d99eb213b11b84fed4d0ffbb7595c77c7b952035a9025ed062c2d9c95ea22a8e

Analysis

user interaction
yes
max time kernel
107s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jre-8u501-windows-x64.exe
Size 69.0MB
Sample260808-v97eaabj5v
SHA256 d99eb213b11b84fed4d0ffbb7595c77c7b952035a9025ed062c2d9c95ea22a8e
MD5 bc25fff67a597194a0cf9f5bcc95d5fb
SHA1 da87a3326719adbc75f47af419d0655cfe83a22b
SHA512 ae53e00ecd5ac1beefd283cdbf184e4f5872d97a2815c4055ff34b263633df89d63d33da0349e8ada791f4f6ddfd62423f72b054079989aad873a8996dd20bcc
SSDEEP 1572864:GlOkrWiU2IupQIMc2IdOIzR8jd/41+ybBlkSDL:GlOkreOj9XY5le+yb7fL
TLSH
T15EF73306A7A44168E0FBE278CD274607E6B57C4643B1828F379D95962F333E09F7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
147	2728	msiexec.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
107	4376	chrome.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	MSIF5DE.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	installer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\WindowsAccessBridge-64.dll	installer.exe
File opened for modification	C:\Windows\system32\WindowsAccessBridge-64.dll	installer.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_common.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\javacpl.cpl	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\plugin2\msvcp140.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\rt.jar	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\bci.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\lib\jfr\profile.jfc	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\plugin2\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\kinit.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\java.policy	MsiExec.exe
File created	C:\Program Files\Java\jre1.8.0_501\lib\management\management.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\lib\javafx.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\legal\jdk\mesa3d.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\lib\resources.jar	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\lib\psfontj2d.properties	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jpeg.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\glass.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\lib\deploy\messages_es.properties	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\JavaAccessBridge-64.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\jsound.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\lib\meta-index	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\lib\cmm\sRGB.pf	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\legal\javafx\gstreamer.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\jawt.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\jli.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dcpr.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\deploy.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\calendars.properties	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\logging.properties	MsiExec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\legal\javafx\icu_web.md	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_common.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\lcms.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\legal\javafx\public_suffix.md	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\lib\security\policy\limited\US_export_policy.jar	msiexec.exe
File created	C:\Program Files\Java\jre1.8.0_501\bin\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\instrument.dll	MsiExec.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{77824AE4-039E-4CA4-87B4-2F64180501F0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA44.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE45.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI485.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI15F0.tmp	msiexec.exe
File created	C:\Windows\Installer\e59d1fc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC00.tmp	msiexec.exe
File created	C:\Windows\Installer\e59d321.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEAA1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5DE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1620.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1217.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d1fc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE04A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE455.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE35A.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE8A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1650.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF4F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE63B.tmp	msiexec.exe

Executes dropped EXE 6 IoCs

pid	Process
2932	jre-8u501-windows-x64.exe
4156	ZAP_2_17_0_windows.exe
204	ZAP_2_17_0_windows.exe
1796	MSIF5DE.tmp
4324	installer.exe
4728	javaw.exe

Loads dropped DLL 64 IoCs

pid	Process
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1872	MsiExec.exe
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp
1796	MSIF5DE.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4324	installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4376	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\ACTIVEX COMPATIBILITY\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	MSIF5DE.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_501\\bin"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{44D1B085-E495-4B5F-9EE6-34795C46E7E7}	MSIF5DE.tmp

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0178-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0060-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0169-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0325-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0337-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0079-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0111-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_111"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0102-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_102"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0193-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0235-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0038-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0052-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_52"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0198-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0188-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0196-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0331-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_331"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0145-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_145"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0147-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0077-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0247-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0294-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0085-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0079-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_07"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_12"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0170-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_170"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0253-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_253"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0061-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0097-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_64"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0088-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0212-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0134-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0178-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0058-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0285-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0327-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_327"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0043-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0072-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0073-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0110-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0182-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0215-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_215"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_50"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0093-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0270-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_270"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0275-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0293-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0326-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_326"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0349-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0239-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_239"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0283-ABCDEFFEDCBC}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0036-ABCDEFFEDCBB}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBB}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0069-ABCDEFFEDCBC}	MSIF5DE.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0174-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_174"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0340-ABCDEFFEDCBC}	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0105-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0164-ABCDEFFEDCBB}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0182-ABCDEFFEDCBC}\INPROCSERVER32	MSIF5DE.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0090-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0058-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0072-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0143-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0123-ABCDEFFEDCBC}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0124-ABCDEFFEDCBC}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0260-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0212-ABCDEFFEDCBB}	MSIF5DE.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0048-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0197-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_197"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0233-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0045-ABCDEFFEDCBA}	MSIF5DE.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBC}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0033-ABCDEFFEDCBC}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0118-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0228-ABCDEFFEDCBC}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0315-ABCDEFFEDCBC}\INPROCSERVER32	MSIF5DE.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0070-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0060-ABCDEFFEDCBB}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0068-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0367-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0070-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0096-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0146-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBC}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0163-ABCDEFFEDCBC}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0170-ABCDEFFEDCBC}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0026-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0226-ABCDEFFEDCBB}	MSIF5DE.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0162-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_162"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0178-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0137-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_501\\bin\\jp2iexp.dll"	installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0182-ABCDEFFEDCBC}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0181-ABCDEFFEDCBB}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA}	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0129-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_09"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0217-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0287-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0210-ABCDEFFEDCBB}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0029-ABCDEFFEDCBB}	MSIF5DE.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0011-ABCDEFFEDCBC}\INPROCSERVER32	MSIF5DE.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0221-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0312-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\INPROCSERVER32	MSIF5DE.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0154-ABCDEFFEDCBA}\INPROCSERVER32	MSIF5DE.tmp

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2728	msiexec.exe
2728	msiexec.exe
2728	msiexec.exe
2728	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2932	jre-8u501-windows-x64.exe
2932	jre-8u501-windows-x64.exe
2932	jre-8u501-windows-x64.exe
2932	jre-8u501-windows-x64.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1656	2456	chrome.exe	89
PID 5072 wrote to memory of 2932	5072	jre-8u501-windows-x64.exe	90
PID 2456 wrote to memory of 3108	2456	chrome.exe	91
PID 2456 wrote to memory of 4376	2456	chrome.exe	92
PID 2456 wrote to memory of 3108	2456	chrome.exe	91
PID 2456 wrote to memory of 2708	2456	chrome.exe	93
PID 2456 wrote to memory of 2708	2456	chrome.exe	93
PID 2456 wrote to memory of 4564	2456	chrome.exe	95
PID 2456 wrote to memory of 4956	2456	chrome.exe	96
PID 2456 wrote to memory of 4564	2456	chrome.exe	95
PID 2456 wrote to memory of 4956	2456	chrome.exe	96
PID 2456 wrote to memory of 1948	2456	chrome.exe	97
PID 2456 wrote to memory of 1948	2456	chrome.exe	97
PID 2456 wrote to memory of 4320	2456	chrome.exe	98
PID 2456 wrote to memory of 4868	2456	chrome.exe	101
PID 2456 wrote to memory of 4868	2456	chrome.exe	101
PID 2456 wrote to memory of 2616	2456	chrome.exe	102
PID 2456 wrote to memory of 2616	2456	chrome.exe	102
PID 2456 wrote to memory of 3960	2456	chrome.exe	104
PID 2456 wrote to memory of 3960	2456	chrome.exe	104
PID 2456 wrote to memory of 224	2456	chrome.exe	105
PID 2456 wrote to memory of 1736	2456	chrome.exe	106
PID 2456 wrote to memory of 1732	2456	chrome.exe	107
PID 2456 wrote to memory of 4448	2456	chrome.exe	112
PID 4156 wrote to memory of 204	4156	ZAP_2_17_0_windows.exe	117
PID 2728 wrote to memory of 1872	2728	msiexec.exe	120
PID 2728 wrote to memory of 1796	2728	msiexec.exe	121
PID 1796 wrote to memory of 4744	1796	MSIF5DE.tmp	122
PID 2728 wrote to memory of 3560	2728	msiexec.exe	125
PID 2728 wrote to memory of 4324	2728	msiexec.exe	126
PID 4324 wrote to memory of 4728	4324	installer.exe	127

C:\Users\Admin\AppData\Local\Temp\jre-8u501-windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\jre-8u501-windows-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\jds240685234.tmp\jre-8u501-windows-x64.exe
  "C:\Users\Admin\AppData\Local\Temp\jds240685234.tmp\jre-8u501-windows-x64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2932
- - C:\Program Files\Java\jre1.8.0_501\bin\javaw.exe
    -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_501\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
    3⤵
    PID:4672
- - C:\Program Files\Java\jre1.8.0_501\bin\javaw.exe
    -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_501\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
    3⤵
    PID:3948
- - C:\Program Files\Java\jre1.8.0_501\bin\javaw.exe
    -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_501\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -systemConfig deployment.expiration.check.enabled false
    3⤵
    PID:4044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff82320c728,0x7ff82320c734,0x7ff82320c740
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,17963623121332295957,17717596247923090851,262144 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,2978046635867902519,10542317387308083735,524288 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,12336689952827630175,6040541765058485181,524288 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,4268642202387087178,1718154970410826701,2097152 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,16673165145942638901,6738144421830750501,2097152 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4636,i,4322091656026709505,3774253085016299355,2097152 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,16321129232487986622,2301300567430330891,524288 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5328,i,6149323405459652550,6393632719693741226,2097152 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4480,i,10508729342488383070,7452086462578629845,2097152 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5848,i,2019679817105948555,6789658198984803137,2097152 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,7437916205793240047,12270101952503837433,524288 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,11762894555645380094,6009349177207806859,524288 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,802206888418006652,354388968385102688,524288 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3396,i,8571821525058667207,2949651411754064767,524288 --field-trial-handle=2088,i,9949157761629630511,12524731965886582518,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:4448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:64

C:\Users\Admin\Downloads\ZAP_2_17_0_windows.exe
"C:\Users\Admin\Downloads\ZAP_2_17_0_windows.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\Downloads\ZAP_2_17_0_windows.exe
  "C:\Users\Admin\Downloads\ZAP_2_17_0_windows.exe" __i4j_windel "C:\Users\Admin\AppData\Local\Temp\i4dAB99.tmp"
  2⤵
  - Executes dropped EXE
  PID:204

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 34765DAEB42F95D5C3F57CEB1870B8DA
  2⤵
  - Drops file in Program Files directory
  - Loads dropped DLL
  PID:1872
- C:\Windows\Installer\MSIF5DE.tmp
  "C:\Windows\Installer\MSIF5DE.tmp" INSTALLDIR="C:\Program Files\Java\jre-1.8\\" ProductCode={77924AE4-039E-4CA4-87B4-2F64180381F0} /s
  2⤵
  - Installs/modifies Browser Helper Object
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
    "C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -u auto-update
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7D3CC7A62C59DB0B701D7B36895A9790 E Global\MSI0000
  2⤵
  PID:3560
- C:\Program Files\Java\jre1.8.0_501\installer.exe
  "C:\Program Files\Java\jre1.8.0_501\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_501\\" WEB_ANALYTICS=Disable EULA=Disable INSTALL_SILENT=1 AUTO_UPDATE=Disable SPONSORS=Disable REPAIRMODE=0 ProductCode={77824AE4-039E-4CA4-87B4-2F64180501F0} TMPPINGFILE=C:\Users\Admin\AppData\Local\Temp\jdsping240685890.tmp
  2⤵
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Program Files\Java\jre1.8.0_501\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_501\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
    3⤵
    - Executes dropped EXE
    PID:4728
- - C:\Program Files\Java\jre1.8.0_501\bin\ssvagent.exe
    "C:\Program Files\Java\jre1.8.0_501\bin\ssvagent.exe" -doHKCUSSVSetup
    3⤵
    PID:1780
- - C:\Program Files\Java\jre1.8.0_501\bin\javaws.exe
    "C:\Program Files\Java\jre1.8.0_501\bin\javaws.exe" -wait -fix -permissions -silent
    3⤵
    PID:5056
  - - C:\Program Files\Java\jre1.8.0_501\bin\jp2launcher.exe
      "C:\Program Files\Java\jre1.8.0_501\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_501" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTAxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTAxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUwMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MDFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUwMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTAxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTAxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      PID:3468
- - C:\Program Files\Java\jre1.8.0_501\bin\javaws.exe
    "C:\Program Files\Java\jre1.8.0_501\bin\javaws.exe" -wait -fix -shortcut -silent
    3⤵
    PID:4456
  - - C:\Program Files\Java\jre1.8.0_501\bin\jp2launcher.exe
      "C:\Program Files\Java\jre1.8.0_501\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_501" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTAxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTAxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUwMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MDFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUwMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTAxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTAxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      PID:4012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7C21BC7CD85774BF9FA2867598D4C336
  2⤵
  PID:4544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AF41F13E0F74065BF11DC00DC4451B1E E Global\MSI0000
  2⤵
  PID:4960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 696DC6A796F533972D73958EA695CC64
  2⤵
  PID:4740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5FEEF57AC9CD928AA55A0DA07701E51C E Global\MSI0000
  2⤵
  PID:844

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
1⤵
PID:2332

C:\Users\Admin\Downloads\ZAP_2_17_0_windows.exe
"C:\Users\Admin\Downloads\ZAP_2_17_0_windows.exe"
1⤵
PID:3312
- C:\Users\Admin\Downloads\ZAP_2_17_0_windows.exe
  "C:\Users\Admin\Downloads\ZAP_2_17_0_windows.exe" __i4j_windel "C:\Users\Admin\AppData\Local\Temp\i4d933A.tmp"
  2⤵
  PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59d201.rbs

Path C:\Config.Msi\e59d201.rbs
Size 105KB
SHA256 769dd0f7773ce1971996dafb23b4a99e0c277bafbb520191b46e775b0fc002e6
MD5 e6e8994484f88c4847fc4878f4921cc3
SHA1 3d9a448395d5767fe911e97aaaa4f4f294966594
SHA512 0d764b51a5be0f87e99b441d379312d829872fe69ed99ac11baa1090625d27dfc3bf50d81dfcd3ffc43f0a8c3239a1db92eaddcb627f95120e40b82e76dc5367
SSDEEP 768:1q6DoTnT6Z+j1VhhTZvd+GhOAqe5jmh35z3gWuvxrtlttt9/:uT+ZY1VZvcGhOAqely3tPuJv
TLSH
T14CB3BC632B95E6D5F55236F06F290A29CF868ED41228001FE7BEC24EDF363957D16C28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59d320.rbs

Path C:\Config.Msi\e59d320.rbs
Size 998KB
SHA256 ec531fdba07c9da1b41754d7d839ad125ef22c8279db03c78f91e2e86b878299
MD5 0dbdf1269062d594bb58e50a8e90ae51
SHA1 7f780870801e485f686e25ff5bacd2a4bbc26358
SHA512 feed232861a63b145545076a95b83ee8b000c6b3d97f6acb0f44a9a0cfcbd499ce43e0f73e2727ec214ee417ed8ac9ffb43721f62025f754b90a06f7e56d981b
SSDEEP 24576:k9bC2bPeoj+FGkiQeLgt3S1s9YZH8QTpvUxEAey:k9bFbPPj+0QeLgt3S1s2TpvUKy
TLSH
T101256C16AB7402ECF0F7E1B48E165417E6B5788A43B1950F03D642963F632A0DF7EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59d324.rbs

Path C:\Config.Msi\e59d324.rbs
Size 7KB
SHA256 bb5bb37bca349adb347a1859325be78561a15933040deadccab454b496d87745
MD5 b893cee9dc3cd3c313fdfc4734ef24da
SHA1 8cd87a3631547f3840a1463194e06c3f50eee8fa
SHA512 3a76e5b0df3ab66e300747e7dddc2132e732042096d988cc76867721e2b8573d151f3c54df7945a9d1c3e8605a966cccbb0ac6b8057034a83c1d255bbef7fc10
SSDEEP 96:73WD+5t48RwT/6xowj8Rwx/6CjD3DZD3tctqowXtHIL4zrjDHwuCw9FwQWu5Aafn:7msRK68Ru6eto4nTC4FpdjP
TLSH
T187F1534AA60381D3FD5E4F31DB231B3537E7D3EA835C429F00CDA6601E853897AA42E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59d329.rbs

Path C:\Config.Msi\e59d329.rbs
Size 8KB
SHA256 c753fe6d63c2d18b357b4181eb8554670575e48c7252e2b83b00a7e993cbdae4
MD5 674bfbe2424c8114db14493f787f087f
SHA1 f7a96259400efd3891e1e5d01cab927fd71ba01b
SHA512 2b30d14eacd853b854acc0aca1da67dea4368360d451e869d8441b8da8785d504924d319f61b62b0ca3ae7d4c8d81f41bb6d3bfe1b8c327cc558ae39fb7a53e5
SSDEEP 96:S3/GgIEIJt9BveOzGmUreWDkmPsCsThqoWUreWDkmPsC6jeD3tbThqowHUm5OwmS:SvGvjHenZrWqjI1rWqjxFKUCHp80
TLSH
T1340260497A0281D3F85F4B30D7171B2537B6D3EA8394624F04CD92645F8238A3FA59EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll
Size 11KB
SHA256 58a8d69df60ecbee776cd9a74b2a32b14bf2b0bd92d527ec5f19502a0d3eb8e9
MD5 624401f31a706b1ae2245eb19264dc7f
SHA1 8d9def3750c18ddfc044d5568e3406d5d0fb9285
SHA512 3353734b556d6eebc57734827450ce3b34d010e0c033e95a6e60800c0fda79a1958ebf9053f12054026525d95d24eec541633186f00f162475cec19f07a0d817
SSDEEP 192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
TLSH
T152322A829FF89483F9976E709294EA93BD3DA7C62A1181590659F1A82CD37C1E700F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll
Size 11KB
SHA256 46079c0a1b660fc187aafd760707f369d0b60d424d878c57685545a3fce95819
MD5 2db5666d3600a4abce86be0099c6b881
SHA1 63d5dda4cec0076884bc678c691bdd2a4fa1d906
SHA512 7c6e1e022db4217a85a4012c8e4daee0a0f987e4fba8a4c952424ef28e250bac38b088c242d72b4641157b7cc882161aefa177765a2e23afcdc627188a084345
SSDEEP 192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
TLSH
T1013219828BFC8003F9A76D7012A5EA43BD3D67D72951919906ADF2993C933C2DF10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 c43075b1d2386a8a262de628c93a65350e52eae82582b27f879708364b978e29
MD5 73433ebfc9a47ed16ea544ddd308eaf8
SHA1 ac1da1378dd79762c6619c9a63fd1ebe4d360c6f
SHA512 1c28cc0d3d02d4c308a86e9d0bc2da88333dfa8c92305ec706f3e389f7bb6d15053040afd1c4f0aa3383f3549495343a537d09fe882db6ed12b7507115e5a263
SSDEEP 192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
TLSH
T165423ACACBAC9103F56B6E7052D5E9937C3CE7C72560C0691A99F1982C933C1D721B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll
Size 12KB
SHA256 f320f9c0463de641b396ce7561af995de32211e144407828b117088cf289df91
MD5 6d0550d3a64bd3fd1d1b739133efb133
SHA1 c7596fde7ea1c676f0cc679ced8ba810d15a4afe
SHA512 5da9d490ef54a1129c94ce51349399b9012fc0d4b575ae6c9f1bafcfcf7f65266f797c539489f882d4ad924c94428b72f5137009a851ecb541fe7fb9de12feb2
SSDEEP 192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
TLSH
T104422AC2CAA89483F5EA6E7081A4D5437C3967C72525C0AD46A9F29D3CE33C1EB10F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll
Size 13KB
SHA256 a5b733e3dce21ab62bd4010f151b3578c6f1246da4a96d51ac60817865648dd3
MD5 0c933a4b3c2fcf1f805edd849428c732
SHA1 b8b19318dbb1d2b7d262527abd1468d099de3fb6
SHA512 b25ed54345a5b14e06aa9dadd07b465c14c23225023d7225e04fbd8a439e184a7d43ab40df80e3f8a3c0f2d5c7a79b402ddc6b9093d0d798e612f4406284e39d
SSDEEP 192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
TLSH
T1EA5219D289BCD183F48A6D706295E5633D3A978A193A813105E9F2E93DEB3C2D61493C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll
Size 13KB
SHA256 d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045
MD5 4ccde2d1681217e282996e27f3d9ed2e
SHA1 8eda134b0294ed35e4bbac4911da620301a3f34d
SHA512 93fe6ae9a947ac88cc5ed78996e555700340e110d12b2651f11956db7cee66322c269717d31fccb31744f4c572a455b156b368f08b70eda9effec6de01dbab23
SSDEEP 384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
TLSH
T127522A52E2E4F547F99BED7042DAC553AD3857C70920C0661695E6AD3CE33C0EB1462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reference Documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
Size 193B
SHA256 ee55ddf4cda30cd0f0fdb4fc2d0bf9ecca5dae113d1eddd9b935de8cc7ff432f
MD5 05a8bfa71a5f65da68bc09688a9b30c7
SHA1 1620484f5210e0e719d0363d1672501404d57bbe
SHA512 adf9dcc60912800a0a6d5884cdcdabd82e7fda43ceb49258264cf5d02fe402d36720319fe5b386f5719eb5ba7305fdb8568d126d0264402d84fffae247a49a04
TLSH
T110C0127CCD05D295E14369461B60BC18AA2E79E418DFC45D52C9DA8B5E884618C09971
MD5 SHA1 SHA512 TLSH

Submit Download

Visit Java.com.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url
Size 178B
SHA256 76db385ff852cf06aaf5598f991570977d9296eb38cf0b132c265e578f18d71e
MD5 ea2763d422170f40caef75d16dae8498
SHA1 6041b32ccbf52affb88d964a1e2be1f3e3bbba6c
SHA512 dcce54aedbea6471f620d9b8835d3ce9235ac4fe2bdd2bc48188518942ef4a58b6e6a9cbb8633235a3df3c067a9853f1e2fe3819dec8fbc85c1d03add316afd0
TLSH
T1C3C0126CC90981D4E14250861730BC28A81E78E148EEC45E52CACA8B1C454918958962
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bc2a4963c46de184bb5d5b2e282f24a510dd73e127b4eb1d369c4512eb6144a0
MD5 04ae803de3294599f0130b69b496c7c4
SHA1 d35958cca8f534627c1e0f4f1b6a584b2273d83f
SHA512 22d5a64a8c98bd99bfb21c09ad071dedb9051629825b9f18975b053edcfb709ab9dd72141a9c5ce8ad157b9e519c197e03a009f8be22294eeed46dcc1c331d3e
TLSH
T1F6E022AAD971AC3B5CF9172DA0840B86EB40135B3B90894F3A3C8109CFB4A3B058681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 c7826cbca4c4a649006168946869804890645f0b319279006683e1f61b5c8267
MD5 2f6a5cebca5be1d52032d99be874fa2b
SHA1 23ed4c4cd85540013bb7f8a3ca2cd68d3c312826
SHA512 7bb3c83eb50b35a2e408487ac57d8308c30d96103bfb2ef0cbfc13eec47d6fa57bb661b0724ae7d720e0127ebd78d01b2795962d2bc6a2e3e6f11c3403736352
TLSH
T1AB01239C3100A54BFF70C172C8F7093A63123E298093BEBE87D00D7676466FC4626636
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f4740d941de0aa68c99edf4e910182d6904808bb14fefd7a2fe9d79f725d6a55
MD5 4677882e9277483384f50f83702b6e9c
SHA1 5954b1cc4773c848829c673cf06233b485bfb80a
SHA512 25ee34612a01abbe212eb0540c65c319cd63a43a2b2e51faa41513ffd770168114d689d60d0e65c0d7259a3f3ab6990f4b1a369b8b524d61315b1ce4c070af85
SSDEEP 3:MsEllllkEthXllkl2zE/lBT/:/M/xT02z4T/
TLSH
T1BA4402096BC14406D5106230C191839113B0D4500A23674325510C625C856451C00011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 8265336a193c17c032afcd3ccef941e6160e2f74d49cf83c6a004e6b33caaa4d
MD5 b324ecfe8feeee82fbba8b41f22f1efc
SHA1 8a30406e0a5221579ded6230c9dbe53f08a1b2c0
SHA512 652b96e4a088030c807d48b629b83454c004ca71e67d96a680ba719634a2e2c81ff1c03436c3a0c3638d8835f3683dda9ee032d104dad08eea85985d004287e1
SSDEEP 192:DclwmNuk3aI8xRPj/DRYDNPh+Y6OEOd4Hmtj:DclwmNuk3aI8xRPj/DRYDNp+Y6OEOd4S
TLSH
T1B7E1BBF7C3D8C52DC91156F4AB157F1FCE2A1A28432C3C6AC9D9AE1B93E2871D21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 eacf5472933cbaa957f994c2b9851bbc0b3375aa10b4e28f28a099b6709b51a6
MD5 f6520a512a4268e20f5e4fa1c8828ca2
SHA1 dba30e76018c1509c91906b2afc7e510f9f597ff
SHA512 24d33301ccf49c36356657fbaa4a07d4d7ebfccc319c0d1f4983c07f7ef5dc6a06e9f225b5e883edf93dcba3687bf984fed09fcda37ec58fd1ebed868fa08bc0
TLSH
T1B0314BE7D1BFB46B102D48AB1D18F84A29B7A43512915CE8DB6A816DE0D64E32B11492
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c8c58951af36c19e0a709857894be8413502008178343fecda98f83600010c95
MD5 776993b1668bc076c940b838e16faa30
SHA1 c0233acd6d7a5d4e7a6884da7daa7f61cfeb469c
SHA512 c85ec3be51d344a3eb2cd9483c8e488982aefaf086d3a7d2e4fd750400c5629f913148908fe287f150684c752ee38d22fd035fdb3dbe01bc65c2ab7dff072df2
SSDEEP 192:eBRMcBzwxXDv78pAPRp2ZoND9DHsb+WNdrkC4OMerN4kwMa4cVyIsnAUgraJ:wRMmzwp74UXn5w7Seqsale
TLSH
T12452A62AAD10293B9CEAD229FD567763D3F6202171D41E94FAFC892C14EB5CC3227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 88d39070e15a4841e2858cb8f35675df9ab0f9ebdf906abcaee10868afbaf475
MD5 b8d5ded9a4ef4e9d16048341a19e5d5d
SHA1 78c707459135f972ff37c8aafca0afa276612c80
SHA512 1c4027488b062a26effb43f7458513030e07ee23bebafdb02a3a11c1c1c793377181b87f9cdc1c4b01487e724405612ca36a5405b2a2e3302cb24b2cf1f105b4
SSDEEP 192:eBRMcBzwxXDv78pPPRpTZoND9DHsb+WNdrkC4OMdM72mN4kwMa4iVyIsnAUgraJ:wRMmzwp74JXc5w7Sy2lsaxe
TLSH
T12B52B72AAD20293B9CEAD229FD557767D3F6202161D41E94FBFC892C18EB5CC3227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ddcab3ba80ce22733d07ea4c50d9695a0ee39fbc8e70144fc9bd5f16d09825cc
MD5 ca4647057210f8f3bd20913299766459
SHA1 0efe86eaf54c8746e739f249b43b260cb7380334
SHA512 909733f2b54df3411362575325075836de693a6ac6d15597dbfa882001d065732c38801abcb0711ed40acdf7571c5dfa618dbe75fc0f78362f6f6750199dd752
SSDEEP 192:eBRskxXDv78pAPRp2ZFj9DHsb+WNnkC4Wc2UN4kwMa4nVyIsnAUgtaJ:wRskp74UXK5wde2Tsak8
TLSH
T19742B62AAD10693B5CEAD229FD667763D3F6102171952E94FAFC892C14E75CC322B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 bcd7c0b55d3d873f9eb9ccf08c0bd55b5b872e6522ef212e56884afccb2c0fec
MD5 303f96310ab87e1cd0abc3b4a92da38a
SHA1 08bc25cefbb1226431b72dad7cfdc7ab44190bf6
SHA512 a86383b7f5dc3cf3954159697a56de7048eecdbb253daa1313843a33f1c1d3db000dbb7eaf2cc9ae9d6ed44fdd0067ed05fe75debf55cc83d4f7c8574b1abb85
TLSH
T1CDA0023405561235F01802F954A1C140AB305D25068657D740D442549C601844131846
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 90d36393d0a897e2dd919101e8987222e5e5c552d387322a91f9435f254e7d64
MD5 b4a2a8f6ed99b8120622628a782d202b
SHA1 6fa19d6f0feacd94894a4958f6357452a56b50d4
SHA512 ce469dad6b864e1fbff9bce88608986e9fe8506e04a64536bfef008d13feb984ded7e2340293dc9e8d33c427b4725d82185d0669710da1be56d714579fe2ec8e
SSDEEP 6144:C1ThxNPRW2PYddqmY7U52F0m7Rkm1tYpBeh2BAoH:WlXPRW4Kq97UAZ9oBGcAoH
TLSH
T1B03423227CB5A9390C69FE1D304E3C2E1EF28FE9D464AEC6D8C46F0836AF9441C06974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c305e2b8c67f67ee9b554345a019ac64c7ddd83e698f4e1eb83b6260be6be27e
MD5 b151c4c19fc0abc5d60045edeac4ae15
SHA1 9bde25ad27f3bf3d76fc336aa993dcb4ff790513
SHA512 d29af384e701452eb6cc55135ac9cbde556dfb04539dcd2335ef5894f97c08053dc6ad9a5810a82f8a4fe12fb88434e15b59dfacea95f17a0015a04aaa63daa3
SSDEEP 3072:IGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:jm7Rkm1tYpBeh2BAoO
TLSH
T121C3123B5D65E9375D78A70EB48E0B1E1EF24DA6C930DE42C8D86A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 23bd96d20ac70259b0f84ebe9d625c66abd6156c8274bcffe315133ea9bb8869
MD5 3098ce18df0e6d0b0e9a80b1bf225f0d
SHA1 0301b0646f1c9fd0287f4a0a047b83caeb09b8b6
SHA512 1714794263a78768ca5131b83d9827d6b14a89719b955b61b704e2e751b93ef613650ea04711106691fa32a6f32d2f786d685c7abaab5350b38e4dee18a0625e
SSDEEP 6144:6ehxNPRW2PYddqmY7U52F0m7Rkm1tYpBeh2BAoH:6aXPRW4Kq97UAZ9oBGcAoH
TLSH
T1023423127DB5AA790C5DFE1D308F2D2E2EF28EE494A4BEC2C8D49F0827AED841555D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 22a1fbfe5153962d0d485c6cda7213639dd2cf27b933675d8511c148d15465f8
MD5 e44a2512e6e23d57116ffd8676ce40d7
SHA1 10a6c6afcb1ce0b037cb3c69089a7b1f692162cd
SHA512 37f638d7c6bbde0b031c01f17d75b6fd4a05fe0a8ec7aae5f1a51f05844bfae7408f6949215ce1b3e976755aadade3c6dff656bff863a84f5f2a45f6ee453451
SSDEEP 6144:ZehxNPRW2PYddqmY7U52F0m7Rkm1tYpBeh2BAoH:ZaXPRW4Kq97UAZ9oBGcAoH
TLSH
T1463423127DB5AA790C5DFE1D308F1D2E2EF28EE494A4BEC2C8D49F0827AE9841555D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 04e97dc7b1ce949b382ad23566166910f829a04de0f834d0942082b50f362648
MD5 f6e80b862f0ed837f65e716e0f407f36
SHA1 8d43c2fe25e80463ef86dccc4b9e38749fa4c464
SHA512 351ad741bd94543c7badbe080b06fc674956bfa5be71ed020b4b2354fa5a3710ab008be090d13994e771952b9fbf41da29145209e5f27b8376cde0809d5689d8
SSDEEP 6144:v1ChxNPRW2PYddqmY7U52F0m7Rkm1tYpBeh2BAoH:9GXPRW4Kq97UAZ9oBGcAoH
TLSH
T1F73423227CB1A9394C69FE1D304E3C2E1EF28FE9D464AEC6D8946F0836AF9541C16D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i4dAB99.tmp

Path C:\Users\Admin\AppData\Local\Temp\i4dAB99.tmp
Size 328B
SHA256 491d89a3fc971b4d12000c0086c00e78ea10beab6786b6d670da3665edcd46a9
MD5 c63a82e3c4c09dbbd36a5a740e7299e5
SHA1 8be3cf885c43304d6279ce1f87e1c20882ef0f54
SHA512 bbf8d28fd1ee8bbe16b94d64b9178498c9fdd5125a52ce2284997a59c3e2487f93b2b71a239c69b4950da4c355b21e77dce0b7086e7455a3e2dba90d4f6a4dac
TLSH
T160E08C67B1F82001BBBB5E81AEB6B071827A38E42A09119D10C8525D4CD0F5094643FB
MD5 SHA1 SHA512 TLSH

Submit Download

i4j_nlog_1.log

Path C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log
Size 820B
SHA256 c77e0adade07a15baba72b3910eb2d7ff552cf849d322ce546b41e51041686d6
MD5 5f13e3a5f69eedb63e62625c1c47ee31
SHA1 b0d22eeb7b40fae995e4b02ae21399b889fb2890
SHA512 b257d56d264eee90411da8fd0fbaa5a21dfa9f923ded80bea6ed32614f3d89a4d771399f2d89fc615d706ddc8bef680db15f9bbfe3e3c0bb10c274c4c1e2efa5
TLSH
T16401122005D5D7C5D0769591367B77CD85A6A4262980203C7F34448633D1CDDCFD6817
MD5 SHA1 SHA512 TLSH

Submit Download

i4j_nlog_1.log

Path C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log
Size 1KB
SHA256 578701cef28df7f9c0b68c3b3f3e846c0231df3f4cc71941b1b26810f89d679e
MD5 43309a30d75ccdf603275c6ce161909b
SHA1 ab50ae5bf0f2da1abdc7ae55f4ba3db80913e082
SHA512 777b8aa32729852245bf03c9d6baab263ddfc87271df04079fec7ad57d2bcff159c185ef4723b7564fd9e835200d7a013b1c474640e8e5aa967e49aa6f5fcb57
TLSH
T1791142100390A7D9E47B958035B777CC45B6941636C01839BF3444C623E2DEECBE782B
MD5 SHA1 SHA512 TLSH

Submit Download

i4j_nlog_1.log

Path C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log
Size 2KB
SHA256 338d4e41df4a3b3325313eeef8919420c55c0189f474cb08cacc1872cef69ec5
MD5 dabb3fb7315057ee3133066ce62572b6
SHA1 f5dba166e24fe82ad79cc7f91dba5c481695c8d5
SHA512 630bae37c10282b1d482a7ac4f2c80047743fb98f35957018523eb19aa2baf57bc7d9aaea1ae730f742ecbf36896be9ec70979facc7f2bdb9b819e4f5439e56e
TLSH
T1EA41635047E2A3A8F83B945626BBB3DCCB705C4E3B84A6346FB04448A285DCFDFE1556
MD5 SHA1 SHA512 TLSH

Submit Download

i4j_nlog_1.log

Path C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log
Size 4KB
SHA256 2b98f9c0c05762d48a5617955efeff656fd19a1a7a802274ccc174dabe275772
MD5 5f5e3a1281d2f8f1fbdc4fb228309364
SHA1 fb63639917c25ef220ca97d756a25396199e1794
SHA512 78ca76e3b2633e8940da4574cfe07440138a8719883e3f99183553c79dbc311bece3df77b6157d7c7278cc9f61968b22dde540031297522da5cf38a3f53bd308
SSDEEP 96:Xt7n+fL7y7C9JEfJYV7/z/Yk70atNqTxVzmKQIMdnTcdTdvHc+OV1OVnaYaf:XtL+TO04OVNhmS7f
TLSH
T1C081CD8196E7EA7DB537942635AF76DCCA600C4C3B55B7305FA0C44CA281D8F9BE07A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i4j_nlog_2.log

Path C:\Users\Admin\AppData\Local\Temp\i4j_nlog_2.log
Size 829B
SHA256 3988888c4895d145f81376906ef8b091407adfa2427ad52d3a1894d5cd78a65b
MD5 eeb5ab83784d6f7fec32df3d230c7766
SHA1 e7db69baee3caa7bf0defed74cf53c7a585d12bb
SHA512 dafb45fea4db6ff600be3d5cc15c56fd580de1e3b71216d5bff12c02475bde364359e1a54ca625dfd0be8ec2f63c445a288bfb0b0c8c19a865e53b71725b92f4
TLSH
T1130141B106C2E789E0B695D126B9B7CC85A6B80338C02135AF78044632A1CEDDFD7837
MD5 SHA1 SHA512 TLSH

Submit Download

i4j_nlog_2.log

Path C:\Users\Admin\AppData\Local\Temp\i4j_nlog_2.log
Size 1KB
SHA256 629b8320de42beb2a2e078cd3a2b2fe6c6dc9d7de3489e5a083fd8653c2f1dcf
MD5 5ab88ce0f66c4c84b2abada0eacf373a
SHA1 36bda27a4c7ee59146f40c79cbc327ea746fbdee
SHA512 35133af4ee8d66cb2555e13224bc371a92649362355b9a079107df2d179339453dbd9dfd0a0f6be34606af2de1bfea43082d2b3d5b00a05ecb6559a0b575f6e8
TLSH
T1171142B103D1E34AF07ACD8036B977CD86A5940335C01431AF74088622A2EEE9AF783B
MD5 SHA1 SHA512 TLSH

Submit Download

i4j_nlog_2.log

Path C:\Users\Admin\AppData\Local\Temp\i4j_nlog_2.log
Size 2KB
SHA256 d298422889dbf282126c3f911eac1d7d588c91b9c7e88df4d88f5afa27bc2e7d
MD5 98f401a7cdf65418376e480947e0fe66
SHA1 022970cb0a9bcaafea5fa96247e1da2a00e8db6c
SHA512 30e3696a118c13ccd9401a01d1aa87b07946d8de335bc729ffc75b5b538b5a5675c13a25f63daf64c4fae4e36f10e653a19c99a009cab958fa5a98c3b1359ead
TLSH
T1EF5142A086D2E27DA42AD417263FF3DCD7285D8A378476314F304845A155EDEEAE2923
MD5 SHA1 SHA512 TLSH

Submit Download

i4j_nlog_2.log

Path C:\Users\Admin\AppData\Local\Temp\i4j_nlog_2.log
Size 3KB
SHA256 b75d5e959bd55fc25bb23cd02cf8a583f797034db9b1f5f6f1cdd8e85ccd529f
MD5 5cf00add5eb493c2e81a361f55f782a1
SHA1 4203bf7b9e8ff9997a030166da4b571c88e965ff
SHA512 6657d59ab72ff49c61d6b22aa1b04e70348df6d43ca9c77c364991ccdface43d3daa6611dc801e038dca7d62a3e1939694ae73c76fde5ce4ef4a4804fd1890c5
TLSH
T12D610FD1C5D3E37DA02AD417263FB6DCE6280D893794BA305F208848A245DEEAAD5773
MD5 SHA1 SHA512 TLSH

Submit Download

i4j_nlog_2.log

Path C:\Users\Admin\AppData\Local\Temp\i4j_nlog_2.log
Size 4KB
SHA256 1fe23e3e864d4a1195c31e8951995364adecf987f750a40733e58d51977b2e00
MD5 f65df05e83559d2baa7bc551e2844104
SHA1 b5d9ccff68df1658aad46b9acaf0e69379705a22
SHA512 39639b14bbc3a307037639142e8575cbf32692f479290875acedb7a2ae663a93b5f22e4e58c29db3d2ed661bdc0458d24612fa3382ce874305b91630e3da6fd3
SSDEEP 96:Xt7n+FK7y72vtgJYA7PZnfwjIaxRqxVAma75b4abzcbFbpcbebkbPbShJihuM9n2:XtL+sOtOAF2C/j
TLSH
T1A481BF81D5D7F23EA02AD023363FB2DCE6240D8D3B55BA345F20C848A645DEE96D5772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 228KB
SHA256 5c4597dd6e159b36524485da650917b0a441390a8a27c72b84a8c5c3f897dbff
MD5 ca721a9274926f38d06ab2bad310ab02
SHA1 ad1dbfce1c3a9758d7068b91d564bdff376cfa9b
SHA512 10431b1a041c55a7cf3d5882d91acfe1e67ab4fe409a615cfdfc183c4f3746eb004ee0597a1c72675d04c255720e1f9b3ba7b2ac48e3276a8d8bebb87a6b8605
SSDEEP 3072:xk+dizBLty6lUGDVzv5stFVbsjx22cSMD0At+FP6DObvdt:kuG62
TLSH
T19E34634AD53D88FE38235BD3C36D5E559AA21A09435E0A2C35DF82DA7484D03C92E9FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 182KB
SHA256 bd08d25c32b8263242da58c4c268bd87a73593a7fa824548564e53621dde7f33
MD5 1bb92287b4788c58cb68135950ec390a
SHA1 d12e23a2d209a1eb86a9ff4ce9ecec150175bf4d
SHA512 f519f93720c939940a8eb89945ef98d44600123dc0970dcd042f8283d25e3546d9817c6072302503f107d7a40dff4ca63fbcdc98c54cf52505f910c7b85b1232
SSDEEP 3072:xk+dizBLty6lUGDVzv5stFVbsjx22cSMD0At+FP6DObvdC:kuG61
TLSH
T1E104304AC62D88FA24235FC3C3AD5E658E920A09535E0A1C35DFD6DA7485D03C92E9FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 189KB
SHA256 b1dde8045a80134b253ee57aaf9a8f3bb21cd751579ca4212ed590f5e109e980
MD5 a4080b8e32ca32b4986d0c14835e6d48
SHA1 0af077193cfb0f34bae018eb0efa00f79a792b1b
SHA512 d82297319110ba55d5f1f18f4ac43e7598c81f0de1f83639a5eddd04ec50542bde8bdbd535b861f182d0cd84e61b09769dbecff8b7979d1d34956eb07830459a
SSDEEP 3072:xk+dizBLty6lUGDVzv5stFVbsjx22cSMD0At+FP6DObvdR:kuG6E
TLSH
T18214414AC62D88FA28235FC3C36D5E559E920A09535E0A2C35DFD6DA7484D03C92E9FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 174KB
SHA256 d25a85cdd606ebadfcfa14e0f8b891fc2a0aa078d296882c480447e18dabda57
MD5 9b5c2bfd677e6a1f3614a1788a48979a
SHA1 7d4a7361ac8f1b6e93b4afa480639d52a728e2e5
SHA512 5bab09a9de1e00fa1585f8f69b432a6a757bda3e9f3fad286f0ace4ee74d6d5bb72e4d043c68d6b5af1cedfe9b2402cc5b3b1179bb08a9cfeb86d71b6a9566f2
SSDEEP 3072:xk+dizBLty6lUGDVzv5stFVbsjx22cSMD0At+FP6DObvd4:kuG6b
TLSH
T1C904304AC62D88FA24235FC3C3AD5E658E920A09535E0A1C35DFD6DE7485D03892E9FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6A32.tmp

Path C:\Windows\Installer\MSI6A32.tmp
Size 269KB
SHA256 a7d7b98449549710b359dcacb41642e26e9d79523fb1507860ba2ed4b314ef89
MD5 4367508c0a612115c8d15c92b6ccec0c
SHA1 cf19b8fd08d65af94f519e71b7976d3699ef1cd5
SHA512 291a111cdd47182421786dec45a9cf08d10fdf2328afff60920f16eeaf8ee84e0c4c6fb2c04ab215e28473e5e4adca4ecfc80cba277dcd351797838e410d737c
SSDEEP 6144:3fL5HqSsYVIBkn8HMt+w4N+EMblQPpAOItkyBgsykeD:o7YVqkn8HI405QBJymsykeD
TLSH
T1B044AE1179C1C833D9BF12350529D7A45A7DB5704BB1C8ABA3D81E6E8F321C2DF31AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6EDA.tmp

Path C:\Windows\Installer\MSI6EDA.tmp
Size 279KB
SHA256 604fd5a39aa044bb0a852135fb76e0ba22ba6ccea9e6d3e50d1180cb37ab5532
MD5 4a95fe401730e6d5037f15aee7e61bb3
SHA1 be8d3e64e3e66f371b716e00e00a416733ba2dd4
SHA512 8eb173e061af2b26d75159c34059383ff5d531630194a875346d903b3641fec7ed9c26024190b71cddb1818e57845b6195869e2a48c597888b6dde3e4ac37e7d
SSDEEP 6144:laI8OapNZ8or4KpWvu2ULSYT/JYg5W84zKKKVn:f8Z8orVWKDJZ5W7KR
TLSH
T14054AE217991C077DAAF0A349939C7658E7DBCA04BB0D4C7A3C41DAA8E722C1DF35B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIDA39.tmp

Path C:\Windows\Installer\MSIDA39.tmp
Size 1.1MB
SHA256 3bd4635aaaafcfe39b8f1e8701c6e82930ca913c714bfb3debf33b10a3c18456
MD5 5d772f9d4c660637c489f69a897397fe
SHA1 f198ac431bb64f72edf4f70914d0da2954264fac
SHA512 d42ab3f2f005a535e40cae65aba3a5401752291f06d471482da33d17523bfa9e474a89f63be2484018baf8a9ca4987243c8d70f235441336a5f5f57ecc77a950
SSDEEP 12288:38zy/sT+200R5mGTWAr7MjNt0muuOpcQ8VXSoAeD3vM/2X5HUig1NYd:yPv9RkGiMMjNt0idrk/85Rk2
TLSH
T18A357C16A3A501ACF0F7E774DD274512EAB27C4646B1E60F039145AA2F733A0DE79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEAA1.tmp

Path C:\Windows\Installer\MSIEAA1.tmp
Size 908KB
SHA256 e6597b902da4734352ed9c65172118221708597e414b4b687cc29c71b0e3f55d
MD5 2c169c625b6f35aab52b5bf76abbc27e
SHA1 6e10678a100844c40e071f462dba80a3db0a3db9
SHA512 fa9b12cb88c61b689a797d5f378f92bbb09e81b9aae8ad2fc8640229ea6908fc426bd6c8f9f60b4724e76cd517d205ba939bec106061f339121b7168558b229e
SSDEEP 12288:qtX3eZe6sdF8vrUU5TIaMZYeCB1o6RrGf859njBvM/2X5HUig1NYb:iuZ2F8vguTZMZgK21+/85RkI
TLSH
T19F159E06A3A441BCF0F7E278D9275A12FBB57C4A4271960F03D052AA1F777A09E7D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF5DE.tmp

Path C:\Windows\Installer\MSIF5DE.tmp
Size 893KB
SHA256 d65fbde2989351ca8b43054b4659a70ae7f54b4c21ba7ce955ece4b530006ac2
MD5 d1b00a892cf35b9e7571b93cf74785bc
SHA1 146b5d317d4b6731a7c457dd1984e08f8116a50b
SHA512 45c813717e1ef93aa3822c5237b8c4106fd7d847ce4b232e39bdf94fd270343ec6317009abe0a2112b3000767ffdea1471e6d87b7a2627e7cbb1322d7a4b8ba8
SSDEEP 12288:ORX14hdvnzzY3lQIZB3Xa5nG5rSdFjfDu4s5cDgNto6A+877i:O/4hdvzzY3PB3qiGdxfd7sqi
TLSH
T1F6158D1A67A801FDE0FBD278D9165A03F6B5780B02B1962F03D145A63F532B19F7E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59d326.msi

Path C:\Windows\Installer\e59d326.msi
Size 1.0MB
SHA256 e88641d2c027df1450c60a70e76d81c3f32121d711ebe68269b9d13384fc00eb
MD5 442effa8de9d2a42efc363ecde720936
SHA1 1096cd6fb41aeafecfffe766e8d31f41951e2438
SHA512 ca4e2c10c0a013f649920da4d1fe28fe4becdd1cad265c358eab5bafd08ebf8b37c7076b3c6e87d5c614b92cfedcb2088297a5de67fc294e3563adf91edae65e
SSDEEP 24576:s1E8N1JVwdMRKSRscI1agsIk25scRNDJ7o:6bVvKtHogzscRNDBo
TLSH
T1353502227E51C076D96F0A309979C7648E7DBCA00FA0E5C7A3C43DDD8E725C0DB29A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3468-1841-0x000002D0975B0000-0x000002D0975B1000-memory.dmp

Download

memory/3468-1828-0x000002D0975B0000-0x000002D0975B1000-memory.dmp

Download

memory/3468-1867-0x000002D0975B0000-0x000002D0975B1000-memory.dmp

Download

memory/3948-2103-0x00000241A95A0000-0x00000241A95A1000-memory.dmp

Download

memory/3948-2105-0x00000241A95A0000-0x00000241A95A1000-memory.dmp

Download

memory/4012-1881-0x0000020993B20000-0x0000020993B21000-memory.dmp

Download

memory/4012-1920-0x0000020993B20000-0x0000020993B21000-memory.dmp

Download

memory/4012-1894-0x0000020993B20000-0x0000020993B21000-memory.dmp

Download

memory/4044-2279-0x000001E0F59C0000-0x000001E0F59C1000-memory.dmp

Download

memory/4044-2282-0x000001E0F59C0000-0x000001E0F59C1000-memory.dmp

Download

memory/4672-2092-0x00000240E80E0000-0x00000240E80E1000-memory.dmp

Download

memory/4672-2087-0x00000240E80E0000-0x00000240E80E1000-memory.dmp

Download

memory/4728-1639-0x0000021005AA0000-0x0000021005AA1000-memory.dmp

Download