Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2024, 08:53
Behavioral task
behavioral1
Sample
12a9bd842ad230dab192408b264db672_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
28 signatures
150 seconds
General
- Target 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe
- Size 129KB
- Sample241004-ktlsjavekp
- SHA256 0f6b9821918641734d08769055343279f1e67ce077317d3daf6a066d3d182dd3
- MD5 12a9bd842ad230dab192408b264db672
- SHA1 af0663b858c0f12a9b73865988ed2b977cee386b
- SHA512 b037647e5c01bc12b695c2a2a2c8cd90e570d351ac25581d47f5d5a6d20f30288d7dd5091ad33c201d6bdbcc5d220c1dc1e3b74a8dc34ed873dd4654828f0875
- SSDEEP 3072:HOiyDxsHWq7IVNuutVY4t3hMafrZknlOwzmwNCdscout0Qw8:uDDxsHnIJVY41hx9wtCdscoS0Q/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation ZonaUpdater.exe - Executes dropped EXE 36 IoCs
pid Process 4464 javaSetup.exe 4348 unpack200.exe 2616 unpack200.exe 964 unpack200.exe 4132 unpack200.exe 4188 unpack200.exe 5096 unpack200.exe 2736 unpack200.exe 3252 unpack200.exe 5052 javaw.exe 4992 javaws.exe 4472 javaw.exe 4296 jp2launcher.exe 1708 javaw.exe 3764 javaw.exe 4444 Zona.exe 3272 javaw.exe 3252 Zona.exe 852 javaw.exe 4412 ZonaUpdater.exe 3664 javaw.exe 1924 ZONAUP~1.EXE 3212 Zona.exe 2980 javaw.exe 1132 Zona.exe 4484 javaw.exe 4660 Zona.exe 4896 javaw.exe 1692 Zona.exe 3684 javaw.exe 2372 Zona.exe 3272 javaw.exe 1536 Zona.exe 4556 javaw.exe 388 Zona.exe 4820 javaw.exe - Loads dropped DLL 64 IoCs
pid Process 4264 MsiExec.exe 2184 MsiExec.exe 4348 unpack200.exe 2616 unpack200.exe 964 unpack200.exe 4132 unpack200.exe 4188 unpack200.exe 5096 unpack200.exe 2736 unpack200.exe 3252 unpack200.exe 5052 javaw.exe 5052 javaw.exe 5052 javaw.exe 5052 javaw.exe 5052 javaw.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 4992 javaws.exe 4472 javaw.exe 4472 javaw.exe 4472 javaw.exe 4472 javaw.exe 4472 javaw.exe 4296 jp2launcher.exe 4296 jp2launcher.exe 4296 jp2launcher.exe 4296 jp2launcher.exe 4296 jp2launcher.exe 4296 jp2launcher.exe 4296 jp2launcher.exe 4296 jp2launcher.exe 4296 jp2launcher.exe 4296 jp2launcher.exe 1708 javaw.exe 1708 javaw.exe 1708 javaw.exe 1708 javaw.exe 1708 javaw.exe 3764 javaw.exe 3764 javaw.exe 3764 javaw.exe 3764 javaw.exe 3764 javaw.exe 3272 javaw.exe 3272 javaw.exe 3272 javaw.exe 3272 javaw.exe 3272 javaw.exe 852 javaw.exe 852 javaw.exe 852 javaw.exe 852 javaw.exe 852 javaw.exe 3252 Zona.exe 3252 Zona.exe 3252 Zona.exe 3252 Zona.exe 3252 Zona.exe 3252 Zona.exe 3252 Zona.exe 3252 Zona.exe 3252 Zona.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zona = "C:\\Program Files (x86)\\Zona\\Zona.exe /MINIMIZED" 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe - Blocklisted process makes network request 3 IoCs
flow pid Process 59 3904 msiexec.exe 61 3904 msiexec.exe 63 3904 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" MsiExec.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 122 checkip.dyndns.org - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\java.exe MsiExec.exe File opened for modification C:\Windows\SysWOW64\java.exe MsiExec.exe File created C:\Windows\SysWOW64\javaw.exe MsiExec.exe File created C:\Windows\SysWOW64\WindowsAccessBridge-32.dll MsiExec.exe File created C:\Windows\SysWOW64\javaws.exe MsiExec.exe -
resource yara_rule behavioral2/memory/512-0-0x0000000000F20000-0x0000000000F70000-memory.dmp upx behavioral2/memory/512-46-0x0000000000F20000-0x0000000000F70000-memory.dmp upx behavioral2/memory/1512-48-0x0000000000F20000-0x0000000000F70000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre7\bin\jpicom.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Bissau MsiExec.exe File created C:\Program Files (x86)\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\javaw.exe MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Regina MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\Ushuaia MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Porto_Velho MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\cmm\GRAY.pf MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Dublin MsiExec.exe File created C:\Program Files (x86)\Zona\uninstall.exe javaw.exe File created C:\Program Files (x86)\Java\jre7\patchjre.exe msiexec.exe File created C:\Program Files (x86)\Java\jre7\bin\eula.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Malta MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Campo_Grande MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Menominee MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Yakutat MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Christmas MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\CST6 MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\dt_socket.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\fontconfig.bfc MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\ssv.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\javafx-iio.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\jp2native.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Krasnoyarsk MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\San_Juan MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Rainy_River MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Karachi MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Dawson MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Tell_City MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\Catamarca MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Cancun MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\deploy\jqs\jqs.conf MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\ext\access-bridge-32.jar MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\sound.properties MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Adak MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Argentina\Cordoba MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\PST8PDT MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\client\Xusage.txt MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\ext\access-bridge.jar MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\security\javafx.policy MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Asuncion MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Jamaica MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\SystemV\MST7 MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\deploy.pack MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\plugin.pack MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Windhoek MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Fortaleza MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Rio_Branco MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Yellowknife MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\JavaAccessBridge-32.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\deploy\messages_ja.properties MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\ssvagent.exe MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\verify.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\psfont.properties.ja MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Bogota MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\El_Salvador MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\jsoundds.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Vevay MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Mahe MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Ho_Chi_Minh MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Honolulu MsiExec.exe File created C:\Program Files (x86)\Zona\Zona.7z.tmp javaw.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID7A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID96A.tmp msiexec.exe File opened for modification C:\Windows\ZonaUpdater.log ZonaUpdater.exe File opened for modification C:\Windows\Installer\e57d06f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID496.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F03217080FF} msiexec.exe File created C:\Windows\Installer\e57d073.msi msiexec.exe File created C:\Windows\hsperfdata_Admin\3664 javaw.exe File opened for modification C:\Windows\ZonaUpdater.log ZONAUP~1.EXE File created C:\Windows\Installer\e57d06f.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 39 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZonaUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zona.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unpack200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zona.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zona.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zona.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zona.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zona.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zona.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZONAUP~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jp2launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zona.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zona.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "45663788" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}" MsiExec.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_17" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0078-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0033-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0055-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_02" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_17" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0019-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA} MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0086-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0014-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0035-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_15" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0068-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0064-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0055-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_49" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0031-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_36" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0083-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0016-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_16" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_19" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0071-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_16" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0079-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0037-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0065-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Zona\DefaultIcon\ = "C:\\PROGRA~2\\Zona\\torrent.ico" Zona.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0057-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0042-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_42" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_20" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0054-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0079-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_79" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_38" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0070-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_70" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0046-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0088-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_12" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0019-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Magnet\shell\ = "open" Zona.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0053-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0056-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0095-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_29" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_11" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0072-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_72" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_33" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_01" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0047-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0061-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_61" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0080-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_75" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4296 jp2launcher.exe 4296 jp2launcher.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4588 msiexec.exe Token: SeIncreaseQuotaPrivilege 4588 msiexec.exe Token: SeSecurityPrivilege 3904 msiexec.exe Token: SeCreateTokenPrivilege 4588 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4588 msiexec.exe Token: SeLockMemoryPrivilege 4588 msiexec.exe Token: SeIncreaseQuotaPrivilege 4588 msiexec.exe Token: SeMachineAccountPrivilege 4588 msiexec.exe Token: SeTcbPrivilege 4588 msiexec.exe Token: SeSecurityPrivilege 4588 msiexec.exe Token: SeTakeOwnershipPrivilege 4588 msiexec.exe Token: SeLoadDriverPrivilege 4588 msiexec.exe Token: SeSystemProfilePrivilege 4588 msiexec.exe Token: SeSystemtimePrivilege 4588 msiexec.exe Token: SeProfSingleProcessPrivilege 4588 msiexec.exe Token: SeIncBasePriorityPrivilege 4588 msiexec.exe Token: SeCreatePagefilePrivilege 4588 msiexec.exe Token: SeCreatePermanentPrivilege 4588 msiexec.exe Token: SeBackupPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 4588 msiexec.exe Token: SeShutdownPrivilege 4588 msiexec.exe Token: SeDebugPrivilege 4588 msiexec.exe Token: SeAuditPrivilege 4588 msiexec.exe Token: SeSystemEnvironmentPrivilege 4588 msiexec.exe Token: SeChangeNotifyPrivilege 4588 msiexec.exe Token: SeRemoteShutdownPrivilege 4588 msiexec.exe Token: SeUndockPrivilege 4588 msiexec.exe Token: SeSyncAgentPrivilege 4588 msiexec.exe Token: SeEnableDelegationPrivilege 4588 msiexec.exe Token: SeManageVolumePrivilege 4588 msiexec.exe Token: SeImpersonatePrivilege 4588 msiexec.exe Token: SeCreateGlobalPrivilege 4588 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3252 Zona.exe 3252 Zona.exe 3252 Zona.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3252 Zona.exe 3252 Zona.exe 3252 Zona.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4296 jp2launcher.exe 3252 Zona.exe 3252 Zona.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 512 wrote to memory of 2672 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 82 PID 512 wrote to memory of 2672 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 82 PID 512 wrote to memory of 2672 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 82 PID 512 wrote to memory of 1512 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 85 PID 512 wrote to memory of 1512 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 85 PID 512 wrote to memory of 1512 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 85 PID 1512 wrote to memory of 4464 1512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 93 PID 1512 wrote to memory of 4464 1512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 93 PID 1512 wrote to memory of 4464 1512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 93 PID 4464 wrote to memory of 4588 4464 javaSetup.exe 94 PID 4464 wrote to memory of 4588 4464 javaSetup.exe 94 PID 4464 wrote to memory of 4588 4464 javaSetup.exe 94 PID 3904 wrote to memory of 4264 3904 msiexec.exe 96 PID 3904 wrote to memory of 4264 3904 msiexec.exe 96 PID 3904 wrote to memory of 4264 3904 msiexec.exe 96 PID 3904 wrote to memory of 2184 3904 msiexec.exe 98 PID 3904 wrote to memory of 2184 3904 msiexec.exe 98 PID 3904 wrote to memory of 2184 3904 msiexec.exe 98 PID 2184 wrote to memory of 4348 2184 MsiExec.exe 99 PID 2184 wrote to memory of 4348 2184 MsiExec.exe 99 PID 2184 wrote to memory of 4348 2184 MsiExec.exe 99 PID 2184 wrote to memory of 2616 2184 MsiExec.exe 100 PID 2184 wrote to memory of 2616 2184 MsiExec.exe 100 PID 2184 wrote to memory of 2616 2184 MsiExec.exe 100 PID 2184 wrote to memory of 964 2184 MsiExec.exe 101 PID 2184 wrote to memory of 964 2184 MsiExec.exe 101 PID 2184 wrote to memory of 964 2184 MsiExec.exe 101 PID 2184 wrote to memory of 4132 2184 MsiExec.exe 102 PID 2184 wrote to memory of 4132 2184 MsiExec.exe 102 PID 2184 wrote to memory of 4132 2184 MsiExec.exe 102 PID 2184 wrote to memory of 4188 2184 MsiExec.exe 103 PID 2184 wrote to memory of 4188 2184 MsiExec.exe 103 PID 2184 wrote to memory of 4188 2184 MsiExec.exe 103 PID 2184 wrote to memory of 5096 2184 MsiExec.exe 104 PID 2184 wrote to memory of 5096 2184 MsiExec.exe 104 PID 2184 wrote to memory of 5096 2184 MsiExec.exe 104 PID 2184 wrote to memory of 2736 2184 MsiExec.exe 105 PID 2184 wrote to memory of 2736 2184 MsiExec.exe 105 PID 2184 wrote to memory of 2736 2184 MsiExec.exe 105 PID 2184 wrote to memory of 3252 2184 MsiExec.exe 106 PID 2184 wrote to memory of 3252 2184 MsiExec.exe 106 PID 2184 wrote to memory of 3252 2184 MsiExec.exe 106 PID 2184 wrote to memory of 5052 2184 MsiExec.exe 108 PID 2184 wrote to memory of 5052 2184 MsiExec.exe 108 PID 2184 wrote to memory of 5052 2184 MsiExec.exe 108 PID 4992 wrote to memory of 4472 4992 javaws.exe 112 PID 4992 wrote to memory of 4472 4992 javaws.exe 112 PID 4992 wrote to memory of 4472 4992 javaws.exe 112 PID 4992 wrote to memory of 4296 4992 javaws.exe 113 PID 4992 wrote to memory of 4296 4992 javaws.exe 113 PID 4992 wrote to memory of 4296 4992 javaws.exe 113 PID 1512 wrote to memory of 1708 1512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 114 PID 1512 wrote to memory of 1708 1512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 114 PID 1512 wrote to memory of 1708 1512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 114 PID 1512 wrote to memory of 3764 1512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 115 PID 1512 wrote to memory of 3764 1512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 115 PID 1512 wrote to memory of 3764 1512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 115 PID 512 wrote to memory of 4444 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 116 PID 512 wrote to memory of 4444 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 116 PID 512 wrote to memory of 4444 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 116 PID 4444 wrote to memory of 3272 4444 Zona.exe 117 PID 4444 wrote to memory of 3272 4444 Zona.exe 117 PID 4444 wrote to memory of 3272 4444 Zona.exe 117 PID 512 wrote to memory of 3252 512 12a9bd842ad230dab192408b264db672_JaffaCakes118.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\12a9bd842ad230dab192408b264db672_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\12a9bd842ad230dab192408b264db672_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\cscript.execscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs2⤵
- System Location Discovery: System Language Discovery
PID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\12a9bd842ad230dab192408b264db672_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\12a9bd842ad230dab192408b264db672_JaffaCakes118.exe" /asService2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\javaSetup.exe"C:\Users\Admin\AppData\Local\Temp\javaSetup.exe" /s REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi" REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0 /qn METHOD=joff4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
-
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Local\Temp\Zona.7z" "C:\Program Files (x86)\Zona"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1708
-
-
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Zona\utils.jar" org.sevenzip.decoder.SevenZipFolderDecoder "C:\Users\Admin\AppData\Local\Temp\appdata.7z" "C:\Users\Admin\AppData\Roaming\Zona"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3764
-
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" /copydll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3272
-
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" --readInitFile2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3252 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:852
-
-
C:\Users\Admin\AppData\Roaming\Zona\plugins\zupdater\ZonaUpdater.exeC:\Users\Admin\AppData\Roaming\Zona\plugins\zupdater\ZonaUpdater.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4412 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Users\Admin\AppData\Roaming\Zona\plugins\zupdater\zupdater.ext.jar" ru.zona.plugins.zupdater.ext.Main update4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3664
-
-
C:\Users\Admin\AppData\Roaming\Zona\plugins\zupdater\ZONAUP~1.EXE"C:\Users\Admin\AppData\Roaming\Zona\plugins\zupdater\ZONAUP~1.EXE" /asService /logPath "C:\Windows\ZonaUpdater.log"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1924
-
-
-
-
C:\Windows\SysWOW64\cscript.execscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs2⤵
- System Location Discovery: System Language Discovery
PID:1432
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" /copydll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3212 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980
-
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" --readInitFile2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484
-
-
-
C:\Windows\SysWOW64\cscript.execscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs2⤵
- System Location Discovery: System Language Discovery
PID:2972
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" /copydll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4660 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896
-
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" --readInitFile2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3684
-
-
-
C:\Windows\SysWOW64\cscript.execscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs2⤵
- System Location Discovery: System Language Discovery
PID:1328
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" /copydll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3272
-
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" --readInitFile2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1536 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4556
-
-
-
C:\Windows\SysWOW64\cscript.execscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs2⤵
- System Location Discovery: System Language Discovery
PID:4040
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" /copydll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:388 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\PROGRA~2\Zona\Zona.jar" org.gudy.azureus2.core3.util.Constants3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4820
-
-
-
C:\Program Files (x86)\Zona\Zona.exe"C:\Program Files (x86)\Zona\Zona.exe" --readInitFile2⤵PID:3316
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D8DF299674ED7AF17658A403C90F4EB92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4264
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 66BAF80951DFDB19DEAC21351EF6CC88 E Global\MSI00002⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\rt.pack" "C:\Program Files (x86)\Java\jre7\lib\rt.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4348
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\charsets.pack" "C:\Program Files (x86)\Java\jre7\lib\charsets.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\deploy.pack" "C:\Program Files (x86)\Java\jre7\lib\deploy.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\javaws.pack" "C:\Program Files (x86)\Java\jre7\lib\javaws.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4132
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\plugin.pack" "C:\Program Files (x86)\Java\jre7\lib\plugin.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4188
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jsse.pack" "C:\Program Files (x86)\Java\jre7\lib\jsse.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5096
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack" "C:\Program Files (x86)\Java\jre7\lib\jfxrt.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3252
-
-
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5052
-
-
C:\Program Files (x86)\Java\jre7\bin\javaws.exe"C:\Program Files (x86)\Java\jre7\bin\javaws.exe" -fix -permissions -silent3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -classpath "C:\Program Files (x86)\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.JreLocator4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4472
-
-
C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmU3XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlN1xiaW5camF2YXcuZXhl -ma LWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4296
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57d072.rbs
- Size 10KB
- SHA256 57ac4f898a62b73cc083525e90a746ab93ef3f94847e9965daf2b8fa3fd87c0b
- MD5 ead29ea6c287a22ac7a7e55db9225b53
- SHA1 dcbe5bb88739f6376240ce2189311e7b5ca50bb5
- SHA512 00b6d87b12ca51cedc302baf450a731a056381985600f2d167f5bddf6f99ea44f07ca55276049fa1af1dbc161e1a063d2218b34834a91a867bd938f3da530f1a
- SSDEEP 192:5XaxCiGdAeseKOuG0GoeKOuI0eazmZqpPihwba:5XspXAWhAwJmeW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\MSVCR100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\WindowsAccessBridge-32.dll
- Size 95KB
- SHA256 4010a3ec604a327861bedf01626c12eaded9d381b6e4f0e6f760895838834a21
- MD5 1722510af00ea3c7406681b47bf442f7
- SHA1 cafac266d52d78d3743c31ebef22a894781e0de5
- SHA512 31a2ce3d5eb9828cbb82d2a7e29f2c5bf46528d38f25827329512cedde37bd03b3cfdba0aba3320b6c0e7779588958e83bff735f6059aad37172598e70e863eb
- SSDEEP 1536:wOW8GIF0xqg9Wr0eQPgjiKMQxSo7H0IpSiXk/LPQlswj81NowG0W:zHCxqgA7QPgjiKMvo4IpSi6U6wKKxX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll
- Size 3.4MB
- SHA256 500d359211ece211cf672de328345876f016fb4a476b2a03cbc3b8b89023ae1f
- MD5 27147e1e3faf9b5ccda882cd96f2a85c
- SHA1 7103f60121727917f812bfc7cdff5347fc17cc8e
- SHA512 0866c604911e243687e7fe721142eb882b19691c902736b59ba304933463d8c9154ecc319b91c9771cee8139e151cc2a2e960bc7a93ed97352cf5232a0964194
- SSDEEP 49152:ZrZNQqi9xkS7HU5kf0a5m4mDfhoobdwQC+1F8E9EYm8cBwoHmFOy8CIIaB6wwzmW:7enY5WijhooGh8cGoHm6jvcv/GnUxV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\deploy.dll
- Size 371KB
- SHA256 352707a271a9ab5d0e190a539b6468d6c6c5ce9675b300acf2305aa1f30625d8
- MD5 87ec9d4a00d34eb6a0f8f92e1d1cc08e
- SHA1 bee4ecae201905096dd44d1d348ecb3556d90832
- SHA512 5b7f9866168ad7948a5a80078b14ff747201d17922ca907072a081e0078f6ac68446ddd36b027b4a17f5afa7d1bb4962642cff28cf66867171ebb78735f242d2
- SSDEEP 6144:ZtbYrD6qqtQgirH7/W4/SDMqiJjOBCCMEdvxIW1hN:ZtbYr4tG7/W4/SDMqa4vq+hN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
- Size 864KB
- SHA256 c029fd3c6ffd2158d0633fc122786838a6f5d3cc7ef78bbe934697015c8c63dd
- MD5 bc3a575dfb1a58d35e8617f2966bf1ea
- SHA1 6353630f62e246d7f462134e8d10a7a42935e20f
- SHA512 c976da30d343f8e104bec72300dc0c17e582e380f0a3ae85b242dbf2d5b40459feb4a3b7789fb8d755b21cbaa0940038d20dbbf1296a48e77b461092abbbe514
- SSDEEP 12288:vd4rPQxptuRWuSmOqPsz9YbUOLgsxel3nvb9N3YfG2JmekTvChbOso6CyQJueOdv:F4zWuSDOsz9g1Lgsxq9N3yX4USK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\java.dll
- Size 117KB
- SHA256 81ad5696a6fcad89127fc7a428636d431b446ff1ee0c37bf87e8d513a8bae7af
- MD5 a258a133f7d565600647a248ab95792c
- SHA1 1c6a855ca1fc04413b906b0b17609eff38317161
- SHA512 bf9dd97947eb0c71243ae28255af54b06d9e17af7ade666538dd93f9fdf6d8fbc3855f48bfaf6522dbd9ce3c6cff655581f092709670606d033f2321b1f4a5e7
- SSDEEP 3072:gnQmO7IlruvLXTYZKj8Jq1YwEyy4YtQNAoTX0D:4h3lKvL0Ztp4K3D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\java.exe
- Size 171KB
- SHA256 c7fd72a0730b377c6da5ac80cdaf5f4cca84cc999a563a4c420fe5a8576810f8
- MD5 88651044108e995f9801e35d2582491c
- SHA1 abbf404c0253d085223a64ab947e1057c4211c9c
- SHA512 486b1d7ad7c3debcb8d70f9351adb08c8321c4cfb409a00ff818be1dacdc376a0eded630ccdc74aa99cc472589b88c9681989076fd78eb109759d33e7bf70543
- SSDEEP 3072:KnwrusR90uNHgtMhsaR2fhvTxVwEPEoTBfmabjZqMN7GLi4:wwrusb07tMfRYTxVB8oTBpvqLH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\javaw.exe
- Size 171KB
- SHA256 844ab2231f45fad60d81770ea36d9937da9aa72cd905ce06e7471ddf9d69263b
- MD5 64e2bb67ea740860510dcc5c2b6ffa2d
- SHA1 6c5996358264624cdb4a075acc4f0b46177cd259
- SHA512 ed24331883ada44d8b034f5c8bc458e53234109d5cd02a27989972033f5b3305d23365106ce80be81caa16e472c14c103e457a1e0d138eb0d95036e58d877462
- SSDEEP 3072:Yoc9DbDDUaDxmNhrS+eEcbren+W3hYTBfBX0jZqMNSKFg:jc9bDNxmzS+a3entRYTBKvt+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\javaws.exe
- Size 266KB
- SHA256 841339373958786d9c93a7dad5de8fd213ed6b5ad69623f5a5762a453c48e0a5
- MD5 2b4493bb1f94580c41def972ea9a887e
- SHA1 880ca8b20c6df9a6a176b91cc50304cb0fe66d06
- SHA512 b43e54f2c1f3e0a3c3d2fcee518e47d17476bb735606351e41b49e97e10af758ea9a539ac370a2d12cffa93e3e752e829db969968664c59386f65b732c29e40e
- SSDEEP 6144:FHNCVyL+Br9XFt6KeorPZufQ4BIGQYqFkNOjvqR7:JNH6rVtdeobZ2IjYqtjv0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
- Size 145KB
- SHA256 c89091f2a4de2fcf10b30e54a74ec5764e2dfc0577f4f1d879ac8816e3b08bcc
- MD5 0d46182b6134aa9c7acd16133d67e4c3
- SHA1 7b5be3d65e5e744723bf55a08f9dc1042585d5eb
- SHA512 735b6c6bd69b22a71c15ae44c6fa1693700321dc3b4b2367ce05d5c37df62e45d1d3836c2c0f5e44be1036aeb11a533c2a4dbec55163b4a15adfa1c8ef75673b
- SSDEEP 1536:orhTuv/39U7QVq15jIS1mlqct2ND8h+8zu17Oq4qnToIflGIO0IOY03Gk5J0X:oGe9FIFIV8/ulphTBflkaY0Wk5J0X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\verify.dll
- Size 38KB
- SHA256 87d8d59972e73700507c07cee8750b0053c6a0899410338722a00c2803d39ee6
- MD5 cb89b1d71061f5ec52468528ecc0b1fc
- SHA1 6feb23a8b5719c8997de92c7da644807fcba8819
- SHA512 2ff0ed38c7f28eb7ea16f24a0841dfb3306c4fec48ded5fddec8c3140f1a425433a444fe6b6cc4c17b3a39841c8ab0c23d7c9525c119c1b9d6daac2c17a4e4b0
- SSDEEP 768:gPGXoQMYf5rFV1wleN0gzhSlAHCf4ouRHJrf4t8fnd577Iq5z:gOXJMSrufMNf4wfvIw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\wsdetect.dll
- Size 159KB
- SHA256 2ef891881d506084ed182a0ac58b10dbe8c45877ef889ac9105f19431beee4ca
- MD5 958bc8d82e4d0a5b51536bb4fc4fb6d6
- SHA1 626312fa01c72ec5c85c9262ba0ae97a8b1f5b25
- SHA512 fe17b58e3eed817619bebf6d091aee99fdc331c9c5a4163e9f5993b41b2e7362365da210e0636755ada6b8838012de1bc5435b8670aa12f378a3c9e3a9f5af04
- SSDEEP 3072:gLutxFjfIlYey8KP0+KbMcfyMvc0crTwC7bd2:gLunFzIqey5P0bbVrchrTwC7x2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\bin\zip.dll
- Size 66KB
- SHA256 35ce7ab154a38e97951714e17f7689873d89e8c01188de6e5cd741bc0ca3e384
- MD5 1ecf056944068b933ba71cda3edc4a68
- SHA1 2052b2138db0d9a368942470b41bb6fc5b1d4007
- SHA512 cadf312841d392a9970cc068b72063e17454d5e6738b46ec9622257d9dfc0bcad0d9420352752bf7d8f8e8ceaf6aca97d83896f753dc12cfeac3e5efb5e1ab05
- SSDEEP 1536:4UH9k47M2axhBBQq8SRlr8IOwIOpVnToIf1QfqPu:zl6u0xymp9TBf1QfqPu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\charsets.jar
- Size 3.4MB
- SHA256 dd213d0867714191e351f589dc709d6f3cafee819aafda8f8fe022d367ea189b
- MD5 3f080df73b2d7cad61bddcf709aadc72
- SHA1 616e9ec760722737f38213f43755131f836dd627
- SHA512 733b65d3662f2eb9a8f64212e306d934929a05fd753040073f7e2769df77791c29aef9e35610b7b22597bbea6d805a8e04f93235fe761bf6bd5c5733c867025b
- SSDEEP 49152:j3Iihrz1nFtsMm4kCG6APPzmpGNfnvvqNlbIeDX:j3Ii9zNo0TwLdNfn3KlbICX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\charsets.pack
- Size 1.3MB
- SHA256 8ea5af036ec067a0abcf87b8f5921e2281ff9d259e1d4c3bbe7fa9037cd87d02
- MD5 549bbcd204914b543dafee670f110834
- SHA1 012461935191a55482e8c3d453d245e965a10a2a
- SHA512 b0346a2ec52ce47351286f27f347f5fea99e160aedde52bcf74e1629739704bd975c9c99d8db6be3b6bd45e7fa933616fa081eda49e9b911efcc031c7241400e
- SSDEEP 12288:QcvuzHfxrXJEmb5yyWMOXpyDy64BqY0qohrn2Wz/n3OEDgsa1dQnBJ4F:QcWTd5EmbmXse/0/n2cn3QF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\classlist
- Size 73KB
- SHA256 3837e95826d2273a54e3869efcad1521e000215428a2c7ee9397b650834ebaf1
- MD5 1a0b7592ab9c12aff1191dfd225154ca
- SHA1 3d3fb5f326f2caea866028558834ae684a2fe09f
- SHA512 b2932400b6d8c72d344cb0592f121623dd848dcdd341248cf18cd55cd0c4fbd7f923057d022f89586ec6062299d756a37b3ff4308f10865de6ba68b2ee530fe9
- SSDEEP 1536:Erv75nC+l+IbYoce+aeVQfo/ohdAyPD+cJKslPKUhjK6gVXVLpKhbC/4Z+j7RFR2:OnCcYKe/Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\deploy.pack
- Size 1.7MB
- SHA256 928f6b847f94b920c462a08c43f0dfd3f7c40076b1cd60545523a5c27a4870ca
- MD5 b2a448112b7c886ccce9b6a3d5efd8a0
- SHA1 660bc9efe960015b208a421b1a63443e7151024f
- SHA512 871da63f4eaf16d77ba6c19c10d8ddd8e94f744c20a70e24793f837023d20e56698d85f67498bc06ec37b73a8f376c220afbe7f3884b00536b710ff49c339b3f
- SSDEEP 24576:zdyq6mG9BvZSL4096jCVKTBtdjM8pOzoAGdoKW0IriN2:zMvO4dFWfic
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack
- Size 736KB
- SHA256 da2803a283d28882182e1e280b4f25ee1579a5805e73fcc9882e63968f102a8f
- MD5 c8dc1cfeaf0fefc39ed0f1de4eaa175c
- SHA1 11cacbb9e5724d37789455de37a225d8e0c648a1
- SHA512 6b419ba94ae90f8caa3a57690f2ec7e249c9fb8ab86819439621cde1243c7636ee76820622ce32ed483ce76976f7ced74778898fc2725b1a2407b039fb53508c
- SSDEEP 12288:+FFkQLRQjAgM4fIuskrqTYSuGTwj0ehh/k9SoBUaBYu:BpAgXzOcSuUw4eh5iUAv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg
- Size 686B
- SHA256 c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88
- MD5 5147cce789cd18ad6b2996eb89e5d866
- SHA1 756f1fffe96ef581f0d4d47253523544c89a2622
- SHA512 55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Java\jre7\lib\images\cursors\invalid32x32.gif
- Size 153B
- SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
- MD5 1e9d8f133a442da6b0c74d49bc84a341
- SHA1 259edc45b4569427e8319895a444f4295d54348f
- SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Java\jre7\lib\javaws.pack
- Size 205KB
- SHA256 ee43869ee94eefe241d661101ff6a03cc276f8e558967b1b350ea088f1dad2e2
- MD5 491bce42c6cd8af88a2e11f37711ed4f
- SHA1 3de7c18fee44465a6afe34e068f2a64dea9fa324
- SHA512 1e5f99466b77b5a82c23449434272acf5746811ef96b98105f89b3339ccd86734d7713c94b773755219345d673a761a356fbe846a38e7893bd8894e43cf102e4
- SSDEEP 3072:r05V3g4qpeICnbOKxO6kzmioaxOuVhi8kV2MoOGN2jhKuCQ0nAsKu4iCp+vgn43:ruO30OekKioaQ8v29pCQivKXgO43
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\jfxrt.pack
- Size 3.2MB
- SHA256 8c481a549acfa58b1bac0385906febe33a928d004a529fec505b6a9228678fed
- MD5 dfaa6429468d56ef77932cf26a495f75
- SHA1 8a21a29225640f1829ae328a24ef9cb5e215a4e0
- SHA512 6c19ed573b111315648de0646441486729b304452c15b2282938460a2339db0be4e1eb19cf6f2bf17f73037811ca2553a15957ea96b9d9af64a93045407c1148
- SSDEEP 49152:TIOCux2SzM48f4NCZdfyupJDyQz8YCIN5yOHgNN:BRp0ptz8YCIfHM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\jsse.pack
- Size 141KB
- SHA256 9f031f2f1292bb311c400b0a93a11b78a08f013332b1263ea58617b6548862eb
- MD5 31b4d9c29d29567b0ae3037fac9fbdc6
- SHA1 8b5d1b1a309177466d71a742414d441f600ea38e
- SHA512 b4a8a3a1e837f98a3164e19a6fe939819eb336892335de975822890b52b5923d85fee4c4e5464ccb0d46c847f37f7da98a839aadbf4d20fca355f396a53836c0
- SSDEEP 3072:+btJdrAlQMcNuicXy7/Sa1hz3igGCCCCtgXiJTOyV:+RrrAlQMcN3Uy2abQ/Ok
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\meta-index
- Size 2KB
- SHA256 afb4850419612e0daf1876a5d61120ed0ccae241f188c25c014602007b3a765b
- MD5 8bff510abed2b6fcc5a83eedb65b1766
- SHA1 ba6d0cd7504a5baeb963501b8bdf315ec6cb355c
- SHA512 8786bd672ce9c53f4c31f8206d621eb06ae7527f9adf3700955cc1cb928dde145b684666a5eb4ac11301541f585970ccd377ba144da351741e3cb5769b6ff522
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Java\jre7\lib\plugin.pack
- Size 489KB
- SHA256 93defaaf7f82e2e9565b27dd31a41c89e02d1b7719d0da0b940a55dcc75b91e5
- MD5 47d6cfa1b01a6d41885504bbc3b1919a
- SHA1 3838060f9d530c972d65f36fa38b265120a218aa
- SHA512 b0df9b174624234aaeb2b50cf611f698377925a0ae5c5ee9da46c65fcecf4d28941d1bf2332316d9327981c1f8c6c4fecf750e013f04eef63f5df52d27593135
- SSDEEP 6144:pPYDxiUn5kuS7ogVc4r+cWaTu8KPVzsRnVPI6oWnfmoNOz4KMWpeNi+:pgx57IcEvWeSVzpN0OOWcNV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\rt.jar
- Size 49.4MB
- SHA256 a85b24d93ceb6095691838dda51d31bc5e8dc94663514b46c48d7c41d351aad2
- MD5 bac77d8d145bd553c7efdf7978d9dff0
- SHA1 31da52beb0237a6ffd6ebc4a766d92f12a226fb6
- SHA512 2aabc1986338a68cdecf6d46afd6492a90940d9412bf8f7ad7c6183091403a784244ecf1007dc3875a892c0b1c2557f5de31f387011ca8db657f4367f5fc86ba
- SSDEEP 196608:KBGhB5BSlLdAL/XYYLEY5tz9YW4ZrsdkatGvr4dKUy05VtkR/xCIMS:z5BSlu7lLX/9f0rsdkatGvr4dKUn0x6S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\rt.pack
- Size 13.1MB
- SHA256 82dc6806d9ec9eb16604f90a5c78d0d882b69a0e718d8f6c3c6b7c9719887b7e
- MD5 b6d75e8c90c79af1579769f10b1e5c88
- SHA1 146cb3f05fa161885e8faf079fa2bbd89b5c5b18
- SHA512 02cdd0c0d6e71bc09120db2cd3b9471c0176567d92bb74a08c13e82c1d23722eb4afac41583a11dee3fc531fd442754ee0f5cb964898ec036ddd432947996037
- SSDEEP 196608:xHWBePZbgggLYJ4329rRizU/ULUh49TXY9o9W:DPZbgggLYJ4m9CehoTo9o9W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT
- Size 27B
- SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
- MD5 7da9aa0de33b521b3399a4ffd4078bdb
- SHA1 f188a712f77103d544d4acf91d13dbc664c67034
- SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+5
- Size 27B
- SHA256 27ba8b5814833b1e8e8b5d08246b383cb8a5fb7e74e237cdbcadf320e882ab78
- MD5 a2abe32f03e019dbd5c21e71cc0f0db9
- SHA1 25b042eb931fff4e815adcc2ddce3636debf0ae1
- SHA512 197c065b9c17c6849a15f45ac69dafa68aaa0b792219fedb153d146f23997bfa4fbc4127b1d030a92a4d7103bded76a1389df715b9539ea23ea21e6a4bb65fb2
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Java\jre7\lib\zi\HST
- Size 27B
- SHA256 3144bc5353ebbd941cdccbbd9f5fb5a06f38abf5cc7b672111705c9778412d08
- MD5 715dc3fcec7a4b845347b628caf46c84
- SHA1 1b194cdd0a0dc5560680c33f19fc2e7c09523cd1
- SHA512 72ab4b4ad0990cce0723a882652bf4f37aac09b32a8dd33b56b1fbf25ac56ae054328909efd68c8243e54e449d845fb9d53dd95f47eaaf5873762fcd55a39662
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Java\jre7\lib\zi\MST
- Size 27B
- SHA256 0e6a7f1ab731ae6840eacc36b37cbe3277a991720a7c779e116ab488e0eeed4e
- MD5 11f8e73ad57571383afa5eaf6bc0456a
- SHA1 65a736dddd8e9a3f1dd6fbe999b188910b5f7931
- SHA512 578665a0897a2c05eda59fb6828f4a9f440fc784059a5f97c8484f164a5fcec95274159c6ff6336f4863b942129cb884110d14c9bd507a2d12d83a4e17f596d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
- Size 1KB
- SHA256 d48d923c0c924d2ec3f0af188f20930421191e6d17c2007d0caaa5ea71b0822c
- MD5 2210d87f5d4fcd49bdc17ef8acf350ca
- SHA1 d8616202ba9082225f622bd15e425529e10ee081
- SHA512 0691e468af11d9ffeff2c9bf1fe0057cccba7b987d4b7f656eb08ab53b5964ccd9ed0b9f6b3274aa539f03f937a738c333e21f877e4f1f153bda51a74038f9b9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\Data1.cab
- Size 24.6MB
- SHA256 a84262dd486cf59049d0d2d9a1b00dfb5aa5271592edd8de0e052f12496dec67
- MD5 003a488a2139105704566b47eb29520d
- SHA1 52d672a592cd52ad5e2e7239421f2659e0d17afa
- SHA512 ab34061f8e04bb1d59f1b35e0e1848a176f2b119095e79015130da3a4384c70fa35ecbe1625e07c0eb0de49c67bcdbba59f10fa1dfbbb2066dcb6ee6825215de
- SSDEEP 393216:S9CUhZsoKK1mWskttt7gAbDvaywLI2tt8wTYP/LQb3044DZkPybune:J2ZsoLm7kttLbfwfmwuf1kqbune
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_80\jre1.7.0_80.msi
- Size 898KB
- SHA256 dbf28e21d55dd662cccf4d422a1a645a6a3dbfd6914942dde417d20c4d2fe01c
- MD5 e24d9b483ce7a3a6a4406111883457f7
- SHA1 0d5efff0d110c48f5e6f5d438967427f1e2dbf84
- SHA512 b614b023ce683e78ee685be028fa06d7df90f10360d55de2a8c1214200b0b85998683502f377b01584bf23b72b168c33ef560a78d7abdf68aa3af87beca59398
- SSDEEP 12288:JbSGg983mCR0sY9D4+doy8J5EMPhQmW9K+r:JbS1983zq4LbEI+S+r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RUpdate_r33.exe
- Size 146B
- SHA256 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
- MD5 8eec510e57f5f732fd2cce73df7b73ef
- SHA1 3c0af39ecb3753c5fee3b53d063c7286019eac3b
- SHA512 73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
- Size 4KB
- SHA256 16c16f0dd85e71dd5cd276ae8ec02c335f3f6da16a512398985bb7fad4292474
- MD5 6f0ccb622ef80a245cd3cb6d48503a94
- SHA1 5ba002ad955e47521d371a7989a3da9ad031fa88
- SHA512 d5b83d8c08080ed6ef96fb87fcfdf5c96dab2047cc521263778a7bdd778f2a3a3e13934398de75cc9a5803b19f4a34211c11f7e2e42c78860dd50f286e328de8
- SSDEEP 96:oIxyUuQ6Ry0UxWI73g1af0EnELEEXeBvYXdcdnvYQB6B45vYafH1Hd7w7aVJrdVS:JxyUuQ6Ry0UxWI73gIf0EELJXei0AQU9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
- Size 4KB
- SHA256 e303213aa0c9539af77be6296f112a923258868a96d652f3820f52c21da4d907
- MD5 7ebb29068da7371f207e1d09234e4408
- SHA1 f83e091549039eb7b1711165b00b7257a5cf9604
- SHA512 99db8de4767e4b137d6dbfb28d2448ec9013b1d92de41d268812269552e52e5ecab40e5fc5201bf3acc05936e1f24bafe71a622565b06f91708dc1341ce4dccf
- SSDEEP 96:oIxyUuQ6Ry0UxWI73g1af0EnELEEXeBvYXdcdnvYQB6B45vYafH1Hd7w7aVJrdVX:JxyUuQ6Ry0UxWI73gIf0EELJXei0AQU0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\hd.vbs
- Size 245B
- SHA256 4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
- MD5 d8682d715a652f994dca50509fd09669
- SHA1 bb03cf242964028b5d9183812ed8b04de9d55c6e
- SHA512 eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\javaSetup.exe
- Size 28.1MB
- SHA256 a87adf22064e2f7fa6ef64b2513533bf02aa0bf5265670e95b301a79d7ca89d9
- MD5 f2fd417b6d5c7ffc501c7632cc811c3e
- SHA1 305c1493fca53ab63ba1686c9afdfb65142e59d3
- SHA512 289ee902156537e039636722ad5ac8b0592cf5cffda3d03cf22240003627b049382b95db1b24cf6a2f7134b0df93ede65a80a86381fc161b54c84a76ed04458b
- SSDEEP 786432:rLJxuM2ZsoLm7kttLbfwfmwuf1kqbunTn:51ktdbGmwut/Iz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 22KB
- SHA256 e0e88bda4bcbbcfadb1009060372744f8b3f3628ae29b1d310a99255ec76aa7a
- MD5 525bf7f5b63ffd5e86fa3aee92551c21
- SHA1 bf3cd939fe57f5076afbd231cb5b1b0ea03ba5d0
- SHA512 825d048f8a3eb7ec88bda27eaf34b5c05a9545a12d48d29fc264aeae571fb2b4aa2957cd1b5459d53dc5d18b7968760d47136a6ec099c5612c3a7ab677b24d73
- SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TP:c8L6gWt4wnAQ7WTb6aotVhP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 23KB
- SHA256 f7468e1cf9cb05006bb7eebf4ce106f98828351ac7d8637486794ba90e5f5bc2
- MD5 18f48d6714640435ab93cad409e10070
- SHA1 fd33c178274fb08adb77cf5c695ce29ba32417bd
- SHA512 632e4957e610ab787ed9a2cf3e8d988acb16e4cfc4d4df9b52682ca54fa4f7fed980b7b5dd69b1c4dd71554894ee5e5199da630b721f3c7403652f923a16dcc1
- SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXUO:c8L6gWt4wnAQ7WTb6aotVhkV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 23KB
- SHA256 3532daff57c2b70280ef79edf17af55d108b2d46b88bdbf248fab74db2a43d14
- MD5 a2623660c345873243bb8f88145663b5
- SHA1 d8cabac7b4057649bb6ca31504719fb0881c7190
- SHA512 60dc96479ae28a9011dee7a2e8ff2cb60ab548a6164ba8f5562fcd1cb154362677a68c98c62aa62333ac9812d4ddb3e332957efdbc5acfb5eade18f111c21f6e
- SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1F:c8L6gWt4wnAQ7WTb6aotVhk2p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 24KB
- SHA256 1e1a1fcf7c15b8f6019b1696765c696e69a510bb25fd29daa4f8286b206e738a
- MD5 e2aaff5f40ba3fbc2df129ed2157dd19
- SHA1 8d6b9aeeae45922687e24365cecffdc0e4997f08
- SHA512 e1e5a42c4b5bac65b4747b149a694d738fe7e4e7c5398ef564885796e4d9d3cf5ae4ef1cd2066dd6ba24463654c090d79ac84e0f1ad76575155deab8088e6843
- SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ6:c8L6gWt4wnAQ7WTb6aotVhk2m0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 25KB
- SHA256 f46f4d796f236751d277dc24184765679d409c0e454ae07587ca09e0710a0f1f
- MD5 250dd63c170bf6cc59e2a7a34edb348b
- SHA1 da811a6038e340332de88fe1c2a574ee1bb8a8a8
- SHA512 ffc14529043f3231ace3beda1cb14de9ef37d24221d462138eb8fe9cb255eacba42bb864e41a575b7c14773ae577f6e44afcd408f2415678f1019895e3c376c4
- SSDEEP 192:c8PT6gnLBktLsDTjvcNlAjcsa25TbTifYuhazEoS5TSm+439TkXU1Oo1irJ5SuJk:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aih
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 26KB
- SHA256 a0da062ab80c0dc8d84f51bd76faf53001cd4b48bcbc0ddae6d75e210ea92ccb
- MD5 6395ef19c45e81bddd74837a1394acb5
- SHA1 92a97d8fa5c76891d0df4b4d9812370ee85859b9
- SHA512 5bb7439566d386aa46774e71378284fff75855f2b5971345d54e5142a23a9488a49b1de2a9533d37cb3f33c8d50cc64727daac7c96ca6dd3779144379a068fdb
- SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4K:BL6g648Hs6aotE2mzViqK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 26KB
- SHA256 2f0f162f348b4020566418fd30c090fac83883284dde7c163b923f68d0886c69
- MD5 cc147c8509b89de26462cd73e51d3df4
- SHA1 b37e85f40a18c1832530a760b309799378f7f6a9
- SHA512 b8ef88fc7c91371605dc12a6fae41fa576836ad7eecbf728cd78ab5de9b235c221d5f43d2e9f9adc234f6ae5c3e823dd1b213aaa0340aa8d341015ad393a3e93
- SSDEEP 384:c8L6gWt4wnAQ7WTb6aotVhk2mzb8aiJ4Jt:BL6g648Hs6aotE2mzViqJt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
- Size 3KB
- SHA256 e4ec0be84abe59c42dc1daf21acf9e0406a42afca353bfaca342f2a1c33e1c91
- MD5 f009f87f76ee4d6bc0e973b7c573c4c1
- SHA1 14d25f0f1f06568f3479b50ff246995cca0eb376
- SHA512 701c196000960e34c99407b2a5a4f7b32b4a9079faf8840de68d341db1144fed19b6d5977d449cb53d05874f6125b6a908dcbafb51eb0ec2105e78235399faf5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\jusched.log
- Size 163KB
- SHA256 839368f3074d3dc508623354aa12bacdbdd2f55727940159e5ae2dbf9b4e4920
- MD5 644aff6751d96067f5d0cad9af2df72b
- SHA1 7b5269ce7f2e6433d99f6b20d9e3c58522d24794
- SHA512 77cc1848253a13c4803e7efff5ecf6de6d3481638cd1a74a72b9540721a885865e95abd8fd2d7575b64a4d57527d0fd50d443ff64aa53dc999df226698273441
- SSDEEP 3072:vQK5NET86OXlYUBtV9hu/RH5GCwbbJCn8DcurCJcw9t:Mml4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jusched.log
- Size 163KB
- SHA256 a73679214cf15ffa62f4ca26c6d08925f216bfca30941e9b465dcb9d0a47b50a
- MD5 3f83bf4d0381519b1fef4bc89631b28f
- SHA1 72b478377bb2ceca170f019fc449cfd2ad9ba7ef
- SHA512 f11ce806a89895532d3a26826e112c5365b91da9fae94e8e4339f0374686447de550b96a593837fba5f0def7cb5a502438de457306e3bc2e0c1815c8ce4c9ffd
- SSDEEP 3072:vQK5NET86OXlYUBtV9hu/RH5GCwbbJCn8DcurCJcw9N:MmlM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jusched.log
- Size 163KB
- SHA256 342150ba493a5dcec543f4892f72508e39cec16f90df015d884185c0b4e43773
- MD5 a6d926b9de213f13cf8c036d4b922f4a
- SHA1 fe64d0f7b3451bd314cde4839ef0f21d74817a9a
- SHA512 be3076405a67b0d0b61a28c0637c5b9df448fd924e1cfec725d127302644f71963eb4f07e430708af1af0e5771dd2eed29d0cb90582fb50c0e27b92b34451ab4
- SSDEEP 3072:vQK5NET86OXlYUBtV9hu/RH5GCwbbJCn8DcurCJcw9t:MmlU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Zona\active\56867D583A2FA389E2D57CA8B5CD51DE2F057836.dat.bak
- Size 28KB
- SHA256 6a4b6e6c02b85cbf55449d40c351efdfacca44fd5eedc8167652975fb3c2c13f
- MD5 c4d2d4a3ac2c844fde2248987d7b9dbf
- SHA1 ee91843693c15945b222e478ab98efdbc5c5291c
- SHA512 97f58208c3d90197f010ba9a894b2b9cd37f4d442b36fe54108bd21d649c4f80ef4b11bf79e7bdc2b3c19f2562baecd8fd12c6e5f698c0facac3f222934fd7c4
- SSDEEP 768:H/K4DiTpXlzhTxQWS6HQ5oPkHtEM21jpk6GucaVMgt:fK4+Tp1txQXjoP8CM23DZJLt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Zona\active\56867D583A2FA389E2D57CA8B5CD51DE2F057836.dat.bak
- Size 28KB
- SHA256 614b8658b819705541a06738801c27e30518e4ca12371b166f004be2fbfcc00f
- MD5 9debcf0878c1d50c826e32db2adeeefb
- SHA1 2aa1ceebcb93e99ce0a7181d927b303687b177e8
- SHA512 5ca107b8400387b477109969b3e370848a5297fe6c34d0e84911190c2f5ea660cc750c25bcfcdf83f53e06ee6667ee46c454e8f0a65ff6fb4541f0ba8e78abfd
- SSDEEP 768:e/K4DiTpXlzhTxQWS6HQ5oPkHtEM21jpk6GucaVMgt:UK4+Tp1txQXjoP8CM23DZJLt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Zona\active\AD33DFF53A46663BC9909B86FF1AE8454732F713.dat.bak
- Size 2KB
- SHA256 b3586cce8336726117109efaaeffb515e27c2b69b3a5b8967c941b9391d46098
- MD5 9047ad03d11f2458b1c2ced6671aa549
- SHA1 abdd2f07e8973190b1ae7da60bc3bf0aaa770317
- SHA512 1818db06d2731ade5dca0f137518e3e4aa8cf507e2d77ba1d20f00042018687c8fc7f0f102a4d16f1932acebe35d293f6f6837ba1d02c755cf2c0f7b66799e2e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Zona\init.xml
- Size 380B
- SHA256 ee51a70c10593055c347de75aa8630e3ccb3b70f0b1659e5fcd6c2813f334608
- MD5 f5ee69fbead8eaa7f3f0e60a0e68a25f
- SHA1 1ef31dab5005fcfd81261ea893b6fa7710f0459a
- SHA512 729652347c9b04d923f0391e9e9896eeebab993f657d5b4abf3e3697be71a6b624b5c8514330d58a56f97b1925d3ef99ccf89362fb799a0f440dc59f833c2c28
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Zona\launch.log
- Size 2KB
- SHA256 84049fc80af7b72fb6457c162cd9625478c4ede867349bf6e0c896051d266411
- MD5 b22542301a5a1807135eae11b95855ef
- SHA1 1eee9ba820a19941b5f52665b95b59a870f10349
- SHA512 68c6fa04e44ccb7ca217de3dca45c212ad8e43ddc7ee4a5340f80ec8213de25d156840c38d717640809275d4a5b9083322d1acafe7e7d24a309c027adb3e05c7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Zona\launch.log
- Size 2KB
- SHA256 b4b667beacf9a03715f482390cf6aaae68851a981e70438df8bbb8bab745bf96
- MD5 3f66da70e3bdaff1a1ef82df31c3b446
- SHA1 fff921eb5c7a29e193f58dd3cf363f81260dd966
- SHA512 022a3e744c9bc28b598ac7d9ea47288ebc12e5d8deda335109a102ca1710744b7c5331989dd95ffad69e63dfee788609090a86fc1d3e1ae87f074373f9fcc374
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Zona\launch.log
- Size 3KB
- SHA256 ed558b19df3573fcfa802bf5539b7f525c4b828ce4883a8a0b9688364acba3ba
- MD5 ac51c593b0375b4dbe5911b6d6be937e
- SHA1 d05c5a3a007360b5f3ab3bb45b05f112d2be13a6
- SHA512 b58ec5f5cf6927520b122c4d3ac851e2c2483b2bbc9bb5bd177a224a0e590c6906aeb130a0bc3d30c6e22e2e79ea1453f9c1bd0ee5025de82ddc5ac7314e21c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Zona\launch.log
- Size 5KB
- SHA256 147df4dcfbe9d34035b55bd02a755e00a4b0b2658af55639e6fcaeaba37b191f
- MD5 75897e5bbca36a7fe75706a8107f8b35
- SHA1 c3da61475c9a11cb279cffa16ebc0bcb5bb20b42
- SHA512 fdfe46d6cb59599319482261299d4c20bb998d55a81bda3d29e7f45ad4047f140025a428f712e8abdecd23f5a98e137b0e5d58106c3fd2029ba9effe910643c2
- SSDEEP 96:oI+yEV1LIFJMk42XRhSTIX0YXsk/iI/igq/iIsbW4mmSXSCDHouDHahnFsEU55W3:J+yEVlIFJMk4yRhSTIX0YXsk/5/5q/5q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Zona\torrents\AZU121997980864441330.tmp
- Size 28KB
- SHA256 ce03e50d68c97ce903cce1d337b8b45d5df43cbf5fdb15fec4b19ea55242ad76
- MD5 cadd1d3521af856893bde2a1db1804b1
- SHA1 a0a9f1a3b729af16555972302e75035776c111b7
- SHA512 503a432c79ba9970f38cc5aa8e5f99e9b11ddd862badfd22050db0d65780b87688d286dfab3164dfeb86d5a03f8260c251a021b4e76ae47060fb3853e6dab6e4
- SSDEEP 768:n/K4DiTpXlzhTxQWS6HQ5oPkHtEM21jpk6GucaVMgS:/K4+Tp1txQXjoP8CM23DZJLS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Zona\torrents\AZU2201005529028704900.tmp
- Size 2KB
- SHA256 3cc41f98b945d748ed39ea56066af2e741f5655741f81af53eae2d8b410aa297
- MD5 bd65d21df8506111c23014aef6b990a5
- SHA1 83e3e46cb5e5fff77cd6565bb9ce2ae58bba09d1
- SHA512 41bf0cd4d2999f0887f5e9d68fed1f45c934730f8c7114eece862049a124d838f28e51bc8572fb9dab14512824167a4b71142c3d302bc736d73d97e6b9cf6828
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSID496.tmp
- Size 202KB
- SHA256 bf4e4c75d148cb412e28a0b4e665919fd5ac6b9aa6bc3fa75401394759218d5e
- MD5 9f84d910602183954bed6d9660600783
- SHA1 82e3b122dc63e0a333bca531dd16667d5fafbf23
- SHA512 09fb450e6c6f22a32d5e06f470070aab17d4973afe307b529093af7fa29ab96b61a89814e4964d005459f8ebb25716134a5e1c41f6ea7d260361b135306544b9
- SSDEEP 3072:nCYl9W8fZ2MaPI/K4W7AfchMoCzWNb/sVq5+/DzaRspvh:nHlg8fZ2MfK4dUyoyu/x56u+hh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\ZonaUpdater.log
- Size 2KB
- SHA256 35a99dcec16f98d85124e4274ca68d2c78ab38e76c6b34ea1cb67152b5ab6768
- MD5 8d3dca21ea97c232b00996d7b7618c93
- SHA1 05495c4078d6d5b8d2bc7545fc91888ce7c167b6
- SHA512 f93984e2b48d62eb1664eb2629e581643569f6855ec26f5dfbb2976a5fb31828a50539da470844c0176c18f9f8ddd3544d526a8835df5ff6db605b0e24334155
- MD5 SHA1 SHA512
- Path C:\Windows\ZonaUpdater.log
- Size 2KB
- SHA256 0dc58a61f4c6dd81d9f2f0a515c2359a66b4c694e838969a67bd68a52b2b2c12
- MD5 c396d97eb6c185c6a839fd7d5bf587ef
- SHA1 d69fea7a336b30a4ba44e2ed2ff7fcd5a7d684ca
- SHA512 2c8de24865c582d2da30c4bfb52ddec7ac8be63adc71c3b6455146864f1a2ed28e769eee13310d5c84bad85d3ad665d20f2a605f82674cefee3a56ff5b523c22
- MD5 SHA1 SHA512
- Path C:\Windows\ZonaUpdater.log
- Size 3KB
- SHA256 18a0f59d2d9a13cffa1a08e6574e4c7165d0613bd5ff36fd4875c8e09af137e4
- MD5 85ffddfe0c82cc927e7a4b5902ae2ae0
- SHA1 1588c5df47e2a60eb56c5847a723f29f09cdc630
- SHA512 1b8a4962d3ce7c22a85768399cb843c816391e0115816316e147cf93ab9de4f31e46aadb8912c7ebf422b1b68526c01075ddde2f6c3cd118fad403120c785fde
- MD5 SHA1 SHA512