\AppData\Local\Temp\java_install_reg.log

MD5	a571a80e3e7f07d8d5318528ffcf057f
SHA1	e3ec23f4b500ff697f327a186c6b7a1d0203d242
SHA256	9bf99654183263090ac650e9f691e074a0de278848a0b618df2c074d9fac23e7
SHA512	70db57b8e9aafeaf7fb4e7c7bc4a7b91297b3e5ed7dbe683c63c8191bd98c0a92457d92ee4ee379eca4935c85362cbbfb1bc9fa4a00cc010afec40752d641be4

C:\Program Files (x86)\Java\jre7\bin\java.exe

MD5	88651044108e995f9801e35d2582491c
SHA1	abbf404c0253d085223a64ab947e1057c4211c9c
SHA256	c7fd72a0730b377c6da5ac80cdaf5f4cca84cc999a563a4c420fe5a8576810f8
SHA512	486b1d7ad7c3debcb8d70f9351adb08c8321c4cfb409a00ff818be1dacdc376a0eded630ccdc74aa99cc472589b88c9681989076fd78eb109759d33e7bf70543

C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll

MD5	27147e1e3faf9b5ccda882cd96f2a85c
SHA1	7103f60121727917f812bfc7cdff5347fc17cc8e
SHA256	500d359211ece211cf672de328345876f016fb4a476b2a03cbc3b8b89023ae1f
SHA512	0866c604911e243687e7fe721142eb882b19691c902736b59ba304933463d8c9154ecc319b91c9771cee8139e151cc2a2e960bc7a93ed97352cf5232a0964194

C:\Program Files (x86)\Java\jre7\bin\java.dll

MD5	a258a133f7d565600647a248ab95792c
SHA1	1c6a855ca1fc04413b906b0b17609eff38317161
SHA256	81ad5696a6fcad89127fc7a428636d431b446ff1ee0c37bf87e8d513a8bae7af
SHA512	bf9dd97947eb0c71243ae28255af54b06d9e17af7ade666538dd93f9fdf6d8fbc3855f48bfaf6522dbd9ce3c6cff655581f092709670606d033f2321b1f4a5e7

C:\Program Files (x86)\Java\jre7\bin\zip.dll

MD5	1ecf056944068b933ba71cda3edc4a68
SHA1	2052b2138db0d9a368942470b41bb6fc5b1d4007
SHA256	35ce7ab154a38e97951714e17f7689873d89e8c01188de6e5cd741bc0ca3e384
SHA512	cadf312841d392a9970cc068b72063e17454d5e6738b46ec9622257d9dfc0bcad0d9420352752bf7d8f8e8ceaf6aca97d83896f753dc12cfeac3e5efb5e1ab05

C:\Program Files (x86)\Java\jre7\bin\verify.dll

MD5	cb89b1d71061f5ec52468528ecc0b1fc
SHA1	6feb23a8b5719c8997de92c7da644807fcba8819
SHA256	87d8d59972e73700507c07cee8750b0053c6a0899410338722a00c2803d39ee6
SHA512	2ff0ed38c7f28eb7ea16f24a0841dfb3306c4fec48ded5fddec8c3140f1a425433a444fe6b6cc4c17b3a39841c8ab0c23d7c9525c119c1b9d6daac2c17a4e4b0

C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg

MD5	5147cce789cd18ad6b2996eb89e5d866
SHA1	756f1fffe96ef581f0d4d47253523544c89a2622
SHA256	c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88
SHA512	55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

MD5	64e2bb67ea740860510dcc5c2b6ffa2d
SHA1	6c5996358264624cdb4a075acc4f0b46177cd259
SHA256	844ab2231f45fad60d81770ea36d9937da9aa72cd905ce06e7471ddf9d69263b
SHA512	ed24331883ada44d8b034f5c8bc458e53234109d5cd02a27989972033f5b3305d23365106ce80be81caa16e472c14c103e457a1e0d138eb0d95036e58d877462

memory/1588-865-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	d2c611a13ec2cd37d228aad0305dc734
SHA1	b7d5dd93fb333c96f9d0c516fc862a1f6dc31ae8
SHA256	648dac2d3607a22d24056d6d29f1e43343c0e812faffa92a381f627cc42789d4
SHA512	5e73bcfaf14e4a45068a74623e9ed39276844efc6269604ea231f1457c5837605e34ebc7fbf106156b0d653c3a0ce90bf0817d09a44a7b268718747506da70d3

C:\Program Files (x86)\Java\jre7\lib\javaws.pack

MD5	491bce42c6cd8af88a2e11f37711ed4f
SHA1	3de7c18fee44465a6afe34e068f2a64dea9fa324
SHA256	ee43869ee94eefe241d661101ff6a03cc276f8e558967b1b350ea088f1dad2e2
SHA512	1e5f99466b77b5a82c23449434272acf5746811ef96b98105f89b3339ccd86734d7713c94b773755219345d673a761a356fbe846a38e7893bd8894e43cf102e4

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	e2aaff5f40ba3fbc2df129ed2157dd19
SHA1	8d6b9aeeae45922687e24365cecffdc0e4997f08
SHA256	1e1a1fcf7c15b8f6019b1696765c696e69a510bb25fd29daa4f8286b206e738a
SHA512	e1e5a42c4b5bac65b4747b149a694d738fe7e4e7c5398ef564885796e4d9d3cf5ae4ef1cd2066dd6ba24463654c090d79ac84e0f1ad76575155deab8088e6843

C:\Program Files (x86)\Java\jre7\bin\deploy.dll

MD5	87ec9d4a00d34eb6a0f8f92e1d1cc08e
SHA1	bee4ecae201905096dd44d1d348ecb3556d90832
SHA256	352707a271a9ab5d0e190a539b6468d6c6c5ce9675b300acf2305aa1f30625d8
SHA512	5b7f9866168ad7948a5a80078b14ff747201d17922ca907072a081e0078f6ac68446ddd36b027b4a17f5afa7d1bb4962642cff28cf66867171ebb78735f242d2

C:\Program Files (x86)\Java\jre7\lib\images\cursors\invalid32x32.gif

MD5	1e9d8f133a442da6b0c74d49bc84a341
SHA1	259edc45b4569427e8319895a444f4295d54348f
SHA256	1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA512	63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

C:\Program Files (x86)\Java\jre7\bin\wsdetect.dll

MD5	958bc8d82e4d0a5b51536bb4fc4fb6d6
SHA1	626312fa01c72ec5c85c9262ba0ae97a8b1f5b25
SHA256	2ef891881d506084ed182a0ac58b10dbe8c45877ef889ac9105f19431beee4ca
SHA512	fe17b58e3eed817619bebf6d091aee99fdc331c9c5a4163e9f5993b41b2e7362365da210e0636755ada6b8838012de1bc5435b8670aa12f378a3c9e3a9f5af04

C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge-32.dll

MD5	1722510af00ea3c7406681b47bf442f7
SHA1	cafac266d52d78d3743c31ebef22a894781e0de5
SHA256	4010a3ec604a327861bedf01626c12eaded9d381b6e4f0e6f760895838834a21
SHA512	31a2ce3d5eb9828cbb82d2a7e29f2c5bf46528d38f25827329512cedde37bd03b3cfdba0aba3320b6c0e7779588958e83bff735f6059aad37172598e70e863eb

C:\Program Files (x86)\Java\jre7\lib\zi\MST

MD5	11f8e73ad57571383afa5eaf6bc0456a
SHA1	65a736dddd8e9a3f1dd6fbe999b188910b5f7931
SHA256	0e6a7f1ab731ae6840eacc36b37cbe3277a991720a7c779e116ab488e0eeed4e
SHA512	578665a0897a2c05eda59fb6828f4a9f440fc784059a5f97c8484f164a5fcec95274159c6ff6336f4863b942129cb884110d14c9bd507a2d12d83a4e17f596d2

C:\Program Files (x86)\Java\jre7\lib\zi\HST

MD5	715dc3fcec7a4b845347b628caf46c84
SHA1	1b194cdd0a0dc5560680c33f19fc2e7c09523cd1
SHA256	3144bc5353ebbd941cdccbbd9f5fb5a06f38abf5cc7b672111705c9778412d08
SHA512	72ab4b4ad0990cce0723a882652bf4f37aac09b32a8dd33b56b1fbf25ac56ae054328909efd68c8243e54e449d845fb9d53dd95f47eaaf5873762fcd55a39662

C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+5

MD5	a2abe32f03e019dbd5c21e71cc0f0db9
SHA1	25b042eb931fff4e815adcc2ddce3636debf0ae1
SHA256	27ba8b5814833b1e8e8b5d08246b383cb8a5fb7e74e237cdbcadf320e882ab78
SHA512	197c065b9c17c6849a15f45ac69dafa68aaa0b792219fedb153d146f23997bfa4fbc4127b1d030a92a4d7103bded76a1389df715b9539ea23ea21e6a4bb65fb2

C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT

MD5	7da9aa0de33b521b3399a4ffd4078bdb
SHA1	f188a712f77103d544d4acf91d13dbc664c67034
SHA256	0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
SHA512	9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6

C:\Program Files (x86)\Java\jre7\bin\javaws.exe

MD5	2b4493bb1f94580c41def972ea9a887e
SHA1	880ca8b20c6df9a6a176b91cc50304cb0fe66d06
SHA256	841339373958786d9c93a7dad5de8fd213ed6b5ad69623f5a5762a453c48e0a5
SHA512	b43e54f2c1f3e0a3c3d2fcee518e47d17476bb735606351e41b49e97e10af758ea9a539ac370a2d12cffa93e3e752e829db969968664c59386f65b732c29e40e

C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll

MD5	bc3a575dfb1a58d35e8617f2966bf1ea
SHA1	6353630f62e246d7f462134e8d10a7a42935e20f
SHA256	c029fd3c6ffd2158d0633fc122786838a6f5d3cc7ef78bbe934697015c8c63dd
SHA512	c976da30d343f8e104bec72300dc0c17e582e380f0a3ae85b242dbf2d5b40459feb4a3b7789fb8d755b21cbaa0940038d20dbbf1296a48e77b461092abbbe514

memory/5512-1465-0x000000003A200000-0x000000003A210000-memory.dmp

memory/5512-1487-0x0000000000A70000-0x0000000000A71000-memory.dmp

C:\Config.Msi\e57abf2.rbs

MD5	0db6fc6985709fb1b8dd1add36dba11f
SHA1	87b5194f3351a45ce0bdf6c2154c65d5895d4e22
SHA256	57e55d33ed9a5af4df3928ba86360e1c2143c509baa61a087d3c7852f2e5355c
SHA512	52aed07a5ea23a61865efffda3342d129c8a73f5f82b57f7b57348e552aae19adbf71cf8dbb3cb00d7bec756a0bfb30e98d594100d8b2f4bbcd159658d2a7438

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5	bd04e83d828faf9ff3145153bfb08854
SHA1	9cf40f99467792aae287bc8b4fbadfe59e1c9188
SHA256	24792ba08ddf29061a3ffbbebb7f2295b41eb22b9ac02f1f64c9b7c53b728079
SHA512	6399ec06c729a22e151f4b6f1c7f970adcc8f369e81bd53c921fcfaaf244e66d8bafc282d1cebc86b3119c6cecaa74ad6593f854d1b5a152f61d6ebebb2bb7ea

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

MD5	69795e2843a3a2a15df219c756aa9096
SHA1	51fc6847c39591ceb4715f3c8375e16fecd93f9b
SHA256	7eda3d7e60a37179b0cc547a45ffc8edafd58bd34f46890ffd80ad824a671acb
SHA512	ed3358ac2d404cda798fac77e7b754088c67e952171c1d4975a28566d4e1a278c2865e981219e9191d64f276438ba6fae62f6f53f61ba2de5e734ddad7cdda21

memory/1844-1605-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

memory/5664-1612-0x0000000001240000-0x0000000001241000-memory.dmp

memory/5664-1618-0x0000000001240000-0x0000000001241000-memory.dmp

memory/1140-1619-0x0000000000F20000-0x0000000000FAC000-memory.dmp

memory/2772-1664-0x00000000012B0000-0x00000000012B1000-memory.dmp

memory/2772-1666-0x00000000012B0000-0x00000000012B1000-memory.dmp

memory/3020-1704-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

memory/3020-1708-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

memory/3396-1739-0x0000000002E40000-0x0000000002E41000-memory.dmp

memory/1140-1748-0x0000000000F20000-0x0000000000FAC000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-06 02:48

Reported

2024-06-06 02:50

Platform

win7-20240221-en

Max time kernel

142s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe"

Signatures

Downloads MZ/PE file

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\javaws.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Windows\syswow64\MsiExec.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	N/A

Registers COM server for autorun

persistence

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0043-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0054-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0074-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0031-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0055-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0092-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0040-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0079-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0060-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0074-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0016-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0055-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0084-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0068-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0061-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0057-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0060-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0075-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0083-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0061-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""	C:\Windows\system32\msiexec.exe	N/A

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\msiexec.exe	N/A
N/A	N/A	C:\Windows\system32\msiexec.exe	N/A
N/A	N/A	C:\Windows\system32\msiexec.exe	N/A

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\A:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\J:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\N:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\O:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\R:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\V:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\W:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\X:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\B:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\H:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\K:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\P:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Q:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\S:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\T:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\E:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Y:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\Z:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\G:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\I:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\L:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\M:	C:\Windows\system32\msiexec.exe	N/A
File opened (read-only)	\??\U:	C:\Windows\system32\msiexec.exe	N/A

Installs/modifies Browser Helper Object

stealer adware

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	C:\Windows\syswow64\MsiExec.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\SysWOW64\java.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File opened for modification	C:\Windows\SysWOW64\java.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Windows\SysWOW64\javaw.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Windows\SysWOW64\javaws.exe	C:\Windows\syswow64\MsiExec.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files (x86)\Java\jre7\bin\fxplugins.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Magadan	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Madrid	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Zaporozhye	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Tehran	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\Madeira	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Athens	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\GMT	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Rarotonga	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\orbd.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\Jujuy	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Merida	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Pago_Pago	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\fontconfig.bfc	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Winamac	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Singapore	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\CST6CDT	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\YST9YDT	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\jsoundds.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\Syowa	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\EET	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Swift_Current	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Toronto	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Samarkand	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Chatham	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Tripoli	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Vincennes	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Yakutat	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\EST5EDT	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Havana	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Dili	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Sydney	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\EST5	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\keytool.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\npoji610.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Copenhagen	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\jfr.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\security\blacklist	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Chagos	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Kerguelen	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\MST	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\PROGRA~2\Zona\Zona.jar	C:\Program Files (x86)\Java\jre7\bin\javaw.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\rmid.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\cmm\PYCC.pf	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Guyana	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Saipan	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\pack200.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Godthab	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Aqtau	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\jpicom.dll	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\psfontj2d.properties	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Anchorage	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Colombo	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Helsinki	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\America\Yellowknife	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Omsk	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\patchjre.exe	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\javacpl.exe	C:\Windows\syswow64\MsiExec.exe	N/A
File created	C:\Program Files (x86)\Java\jre7\bin\jpinscp.dll	C:\Windows\syswow64\MsiExec.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\Installer\f777790.msi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSI8BE8.tmp	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\f777796.msi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\f777796.msi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSID839.tmp	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\f777790.msi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSI8061.tmp	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSI8300.tmp	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSID682.tmp	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\f77779b.msi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\f777799.ipi	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\f777793.ipi	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\f777795.msi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\f777793.ipi	C:\Windows\system32\msiexec.exe	N/A
File opened for modification	C:\Windows\Installer\MSID088.tmp	C:\Windows\system32\msiexec.exe	N/A
File created	C:\Windows\Installer\f777799.ipi	C:\Windows\system32\msiexec.exe	N/A

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Windows\system32\msiexec.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Windows\system32\msiexec.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "37210456"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	C:\Windows\syswow64\MsiExec.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	C:\Windows\system32\msiexec.exe	N/A
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	C:\Windows\system32\msiexec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	C:\Windows\system32\msiexec.exe	N/A
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	C:\Windows\system32\msiexec.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	C:\Windows\system32\msiexec.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_02"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0042-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0054-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_47"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_27"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0074-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_74"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0047-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_47"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0041-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_23"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_30"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0055-ABCDEFFEDCBA}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0079-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0061-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0046-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_46"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0087-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_08"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0033-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_33"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0036-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/java-deployment-toolkit	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBC}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0026-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0092-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0065-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0081-ABCDEFFEDCBA}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_60"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBB}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0080-ABCDEFFEDCBB}	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBA}	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_22"	C:\Windows\syswow64\MsiExec.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_01"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_27"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF230120708FF\InstanceType = "0"	C:\Windows\system32\msiexec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-0073-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\syswow64\MsiExec.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A
N/A	N/A	C:\Windows\system32\msiexec.exe	N/A
N/A	N/A	C:\Windows\system32\msiexec.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeCreateTokenPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeAssignPrimaryTokenPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeMachineAccountPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeTcbPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeCreatePermanentPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeSyncAgentPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeEnableDelegationPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeImpersonatePrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Windows\SysWOW64\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\msiexec.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1152 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Windows\SysWOW64\cscript.exe
PID 1152 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Windows\SysWOW64\cscript.exe
PID 1152 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Windows\SysWOW64\cscript.exe
PID 1152 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Windows\SysWOW64\cscript.exe
PID 1152 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 1152 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 1152 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 1152 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 1152 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 1152 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 1152 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe
PID 2580 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 2580 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 2580 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 2580 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 2580 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 2580 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 2580 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe
PID 2684 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2684 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2684 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2684 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2684 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2684 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 2684 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe	C:\Windows\SysWOW64\msiexec.exe
PID 1808 wrote to memory of 804	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 804	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 804	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 804	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 804	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 804	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 804	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 2000	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 2000	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 2000	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 2000	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 2000	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 2000	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 1808 wrote to memory of 2000	N/A	C:\Windows\system32\msiexec.exe	C:\Windows\syswow64\MsiExec.exe
PID 2000 wrote to memory of 2812	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2812	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2812	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2812	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2836	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2836	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2836	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2836	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2536	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2536	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2536	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2536	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2504	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2504	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2504	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2504	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2552	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2552	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2552	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2552	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2692	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2692	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2692	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2692	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
PID 2000 wrote to memory of 2868	N/A	C:\Windows\syswow64\MsiExec.exe	C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

Processes

C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe

"C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe"

C:\Windows\SysWOW64\cscript.exe

cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs

C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe

"C:\Users\Admin\AppData\Local\Temp\965abae8ef3e9859e0e473c5f3cffccf.exe" /asService /logPath "C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log"

C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe

"C:\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe" /s REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi" REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0 /qn METHOD=joff

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 718151F427BA00C9D9D9DFDED0712920

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C15E2703F8348524DFE9A19F32525CC8 M Global\MSI0000

C:\Program Files (x86)\Java\jre7\bin\unpack200.exe

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump

C:\Program Files (x86)\Java\jre7\bin\javaws.exe

"C:\Program Files (x86)\Java\jre7\bin\javaws.exe" -fix -permissions -silent

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.JreLocator

C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\AU\au.msi" ALLUSERS=1 /qn

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding B129561531841CA7ADFC84C0A4FDCA57

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.7.0_80-b15

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" ru.megamakc.core.JavaArch

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Roaming\Zona\tmp\6334appdata.7z" "C:\Users\Admin\AppData\Roaming\Zona" "C:\Users\Admin\AppData\Local\Temp\zonaErr_plugin_-344709098.log"

C:\Program Files (x86)\Java\jre7\bin\javaw.exe

"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	stat.miniload.org	udp
US	8.8.8.8:53	dl.zona.ru	udp
US	8.8.8.8:53	i3.x8.net	udp
RU	178.218.223.40:80	i3.x8.net	tcp
RU	46.254.16.107:80	dl.zona.ru	tcp
RU	178.218.223.40:80	i3.x8.net	tcp
US	8.8.8.8:53	javadl-esd-secure.oracle.com	udp
GB	2.22.96.153:443	javadl-esd-secure.oracle.com	tcp
US	8.8.8.8:53	rps-svcs.sun.com	udp
BE	2.17.107.137:80	rps-svcs.sun.com	tcp
US	8.8.8.8:53	javadl.oracle.com	udp
GB	2.22.96.153:80	javadl.oracle.com	tcp
GB	2.22.96.153:443	javadl.oracle.com	tcp
RU	178.218.223.40:80	i3.x8.net	tcp
US	8.8.8.8:53	sjremetrics.java.com	udp
IE	66.235.152.156:443	sjremetrics.java.com	tcp

Files

memory/1152-0-0x0000000000310000-0x000000000039C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	6142f14ff715a92bb18ac4b7b7c6db76
SHA1	d02fcf5249efd171614b23f4852957bfa44997f1
SHA256	e3c0f06ede069d436921deff3fb5419d753b7f223d534390abd67c3649bd98ce
SHA512	1d936420f89a0df616f4756b5ef50e4066968097a3f2e157e72e5b288b68f9734a41b1c944cd150a6aadafd1550b533408ebda1c45b0f6985114b274e2b62cac

C:\Users\Admin\AppData\Local\Temp\hd.vbs

MD5	d8682d715a652f994dca50509fd09669
SHA1	bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA256	4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
SHA512	eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca

memory/1152-38-0x0000000003910000-0x000000000399C000-memory.dmp

memory/2580-39-0x0000000000310000-0x000000000039C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	07997650b839db20a66ed1478d02eac0
SHA1	3786f8a83721fe3c7c8150bdc5385f25ebc5a595
SHA256	7fbed84f136ddcee2bef7ddb95561ab61c8e9d43e6ee01e111194bb3237fff96
SHA512	db2458fc38bc6312480e062438fb3b6527eea3ac56709bcb627c376a64ce35315d3e7e39f2e87e29d0e210120fb1a93388bda8a7ace440868d1eea0df7245ad5

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	6e36c78342721340ebdc6dc0b033faf8
SHA1	1d026177af4efd0e6e349bcde561e72612e6e332
SHA256	ff1e05df6c8d62fc07057a579faaad84ece4bae46cf603b826789032c94a0a09
SHA512	5a000c422f5d3bcd79d9cdcd014a1f4d0a83c8ccb9c5f6d26b38fb97a0487d85d75c2b5024a6ee49e0882b980120606b969ffaa8401e5d24fe0b64832904b797

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	0d80794e30c54b8fab78e9181122d436
SHA1	1fe936e91721ce0b257de6ae31a71b2210b2dce1
SHA256	e901fadbfa00e0634a45f428be596b906cc3e4982b5d00f89454b4bd7d0a4190
SHA512	f9164487398cf79403128ce836cfeccaea3a980d1cbe3431dffae5f2de3cbdfdf0837c3ebfc4824257ac2af9152c0afc4e3d0e3792a701fc31630dc4504bdf7b

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	95be5addc7efe7f66764df9780a05061
SHA1	0825f1312a4165cfb0ca421f50e6b90d4499aa8f
SHA256	bb9e8dc468b5791e55306506723189d84a6842a43d9f26e0b1894b614fd01ec8
SHA512	3bd0501d2f5f4679c9ee73abb5e1f740e6e608f52be52d49140891bbdd0a29d73c2add3d2f0b048c4590464a24cb13aae85d0b361d7d922dc5a8c3079db5dd15

memory/1152-76-0x0000000000310000-0x000000000039C000-memory.dmp

memory/2580-77-0x0000000000310000-0x000000000039C000-memory.dmp

memory/1152-83-0x0000000003910000-0x000000000399C000-memory.dmp

memory/1152-85-0x0000000003910000-0x000000000399C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log

MD5	685a158a1e26052385ef62a87ffea31b
SHA1	33788e33ee9a7151344100be5717ea39c0e335a5
SHA256	870c48eeed953ae34b65e2cf96cd38d15056a8d2c7863e862960d69363d6d1fe
SHA512	92675437f1f0bc3e65164392b41ceeb8610c96161a1fc6b8d7f5dc3dad4a9ad2ac70597545f32553d34748d3bd2c618ad72a342a0d046e708c7dba38a8636f56

\Users\Admin\AppData\Roaming\Zona\tmp\41javaSetup.exe

MD5	f2fd417b6d5c7ffc501c7632cc811c3e
SHA1	305c1493fca53ab63ba1686c9afdfb65142e59d3
SHA256	a87adf22064e2f7fa6ef64b2513533bf02aa0bf5265670e95b301a79d7ca89d9
SHA512	289ee902156537e039636722ad5ac8b0592cf5cffda3d03cf22240003627b049382b95db1b24cf6a2f7134b0df93ede65a80a86381fc161b54c84a76ed04458b

C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi

MD5	e24d9b483ce7a3a6a4406111883457f7
SHA1	0d5efff0d110c48f5e6f5d438967427f1e2dbf84
SHA256	dbf28e21d55dd662cccf4d422a1a645a6a3dbfd6914942dde417d20c4d2fe01c
SHA512	b614b023ce683e78ee685be028fa06d7df90f10360d55de2a8c1214200b0b85998683502f377b01584bf23b72b168c33ef560a78d7abdf68aa3af87beca59398

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	df084e3d5e156323aeb47339f8854fea
SHA1	68eda134dcc33d11d5805295d471a1e4af50ac45
SHA256	aca7b8dd3601552590cc25ea712db6c6be00835b5f2dc665b8779e37c2eda216
SHA512	d0c4c58163b64d9c26cd295e040bf7681fb8407991d6493084581f2283033fd90fa8d960fe517b6aa64c452a9cc56d2912ec230db0c5de75aac53a1a3a0f2260

C:\Users\Admin\AppData\Local\Temp\Cab7A1F.tmp

MD5	ac05d27423a85adc1622c714f2cb6184
SHA1	b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256	c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512	6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	49aebf8cbd62d92ac215b2923fb1b9f5
SHA1	1723be06719828dda65ad804298d0431f6aff976
SHA256	b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512	bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar7C48.tmp

MD5	4ea6026cf93ec6338144661bf1202cd1
SHA1	a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256	8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512	6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Windows\Installer\MSI8061.tmp

MD5	9f84d910602183954bed6d9660600783
SHA1	82e3b122dc63e0a333bca531dd16667d5fafbf23
SHA256	bf4e4c75d148cb412e28a0b4e665919fd5ac6b9aa6bc3fa75401394759218d5e
SHA512	09fb450e6c6f22a32d5e06f470070aab17d4973afe307b529093af7fa29ab96b61a89814e4964d005459f8ebb25716134a5e1c41f6ea7d260361b135306544b9

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5	ef4002d78f592e70722c015f85fbcfa1
SHA1	24fd3eb3d3fbe1e37caff8cebb5ebab6786fdbbb
SHA256	2406ed5e6bffe41c97c72016332ed0a746d7dc590b98046ce21169dce298f32d
SHA512	72d8cd3743b976d316c7afabfb6f3889a488565b9c7df24cbd7a25f11478d93c9a0d629fce748ec6149bf41cfd27aa1944c7a96012f475bd6bd41c96eaecfeaf

C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\Data1.cab

MD5	003a488a2139105704566b47eb29520d
SHA1	52d672a592cd52ad5e2e7239421f2659e0d17afa
SHA256	a84262dd486cf59049d0d2d9a1b00dfb5aa5271592edd8de0e052f12496dec67
SHA512	ab34061f8e04bb1d59f1b35e0e1848a176f2b119095e79015130da3a4384c70fa35ecbe1625e07c0eb0de49c67bcdbba59f10fa1dfbbb2066dcb6ee6825215de

\Program Files (x86)\Java\jre7\bin\unpack200.exe

MD5	0d46182b6134aa9c7acd16133d67e4c3
SHA1	7b5be3d65e5e744723bf55a08f9dc1042585d5eb
SHA256	c89091f2a4de2fcf10b30e54a74ec5764e2dfc0577f4f1d879ac8816e3b08bcc
SHA512	735b6c6bd69b22a71c15ae44c6fa1693700321dc3b4b2367ce05d5c37df62e45d1d3836c2c0f5e44be1036aeb11a533c2a4dbec55163b4a15adfa1c8ef75673b

C:\Program Files (x86)\Java\jre7\lib\rt.pack

MD5	b6d75e8c90c79af1579769f10b1e5c88
SHA1	146cb3f05fa161885e8faf079fa2bbd89b5c5b18
SHA256	82dc6806d9ec9eb16604f90a5c78d0d882b69a0e718d8f6c3c6b7c9719887b7e
SHA512	02cdd0c0d6e71bc09120db2cd3b9471c0176567d92bb74a08c13e82c1d23722eb4afac41583a11dee3fc531fd442754ee0f5cb964898ec036ddd432947996037

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	6a86e8d216a77baa9084e18e231204a6
SHA1	6c1e488a58c0776519fb5eb4161d0f929aecb188
SHA256	49c96e06d4d875bd04d6dba41567347e0ca43f712b54dfcb240bbf8da12506d3
SHA512	6c4dddca4bcad858ff042a9f15da6226cf8c4a7c84215a1cba8b6625ef192d74451fb11a9ceb6c5a6450b71fec24c69d404505717c008c9009ca8e0a8a57c37e

\Program Files (x86)\Java\jre7\bin\msvcr100.dll

MD5	bf38660a9125935658cfa3e53fdc7d65
SHA1	0b51fb415ec89848f339f8989d323bea722bfd70
SHA256	60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
SHA512	25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	5da1b3686b8239c4278b11288b0b441d
SHA1	fde3ebc5be1347693b9a66877f78d40929383ff8
SHA256	c2e1e432f32ceaef9be282ed1216275604f03a9fc514781161eaa89c32046f56
SHA512	a5a118bc340169f36c7b69a1d5e20b23be6132be6926664d67839357c40ac7a9337014a9aa570b72f3f3ce816a3b003915516effb764ac00f3959a75a9d05b1d

C:\Program Files (x86)\Java\jre7\lib\charsets.pack

MD5	549bbcd204914b543dafee670f110834
SHA1	012461935191a55482e8c3d453d245e965a10a2a
SHA256	8ea5af036ec067a0abcf87b8f5921e2281ff9d259e1d4c3bbe7fa9037cd87d02
SHA512	b0346a2ec52ce47351286f27f347f5fea99e160aedde52bcf74e1629739704bd975c9c99d8db6be3b6bd45e7fa933616fa081eda49e9b911efcc031c7241400e

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	a4a7a1bb494c3808f6c61b7a016b0e1b
SHA1	78c93a6cb226ae9fec29eb5727737b88457c09ad
SHA256	415da94b6e737947ad017a683a71fa1ab41229ae062f46e18ad8b427dc63b6b9
SHA512	9cf5f993f137024edfe2c35186beaffd891cfc8122d527a95cc42eb098026766ae35f2c53625f50b4821f54b055f21dbe99e6da3dc4c08ffa49419b58553be93

C:\Program Files (x86)\Java\jre7\lib\deploy.pack

MD5	b2a448112b7c886ccce9b6a3d5efd8a0
SHA1	660bc9efe960015b208a421b1a63443e7151024f
SHA256	928f6b847f94b920c462a08c43f0dfd3f7c40076b1cd60545523a5c27a4870ca
SHA512	871da63f4eaf16d77ba6c19c10d8ddd8e94f744c20a70e24793f837023d20e56698d85f67498bc06ec37b73a8f376c220afbe7f3884b00536b710ff49c339b3f

C:\Users\Admin\AppData\Local\Temp\java_install_reg.log

MD5	b8fb107bd13db98220f268c8934f9966
SHA1	9ae449edd077dbe9fc765619a318359a03284b18
SHA256	54319cb0aa82dc67dffada8af6e5fdb235b0c27575f4c7ddfe7a6f834243d3eb
SHA512	af996421da8f6655c62693db73770777b981334e368c0a288b8e7ba5dc20577adc7605336cb0a1d65ae41f0e4cae09e572ccf657c9c35aed679b0ccf17e1941d

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	a256804cf7979b72a2e05766cdc6e6a4
SHA1	7318c80b4ff40c397a27cd2fce6c157bea503be6
SHA256	0ce92642049b8d6cd1925f5697eb4fd699594fc329d590fb482f9430a449c4a5
SHA512	8c8fd367f8e990ae1d291b66ae34efd76dc547e53d3e80b334ce00fc05a703c9a4316025426363106f614ecf64567bb98b918ab019ed084ba47e06f634c397f8

C:\Program Files (x86)\Java\jre7\lib\javaws.pack

MD5	491bce42c6cd8af88a2e11f37711ed4f
SHA1	3de7c18fee44465a6afe34e068f2a64dea9fa324
SHA256	ee43869ee94eefe241d661101ff6a03cc276f8e558967b1b350ea088f1dad2e2
SHA512	1e5f99466b77b5a82c23449434272acf5746811ef96b98105f89b3339ccd86734d7713c94b773755219345d673a761a356fbe846a38e7893bd8894e43cf102e4

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	95b6db47d83e1c43fe0a6dfa89b6cf4c
SHA1	ce67c5f379dca2775815dba04875bee40dcc8c14
SHA256	c3fccdfe60a45a816f9389a8ed5678862bb151d10d58d5ed7275a7d0e3714388
SHA512	4c9df5f9d618bb0d6827ff187b0f7ba1bc7b17fb34635a84a37353837b5afc6c0c4ff0c913608edb6ec478c540d79084fe2aaa15f45628ab4a53938a223dbbe6

C:\Program Files (x86)\Java\jre7\lib\plugin.pack

MD5	47d6cfa1b01a6d41885504bbc3b1919a
SHA1	3838060f9d530c972d65f36fa38b265120a218aa
SHA256	93defaaf7f82e2e9565b27dd31a41c89e02d1b7719d0da0b940a55dcc75b91e5
SHA512	b0df9b174624234aaeb2b50cf611f698377925a0ae5c5ee9da46c65fcecf4d28941d1bf2332316d9327981c1f8c6c4fecf750e013f04eef63f5df52d27593135

C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack

MD5	c8dc1cfeaf0fefc39ed0f1de4eaa175c
SHA1	11cacbb9e5724d37789455de37a225d8e0c648a1
SHA256	da2803a283d28882182e1e280b4f25ee1579a5805e73fcc9882e63968f102a8f
SHA512	6b419ba94ae90f8caa3a57690f2ec7e249c9fb8ab86819439621cde1243c7636ee76820622ce32ed483ce76976f7ced74778898fc2725b1a2407b039fb53508c

C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack

MD5	dfaa6429468d56ef77932cf26a495f75
SHA1	8a21a29225640f1829ae328a24ef9cb5e215a4e0
SHA256	8c481a549acfa58b1bac0385906febe33a928d004a529fec505b6a9228678fed
SHA512	6c19ed573b111315648de0646441486729b304452c15b2282938460a2339db0be4e1eb19cf6f2bf17f73037811ca2553a15957ea96b9d9af64a93045407c1148

C:\Users\Admin\AppData\Local\Temp\java_install.log

MD5	2b86d39053fc6e56bd766e03b26a52c0
SHA1	ef3dc18b0959019ac4501feb955921fb0053907f
SHA256	a0c4e58373a32071c13ea9d822f62773b50746a310cd371e425a2156963e0548
SHA512	b156b87ba767de35d4be1738eebd393fc584c2294f529834f20d63d5179c6b198925c68b94af63243bc667fd5f87792886af2225c1f3d7933e311b75ad1bc173

C:\Program Files (x86)\Java\jre7\lib\jsse.pack

MD5	31b4d9c29d29567b0ae3037fac9fbdc6
SHA1	8b5d1b1a309177466d71a742414d441f600ea38e
SHA256	9f031f2f1292bb311c400b0a93a11b78a08f013332b1263ea58617b6548862eb
SHA512	b4a8a3a1e837f98a3164e19a6fe939819eb336892335de975822890b52b5923d85fee4c4e5464ccb0d46c847f37f7da98a839aadbf4d20fca355f396a53836c0

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5	1c4472e4e48755d0cb82b9bc2dc78d65
SHA1	d505bcb2987b4183b24d2c660f6f50bdc9751ef4
SHA256	12723f4a405520b1e664f5b4ee3dcbb3b5683eca615908a297264418b1dd25c1
SHA512	8d9c07d190319f1b49e7d99d096830a3806cd77ccf1454471d2cfcc07212338617f2935b490454ae3549d237e2fafc1f7e93f72092f49c50c5bce07fb6d8cdd4

\Program Files (x86)\Java\jre7\bin\javaw.exe

MD5	64e2bb67ea740860510dcc5c2b6ffa2d
SHA1	6c5996358264624cdb4a075acc4f0b46177cd259
SHA256	844ab2231f45fad60d81770ea36d9937da9aa72cd905ce06e7471ddf9d69263b
SHA512	ed24331883ada44d8b034f5c8bc458e53234109d5cd02a27989972033f5b3305d23365106ce80be81caa16e472c14c103e457a1e0d138eb0d95036e58d877462

\Program Files (x86)\Java\jre7\bin\java.dll

MD5	a258a133f7d565600647a248ab95792c
SHA1	1c6a855ca1fc04413b906b0b17609eff38317161
SHA256	81ad5696a6fcad89127fc7a428636d431b446ff1ee0c37bf87e8d513a8bae7af
SHA512	bf9dd97947eb0c71243ae28255af54b06d9e17af7ade666538dd93f9fdf6d8fbc3855f48bfaf6522dbd9ce3c6cff655581f092709670606d033f2321b1f4a5e7

\Program Files (x86)\Java\jre7\bin\jpishare.dll

MD5	4cf2dff54d2e12e3ab637fcafa7d4c9d
SHA1	dcbd0a027b8017ac396741698dfc3b3f4d1b4c39
SHA256	8ff2bc130db2f1fef2e6470adb58bcdba1d2133f9ad21ebd7d80fedd3e537e21
SHA512	a206001ceaed2df91428f1b7094246e4e7318bf4e7b19c475d4887b5eae49714ff7fa3cfab4133004a51280cf36549b73eecc87428b0b38294297545e9493e67

C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg

MD5	5147cce789cd18ad6b2996eb89e5d866
SHA1	756f1fffe96ef581f0d4d47253523544c89a2622
SHA256	c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88
SHA512	55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6

C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll

MD5	27147e1e3faf9b5ccda882cd96f2a85c
SHA1	7103f60121727917f812bfc7cdff5347fc17cc8e
SHA256	500d359211ece211cf672de328345876f016fb4a476b2a03cbc3b8b89023ae1f
SHA512	0866c604911e243687e7fe721142eb882b19691c902736b59ba304933463d8c9154ecc319b91c9771cee8139e151cc2a2e960bc7a93ed97352cf5232a0964194

memory/1212-951-0x0000000000100000-0x0000000000101000-memory.dmp

C:\Program Files (x86)\Java\jre7\bin\javaws.exe

MD5	2b4493bb1f94580c41def972ea9a887e
SHA1	880ca8b20c6df9a6a176b91cc50304cb0fe66d06
SHA256	841339373958786d9c93a7dad5de8fd213ed6b5ad69623f5a5762a453c48e0a5
SHA512	b43e54f2c1f3e0a3c3d2fcee518e47d17476bb735606351e41b49e97e10af758ea9a539ac370a2d12cffa93e3e752e829db969968664c59386f65b732c29e40e

C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll

MD5	bc3a575dfb1a58d35e8617f2966bf1ea
SHA1	6353630f62e246d7f462134e8d10a7a42935e20f
SHA256	c029fd3c6ffd2158d0633fc122786838a6f5d3cc7ef78bbe934697015c8c63dd
SHA512	c976da30d343f8e104bec72300dc0c17e582e380f0a3ae85b242dbf2d5b40459feb4a3b7789fb8d755b21cbaa0940038d20dbbf1296a48e77b461092abbbe514

memory/1652-977-0x0000000039E00000-0x0000000039E10000-memory.dmp

memory/1652-999-0x00000000001B0000-0x00000000001B1000-memory.dmp

C:\Config.Msi\f777794.rbs

MD5	52984dfb0bf27a07370fe338c87c1fc2
SHA1	d749abf90f7d1991abeebbb4af1fcdbcb95431e6
SHA256	2a9f5435782d8bd2978afb1598fa3cc9855bb167900bc3daebec65afc19decd2
SHA512	fa4b32b52256e6931b687f06a2019e2224072b7bcc38c00aa200cc969c0f47038ffea84bf8ef07a2a01834380f8f719a2ed5beed87b8a69016c259eb74fba387

memory/2968-1018-0x00000000003A0000-0x00000000003AA000-memory.dmp

memory/2968-1017-0x00000000003A0000-0x00000000003AA000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

MD5	7edbff4bb042699e045caf862ecf670e
SHA1	2944d5301383ff257884757b9622db4e2fc330b7
SHA256	08c9c7114a448f5d985ac754fa3e734015a6c508705b3f170472cf701b38e2c3
SHA512	a7f5e6421614d51d63c8379c054038d591898e4f0c643affce71405db28c574448eff0d2febcef038385953dd4567f4649bff32257e7c47feef749e4012fc591

memory/2968-1078-0x00000000002B0000-0x00000000002B1000-memory.dmp

C:\Config.Msi\f77779a.rbs

MD5	de44b765c7d22353e83af1d119dcfbb4
SHA1	705899700e1774dcadd81c70ae302588038365ec
SHA256	ab063f2a298f75ca8d3f815878cba70b92995154215c7ebeaca6184fd311db8f
SHA512	e9a8f99348104a7e4249dc0d618d2c6fd50d346029492a55228a27a0d786679508595e7884d0ca5c5925f4ddac8eaab326561ead8d904eb17deb2a5e68633801

C:\Windows\Installer\f777796.msi

MD5	55d7e66e49c3994eb5e1004a5efd22b1
SHA1	aa8a045dc0c161e95804f76efe27f1f572072fa8
SHA256	0a833d92b4d4aa068b0cb256b87c0d3495c3cc4a021be86c072095fee467b379
SHA512	2492ca442c4f6aab1f085a54bbbc1a95b836f033f1c8748fa6c3873997a397020baedfc1f661d751afe30ade3ab14b66a676a4731696b6c90c5c3adfa6c2bd2b

memory/2968-1157-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2604-1158-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/1152-1165-0x0000000000310000-0x000000000039C000-memory.dmp

memory/2968-1169-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/1248-1215-0x00000000000B0000-0x00000000000B1000-memory.dmp

memory/1248-1216-0x00000000000B0000-0x00000000000B1000-memory.dmp

memory/1248-1218-0x00000000000B0000-0x00000000000B1000-memory.dmp

memory/1608-1254-0x0000000000160000-0x0000000000161000-memory.dmp

memory/1608-1262-0x0000000000160000-0x0000000000161000-memory.dmp

memory/3000-1293-0x0000000000170000-0x0000000000171000-memory.dmp

memory/1152-1300-0x0000000000310000-0x000000000039C000-memory.dmp

Sample ID	240606-dafc3sfa8z
Target	965abae8ef3e9859e0e473c5f3cffccf.bin
SHA256	139ee6fc065e526efac3cf24d50d0d95c78e1a10ff2cf40839cd4756fff43e71
Tags	adware stealer upx persistence

Malware Analysis Report

2024-07-28 05:04

Table of Contents

Analysis Overview

Threat Level: Likely malicious

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files