Overview
overview
7Static
static
3VOS3000V2.1.6.0.exe
windows10-2004-x64
7VOS3000V2.1.6.0.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$TEMP/jre-...86.exe
windows10-2004-x64
7$TEMP/jre-...86.exe
windows11-ltsc_2024-x64
7V2.1.6.0/b...nt.exe
windows10-2004-x64
3V2.1.6.0/b...nt.exe
windows11-ltsc_2024-x64
3uninst.exe
windows10-2004-x64
7uninst.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 15:17
Behavioral task
behavioral1
Sample
VOS3000V2.1.6.0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
VOS3000V2.1.6.0.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$TEMP/jre-7u5-windows-i586.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral8
Sample
$TEMP/jre-7u5-windows-i586.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
Behavioral task
behavioral9
Sample
V2.1.6.0/bin/vos3000client.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
V2.1.6.0/bin/vos3000client.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
uninst.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
uninst.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target $TEMP/jre-7u5-windows-i586.exe
- Size 20.1MB
- Sample260916-spfdysbd86
- SHA256 9a0eb162c6ae2b7b191fb5402985b8ffa53132774c33b78967edc47d245e9a0c
- MD5 528e15cdb4fa3f9d9bb26c7e2de476cb
- SHA1 504d94c7cc1617b44af8d81de6fd83120b04dfa5
- SHA512 8fcf03fa1e0cdb6a27949c97b41063233e47fe3ca7a394fd5db3a87ddfb33ef67dd0679b72357422ad4beb328a69c4f5ff4aefcdd352907980f43ee294693ba8
- SSDEEP 393216:uK9j2ZaQ4A+VfDpRr4lnk+SD9THvY8LACOxidr/47R8gRe5Le6e:uK9KZj4A0Knk+SD1P9lInGLbe
- TLSH T153272211F680B132E46607354DB6DB59427BBEA46B3161CB32C973AA9FF13C31935AC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
pid Process 4760 MSI4148.tmp 1508 unpack200.exe 2296 unpack200.exe 1464 unpack200.exe 216 unpack200.exe 376 unpack200.exe 5004 unpack200.exe 1852 unpack200.exe 4000 javaw.exe 4504 javaw.exe - Loads dropped DLL 31 IoCs
pid Process 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 3824 MsiExec.exe 1508 unpack200.exe 2296 unpack200.exe 1464 unpack200.exe 216 unpack200.exe 376 unpack200.exe 5004 unpack200.exe 1852 unpack200.exe 4000 javaw.exe 4000 javaw.exe 4000 javaw.exe 4000 javaw.exe 4000 javaw.exe 4504 javaw.exe 4504 javaw.exe 4504 javaw.exe 4504 javaw.exe 4504 javaw.exe 4504 javaw.exe 4504 javaw.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 23 1792 msiexec.exe 25 1792 msiexec.exe 45 204 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" MsiExec.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\javaws.exe MsiExec.exe File created C:\Windows\SysWOW64\npDeployJava1.dll MsiExec.exe File created C:\Windows\SysWOW64\deployJava1.dll MsiExec.exe File created C:\Windows\SysWOW64\java.exe MsiExec.exe File opened for modification C:\Windows\SysWOW64\java.exe MsiExec.exe File created C:\Windows\SysWOW64\javaw.exe MsiExec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Yakutat MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Darwin MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+7 MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\meta-index MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Ouagadougou MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Currie MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\jfr.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Bahrain MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Qatar MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\Madeira MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Tallinn MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\psfont.properties.ja MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Africa\Conakry MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Glace_Bay MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Guadeloupe MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Etc\GMT+6 MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Managua MsiExec.exe File created C:\Program Files (x86)\Java\jre7\COPYRIGHT MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\servertool.exe MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Blanc-Sablon MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Indiana\Petersburg MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Kentucky\Louisville MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Port-au-Prince MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Aqtau MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Baghdad MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\deploy\messages.properties MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\images\cursors\invalid32x32.gif MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Thule MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Madrid MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Indian\Antananarivo MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\MST7MDT MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Noumea MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\npjpi170_05.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\tnameserv.exe MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Miquelon MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Atlantic\Canary MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\EET MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Europe\Copenhagen MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Asuncion MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\McMurdo MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Rangoon MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\charsets.jar unpack200.exe File created C:\Program Files (x86)\Java\jre7\bin\jpeg.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\net.properties MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\servicetag\jdk_header.png MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Guatemala MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Makassar MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Novosibirsk MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Dushanbe MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\dt_socket.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\jdwp.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\jpiexp.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\management\jmxremote.password.template MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Nassau MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Australia\Hobart MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Etc\UCT MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\jp2native.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Bahia_Banderas MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Caracas MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Antarctica\Vostok MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Pacific\Auckland MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\Asia\Sakhalin MsiExec.exe File created C:\Program Files (x86)\Java\jre7\bin\eula.dll MsiExec.exe File created C:\Program Files (x86)\Java\jre7\lib\zi\America\Lima MsiExec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI9561.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5989f9.msi msiexec.exe File created C:\Windows\Installer\e5989f6.msi msiexec.exe File opened for modification C:\Windows\Installer\e5989f6.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F83217005FF} msiexec.exe File opened for modification C:\Windows\Installer\MSI8E0D.tmp msiexec.exe File created C:\Windows\Installer\e5989f8.msi msiexec.exe File created C:\Windows\Installer\e5989f9.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4048 cmd.exe 1800 cmd.exe 1604 cmd.exe 4304 cmd.exe 4052 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unpack200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jre-7u5-windows-i586.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaureg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI4148.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000298171ba54d972bf0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000298171ba0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900298171ba000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a298171ba000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d298171ba000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "3" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre7\\bin" MsiExec.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_05" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0031-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0034-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_34" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0028-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_30" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_16" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_16" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_02" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_05" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_17" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_15" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_23" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0031-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_05" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0032-ABCDEFFEDCBB} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_20" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_02" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_33" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_05" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_35" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_06" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_12" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0037-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_35" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jnlp\Content Type = "application/x-java-jnlp-file" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.1_03" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_25" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_13" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2iexp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32 MsiExec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4940 MsiExec.exe 4940 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1792 msiexec.exe Token: SeIncreaseQuotaPrivilege 1792 msiexec.exe Token: SeSecurityPrivilege 204 msiexec.exe Token: SeCreateTokenPrivilege 1792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1792 msiexec.exe Token: SeLockMemoryPrivilege 1792 msiexec.exe Token: SeIncreaseQuotaPrivilege 1792 msiexec.exe Token: SeMachineAccountPrivilege 1792 msiexec.exe Token: SeTcbPrivilege 1792 msiexec.exe Token: SeSecurityPrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe Token: SeLoadDriverPrivilege 1792 msiexec.exe Token: SeSystemProfilePrivilege 1792 msiexec.exe Token: SeSystemtimePrivilege 1792 msiexec.exe Token: SeProfSingleProcessPrivilege 1792 msiexec.exe Token: SeIncBasePriorityPrivilege 1792 msiexec.exe Token: SeCreatePagefilePrivilege 1792 msiexec.exe Token: SeCreatePermanentPrivilege 1792 msiexec.exe Token: SeBackupPrivilege 1792 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeShutdownPrivilege 1792 msiexec.exe Token: SeDebugPrivilege 1792 msiexec.exe Token: SeAuditPrivilege 1792 msiexec.exe Token: SeSystemEnvironmentPrivilege 1792 msiexec.exe Token: SeChangeNotifyPrivilege 1792 msiexec.exe Token: SeRemoteShutdownPrivilege 1792 msiexec.exe Token: SeUndockPrivilege 1792 msiexec.exe Token: SeSyncAgentPrivilege 1792 msiexec.exe Token: SeEnableDelegationPrivilege 1792 msiexec.exe Token: SeManageVolumePrivilege 1792 msiexec.exe Token: SeImpersonatePrivilege 1792 msiexec.exe Token: SeCreateGlobalPrivilege 1792 msiexec.exe Token: SeCreateTokenPrivilege 1792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1792 msiexec.exe Token: SeLockMemoryPrivilege 1792 msiexec.exe Token: SeIncreaseQuotaPrivilege 1792 msiexec.exe Token: SeMachineAccountPrivilege 1792 msiexec.exe Token: SeTcbPrivilege 1792 msiexec.exe Token: SeSecurityPrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe Token: SeLoadDriverPrivilege 1792 msiexec.exe Token: SeSystemProfilePrivilege 1792 msiexec.exe Token: SeSystemtimePrivilege 1792 msiexec.exe Token: SeProfSingleProcessPrivilege 1792 msiexec.exe Token: SeIncBasePriorityPrivilege 1792 msiexec.exe Token: SeCreatePagefilePrivilege 1792 msiexec.exe Token: SeCreatePermanentPrivilege 1792 msiexec.exe Token: SeBackupPrivilege 1792 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeShutdownPrivilege 1792 msiexec.exe Token: SeDebugPrivilege 1792 msiexec.exe Token: SeAuditPrivilege 1792 msiexec.exe Token: SeSystemEnvironmentPrivilege 1792 msiexec.exe Token: SeChangeNotifyPrivilege 1792 msiexec.exe Token: SeRemoteShutdownPrivilege 1792 msiexec.exe Token: SeUndockPrivilege 1792 msiexec.exe Token: SeSyncAgentPrivilege 1792 msiexec.exe Token: SeEnableDelegationPrivilege 1792 msiexec.exe Token: SeManageVolumePrivilege 1792 msiexec.exe Token: SeImpersonatePrivilege 1792 msiexec.exe Token: SeCreateGlobalPrivilege 1792 msiexec.exe Token: SeCreateTokenPrivilege 1792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1792 msiexec.exe Token: SeLockMemoryPrivilege 1792 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1792 msiexec.exe 1792 msiexec.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2416 wrote to memory of 1792 2416 jre-7u5-windows-i586.exe 89 PID 204 wrote to memory of 4940 204 msiexec.exe 92 PID 1792 wrote to memory of 4760 1792 msiexec.exe 93 PID 204 wrote to memory of 4924 204 msiexec.exe 97 PID 204 wrote to memory of 3824 204 msiexec.exe 99 PID 3824 wrote to memory of 1508 3824 MsiExec.exe 100 PID 3824 wrote to memory of 2296 3824 MsiExec.exe 101 PID 3824 wrote to memory of 1464 3824 MsiExec.exe 102 PID 3824 wrote to memory of 216 3824 MsiExec.exe 103 PID 3824 wrote to memory of 376 3824 MsiExec.exe 104 PID 3824 wrote to memory of 5004 3824 MsiExec.exe 105 PID 3824 wrote to memory of 1852 3824 MsiExec.exe 106 PID 3824 wrote to memory of 4000 3824 MsiExec.exe 107 PID 3824 wrote to memory of 4504 3824 MsiExec.exe 108 PID 4504 wrote to memory of 1604 4504 javaw.exe 109 PID 1604 wrote to memory of 4484 1604 cmd.exe 111 PID 4504 wrote to memory of 4304 4504 javaw.exe 112 PID 4304 wrote to memory of 1896 4304 cmd.exe 114 PID 4504 wrote to memory of 4052 4504 javaw.exe 115 PID 4052 wrote to memory of 4684 4052 cmd.exe 117 PID 4504 wrote to memory of 4048 4504 javaw.exe 118 PID 4048 wrote to memory of 2276 4048 cmd.exe 120 PID 4504 wrote to memory of 1800 4504 javaw.exe 121 PID 1800 wrote to memory of 556 1800 cmd.exe 123 PID 2416 wrote to memory of 4732 2416 jre-7u5-windows-i586.exe 124 PID 2416 wrote to memory of 2728 2416 jre-7u5-windows-i586.exe 125 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\jre-7u5-windows-i586.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\jre-7u5-windows-i586.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_05\jre1.7.0_05.msi" SKIPLICENSE=1 PROG=0 ENDDIALOG=02⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\MSI4148.tmp"C:\Users\Admin\AppData\Local\Temp\MSI4148.tmp" C:\Program Files (x86)\Java\jre7\;C3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4760
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Sun\Java\AU\au.msi" ALLUSERS=1 /qn2⤵
- System Location Discovery: System Language Discovery
PID:4732
-
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.7.0_05-b062⤵
- System Location Discovery: System Language Discovery
PID:2728
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 40B9BE2299EFCAD5A5B7B53AC86B5CB8 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4940
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4924
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DA8A69EEE7EFCF465DA4BDB784C0DFB7 E Global\MSI00002⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\rt.pack" "C:\Program Files (x86)\Java\jre7\lib\rt.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1508
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\charsets.pack" "C:\Program Files (x86)\Java\jre7\lib\charsets.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2296
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\deploy.pack" "C:\Program Files (x86)\Java\jre7\lib\deploy.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\javaws.pack" "C:\Program Files (x86)\Java\jre7\lib\javaws.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:216
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\plugin.pack" "C:\Program Files (x86)\Java\jre7\lib\plugin.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\jsse.pack" "C:\Program Files (x86)\Java\jre7\lib\jsse.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5004
-
-
C:\Program Files (x86)\Java\jre7\bin\unpack200.exe"C:\Program Files (x86)\Java\jre7\bin\unpack200.exe" -r -v -l "C:\Users\Admin\AppData\Local\Temp\java_install.log" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack" "C:\Program Files (x86)\Java\jre7\lib\ext\localedata.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852
-
-
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" -Xshare:dump3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4000
-
-
C:\Program Files (x86)\Java\jre7\bin\javaw.exe"C:\Program Files (x86)\Java\jre7\bin\javaw.exe" com.sun.servicetag.Installer -source "Windows JRE installer"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get model4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get model5⤵
- System Location Discovery: System Language Discovery
PID:4484
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get model4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get model5⤵
- System Location Discovery: System Language Discovery
PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC computersystem get manufacturer4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC computersystem get manufacturer5⤵
- System Location Discovery: System Language Discovery
PID:4684
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC bios get serialnumber4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios get serialnumber5⤵
- System Location Discovery: System Language Discovery
PID:2276
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C WMIC cpu get manufacturer4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC cpu get manufacturer5⤵
- System Location Discovery: System Language Discovery
PID:556
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5989f7.rbs
- Size 10KB
- SHA256 dfb9e4434cfca06a2b08b53fe0111869321c0d06b7ce01417e3707377c895252
- MD5 0efd9924d00a48392d808e990de129cf
- SHA1 5656e9bede50ef0713aaaf154460387c35b4bb8d
- SHA512 f74f381e5bd2cde8a82ac861e890a9062b84477e4ab3af595268a7c74b8d3ca70e19d8c003a5383bc180bc780d22a834d38e845adad968b190b8225821aa3444
- SSDEEP 192:5IKUV2viGaAeQB6xSuG0bNB6xSuv0+oj/SpQHX0ba:SKU26sySWBySbnoW
- TLSH T1B3226442A90181C6F8D21B38DB171F207BB3D7D68701134B09CED5649F667A81FA979B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\bin\MSVCR100.dll
- Size 752KB
- SHA256 1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
- MD5 67ec459e42d3081dd8fd34356f7cafc1
- SHA1 1738050616169d5b17b5adac3ff0370b8c642734
- SHA512 9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
- SSDEEP 12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
- TLSH T16DF49D11B692C073C57220300629D7B24D7BB9711434986BBBD99F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\bin\client\jvm.dll
- Size 3.2MB
- SHA256 45a67771d8bff530b12cabbbbe52925173ac619e8ef4dcd34af6b86e10f5e798
- MD5 4c74aeb140feb8036616ad535dc18062
- SHA1 59f868e59ff5a9481dfd9fbb3bc796f0691e5aa4
- SHA512 667c0edfb4ddb1de190a258b8ad1dee76742ed3ed3b402230d1ef1e078d45f6b77053e519cf8dc825951673df06667be841646c95244c9a03feab86ede20a8db
- SSDEEP 49152:z7ZaeDenwd8qroDuN8ikT6mhpX5sl0McejXTFSdalByMFDLnEPkMXadvLIIRedzk:fD3Sq0utiaXTFjlBlFDwkFgcv/G664
- TLSH T1F1F59E32E6498275EDC301F3DE7D7B7C906DA330078E1AD375882A8859625F23E7A257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
- Size 754KB
- SHA256 a6ac2b6110c5c67ce681327d5479e2e8bf52deba5f5b9d56ca078099b19840dd
- MD5 c5197aa9fa208d7703391c1d529fbcd7
- SHA1 cbd21baea20beb9dd5ef3e8289329b5505bc5af5
- SHA512 cb48d8e5ee8bbba9144bbfd72aaba84f5980f9d72d61e57bf09b32887909e2c75c8de6731e2ec68fc24e330af00a121d4f36237530d8e5291765cc8b5ca51697
- SSDEEP 12288:s86foC8aYY6rEieXIfdSd57TYqc7LmcPQN6Zxt3+rcvEeuk0wCtNJVgbuUm9NMQ:Z6QfaY/rEGMdZTYqc7eN6Zxtu3UKNMQ
- TLSH T168F4071333E8853BF1B3EB30A97997754A7ABC6D9D70D50E3391266E5D30A80C924B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\bin\java.exe
- Size 169KB
- SHA256 307c81e355a064ea701e684b8181bb9156b6f8ff42ee5ebcc65952756937ea28
- MD5 1c4d251305e3de58d412552104edd3cf
- SHA1 2f72a5e4b91c0febc3ee616c275cc83fc5111a0e
- SHA512 e59f4c5f3800f880224faea87cbc13ca049cabaf744dd74c0282e71cba20cdd7cf2aaa377d6a1547013c0e63ca9afd9e8043f8e556d3e5cecf2f533537192ccf
- SSDEEP 3072:s83EmBmurMWObJj0xfPoKDAxc2TBfk0UjZqMN0Oil9Q:s8UML+j4PoKEG2TB0vzAQ
- TLSH T137048C61B1C0C072E527547289B8CAB05E76BCBD58B0844F77EA36790EB33D1826979F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\bin\javaw.exe
- Size 169KB
- SHA256 609f96d8dfa64ac51683cfcf702bbb396ad3effeadbcf18007d78fcdd864a32f
- MD5 53560c9205cd9a362f10cddad91bf7bd
- SHA1 490e43109f3c4a05d23c86f2d8078f3dd6812195
- SHA512 876e3f30ea9df304c1eeab63ddc3df00a9bd86e022e471545e57fd48fc40fa36b34bcf350ba36ec524a03006e9b369344f25c32ddc03504fd459ccd891d3d902
- SSDEEP 3072:I0xTsENwO1KJtIAFPPp/6ORLWTBf09OjZqMNZmVSa:I0NHmBJtIKPp/dxWTBpvEIa
- TLSH T1B7048D61B1C0D072E527047285A9CAB05E76BCBE58B0844F37DE367A0EB33D1866979F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\bin\javaws.exe
- Size 222KB
- SHA256 8659ec7610b54b9d6afebe15543d8b406a320ae7a1c502c2af880c7521dd8c66
- MD5 22735e89fc80445a080735c98d4eebed
- SHA1 f6aa4103733d3c0aaccc150e71140dae2e480e49
- SHA512 6fe8647c77e99dcd6bf68a5fbd97d053a9e3923b5316ea5410dac90bb49fa84a7dffb8745415106a540c095f6d04ad9f90dcf1a41b711db57b2b389ac735f144
- SSDEEP 6144:v3vpdeKNkKzTYO8xJbsMLf7ZjpRre/vpEf:v/p/NkKzTY/6MLzZj/e/vpEf
- TLSH T1BA248D31B280C072C85B553084F9DF315EBABC761BB1948BB3E836695E723E1566A31F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\bin\unpack200.exe
- Size 141KB
- SHA256 90bcb7d91774818dce9f3041e00ba8551ab263a627efe71bccc14e5ba015fe8d
- MD5 80a3912904fb47b9e5170990261c4b89
- SHA1 7f04ab3f73794988807e917b11187245ffe09354
- SHA512 72ba25f5a415b503c55f3961e22441c29459da4a75f3774c5d99b8ed5165efc8b811641457f0fa8c7e07d9ef62b5e251e9ff5fe98b06822c526c8b4fa1f548c6
- SSDEEP 1536:/AzxvR0wcrWl61pszghpMiRbooVD9iEP49Wl8EsMlR5cnToIf3+IOfIOn03G2Jg6:CzAf1pVhooU908rMGTBf3sRn0WOgL+
- TLSH T11BE39DB257D0C17FD4BB16BA80EE6B6C6E79BB0047641CC712CC2B5526107F45A362EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\bin\verify.dll
- Size 37KB
- SHA256 f8ee6431be50db627390d819299f92018ed3642e4501715b4c6eca5d9a6eba33
- MD5 0a540e628474bf593b95cdddd04353e1
- SHA1 a32d76dee375e2502e2a4981483c906694c2ebbd
- SHA512 426cf0b3c48b22bccc7c73cbfde2d161fb39dcd9c725a083c52f08177f3ffa979e07282f101b0a49c909ed85048fa183bc8091516dd20ce54610aba884cd2574
- SSDEEP 768:z9Ocwk8sQtd5PRwJwXQETtSBADWf4oSpTFrrpUhA5Nbt82FndH/W7I3IILWE4bC4:4cwBs6PSro1/7JFN/CI7adCPw
- TLSH T119036C43B1A1C439E0D78F7761AAE3340725B1C1EFACA6CB119186D4DBE07A1EF2116B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\core.zip
- Size 37.8MB
- SHA256 7e3077434b054b9373befc6d76a9b56881dfd41f445f5c9255a8861973a9d96c
- MD5 da32ccb7ec692ca8d2b873ffa1ae9507
- SHA1 95ef41f86cef0f8660f605984ef8d4f8d23a6ea2
- SHA512 ff23b1303e096223ea71064ebaed7590abf43162026309fe2c2ef5e1afecf98ae2103e5871a0159cb84b6dbc2826f35fe7f813b0ada6016da0550a7cc70224d7
- SSDEEP 786432:6BvFgcv/G6Saujec5EHPgggLYJ4LcL56j8Vo:6BvFgcv/GnauacIo
- TLSH T12197AD03768B7027E6924B3046725375027AF51813736BCBBE4867BCDFA11E3AE35A91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\lib\charsets.pack
- Size 1.3MB
- SHA256 ef8e065bb060495d73f387e4ef1024ab1cbb932feb3a5868f8e788142e354e33
- MD5 a38b15418f0034db681400e005e0f942
- SHA1 d7371f758164537add353b99128d918f41db9477
- SHA512 743d96dc20afa8975a00469c9bae6a6f777ec00992a5ef36e471b974025d7dd47696798b03df575e792b9aa59daf9819b3933779b381076e67070f04eb37a153
- SSDEEP 12288:8KvuzHfxrXJwmb5yyWMxXpyDy64BqYHqoh8n2WY/n3OEDgsa1daYjD4t:8KWTd5wmbJXse/HQn2Jn3vt
- TLSH T16755E6037E6D3A51D61E6F3146BDCF169337A1197A570EEB9A08AB08DEE20F31511BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\lib\deploy.pack
- Size 1.4MB
- SHA256 5dd54023cd13f0b653bd675e7259b64accd8146fa6d00f45d6e11d3ca07abb5d
- MD5 5f11c033b745882c25f889b801832662
- SHA1 919ed04f9273d8affca293ed355bcc392b54c4cf
- SHA512 ec89446fabbd3d1bc796762377293f2ddb65418e60ef281d0363fd7a3cc8470ff7ce26f56ccc84e08af0c1aec6ab02652328dc2743c95dc5fa3b6e90dc01b92f
- SSDEEP 24576:mavNpF6xoibi4gV83AdAC9k+toywuXi2BNugmpF77i6vqcdB99vesKckqRbP7tx4:mav583Q0Pgu9s
- TLSH T18C65F3A329C7346BA3A10F3953764729457BF20812637F0AF520F3FCEB251A2EE19556
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\lib\ext\localedata.pack
- Size 735KB
- SHA256 63b7e067e65ad965876acc614c99af74341f6718d9498be3e05d5b914cd45417
- MD5 d2d364567ae06ffb5ae0dfb39c72a559
- SHA1 e3f6995f5b56c674d479a18baec0e93243ee5e1c
- SHA512 7ef125c5dabe6f2c747980012f69fdefe0057e6d2eb96b4ff6d45bc52bdbc2b628b7d9c94cf5e8cb962809cb1b08030387ac45b763c1fd9105d587883048757a
- SSDEEP 12288:64syQjAgM4fIuskcXrhBuGTwj0ehh/k9SoBUaBYu:IAgXzcXrruUw4eh5iUAv
- TLSH T16EF4FB93608BB59BFF900B3807720F2415BFE96D15536B49B5A4B3BCDB721A3EE504A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\lib\i386\jvm.cfg
- Size 686B
- SHA256 c471d622198461715f245d478484fc7c8de533313c56e922931a875460a5aa88
- MD5 5147cce789cd18ad6b2996eb89e5d866
- SHA1 756f1fffe96ef581f0d4d47253523544c89a2622
- SHA512 55f53adb70b1cf741cdf0dee74d92d2bf4c96954a760afae289972a0ea9bb27bc5eb4df1bd41829c7c484211fcb294fe296a4d560d8a1cdbb8c707b3bf2a79a6
- TLSH T1C801FE6B81466776638210A77940289CAB62D03CE217BCA61088EE983D03C7CA517C56
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Java\jre7\lib\javaws.pack
- Size 198KB
- SHA256 04a250bb353ed912816f5fabcc7b546d3c2474b97a2c52aa1fac3b7775f286c1
- MD5 f8e2c095c22d9612758d09226b202424
- SHA1 0a7ad6e6b384705cc144079a429c3958a45020fd
- SHA512 edfea6549dac819f5605a6fbfd5026b4acf78e19ef8b7663bc535974b88c58af4ec3e21fa88712644d765a167b8e0e1df0f1397d84348515f45f2ba1ec305978
- SSDEEP 3072:hT0cThWvce828jPtigUNvSdvQ93jmyq/3qtAGRzuC92a0hGFv2jb53:hAUket04WgC92ZhRjbx
- TLSH T19F149E07BF0A5065E7F76A7181B6A751232BC3052AB527B36D58051CDEC62C38F2F6CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\lib\jsse.pack
- Size 138KB
- SHA256 2d2aed627b72928cde978a789e31dccc7ab115ac545c08fd7ff16fcf63b81449
- MD5 64865fc5f8de6eec341e48f034895f09
- SHA1 7fa48f367faeff516a02ad468422fba2dea8c8cb
- SHA512 1fd5a056809b222593202991e01ae255f60d9b6e004fd40a17d1decaae60fb6b614008bb536511da1c08c8ee6d6ce2d8b464b8f45f9afbaa6e6b638727fae066
- SSDEEP 3072:THCrIKZLXXShcUso2QE7GCCCCfMJPLfS4FJ:TirIKZLXXS2UvMF
- TLSH T117D38C173F0B5117D2D52B7A60F0A392637AD201367B27936F4609A8CDCA9E2DB2DDD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\lib\plugin.pack
- Size 470KB
- SHA256 1308ffc24034fc77cb38fa6ff42dc67d38fa1536a59693e315cccee441b6c423
- MD5 868e3b50de33a90944f31e8288952862
- SHA1 61b89f67efd3843f25489c2d52a33ac0e7ed13d1
- SHA512 ed86fa6e069c65da186290899369447e69db20f239e80f87a2c08ef01d8a5a24451b97606598375a8966dd0752a9b2c2bbadaa1100ab01a8d381efcc6a2a20a7
- SSDEEP 6144:+bBFf0xx6tITFwE8qZEr19zAGcpn89RnVPr61Q+smsdWpeNi+:2FSUFE8qZAsfn8ojsmuWcNV
- TLSH T125A4BF07BB07605AF6BE297214F457022324C3542A33AB67EE145564CDC6DCBEE2FAC9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\lib\rt.pack
- Size 13.1MB
- SHA256 62190af644e5bdae1d0bee114f6046312da7fa04fd0baebe9aff83e8e711b446
- MD5 6861a13bbeec0d2aabadb3547b147246
- SHA1 1284c7ce51f73c344f5bdb447f95177facc6dc71
- SHA512 63285267b3f9b476b9120297f6a84076a3c7158ad0fe08884b66b94b36826be7b856e02431e93d6cad71b989a154c60d2c10f9070f6abddaad9331bc051c116d
- SSDEEP 196608:FosvH+w1pgggLYJ4LcQAgeQeEqh5BwjSfVUTnd:dHPgggLYJ4LcV956j8VU
- TLSH T1AFD64A077A8F7906E3911F3402B163A6027BE20412773B57BE046BF8DE962D3EE15DA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Java\jre7\lib\zi\GMT
- Size 27B
- SHA256 0a526439ed04845ce94f7e9ae55c689ad01e1493f3b30c5c2b434a31fa33a43d
- MD5 7da9aa0de33b521b3399a4ffd4078bdb
- SHA1 f188a712f77103d544d4acf91d13dbc664c67034
- SHA512 9d2170571a58aed23f29fc465c2b14db3511e88907e017c010d452ecdf7a77299020d71f8b621a86e94dd2774a5418612d381e39335f92e287a4f451ee90cfb6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_109D983612043F6131CC62F7E16F02E2
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- Size 1KB
- SHA256 64e94ea72dffb576571358d070cfe7ff5cbd6edb11d86492f818ca73bbaffd5d
- MD5 f8d3904655f1dfd5082a1e9c68b3e526
- SHA1 d1df59f63a480c5615dc9e98659398b8406fb049
- SHA512 60bcfab16e91c4ac09fa3dbc710da31cb039678e979a70d0a11c1634c9c7f00f23e910e10990aa1ebec9846730dc4a85bb0a693caf1cfbe5d54962794c16330e
- TLSH T1243157690851377354A13775C99B8DD79EF293911BA2D84AC2644A460822FCA1FC80F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4DD39726D4B55AC3B4119B35A893323C_109D983612043F6131CC62F7E16F02E2
- Size 400B
- SHA256 049ea54a41e311262def62010b6f6e2c6dc5401ffde21106911dd0e9177d88f2
- MD5 d8b706c148296886b35e0f751f0cf9c7
- SHA1 9825ce8075bd0f55157bb3a41b57005e4d759e09
- SHA512 aff4505768ef002026ab7c4dde4e9fbd2c6f220f17449789863bc7d8f0b69b587a119b870f48d4843facff559e5c44c61758a12a37bc6fedc1b09f6d9f054ca4
- TLSH T157E07D1435BE811DF1B3CD7A8CE47431775DF502045119F910118665AB12D00CCA3536
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- Size 182B
- SHA256 0ccf9f49f073da5cff716d83abb07c608b004b0956bfebcf6cf4cf569e339a3b
- MD5 5f22e38e7ff2e4ea69dfd7322ebb47c2
- SHA1 6c6e67237a777713e8e357b9ffc54e4aaa9d77d4
- SHA512 5182bdc5ffb45f2cc62904023b2800828b59208dd9ea9640c5857751438f58873b85005582fd8f3aa4acec17cd82b91f2a644c130bc87f08d1220a9abcc54f2d
- TLSH T148C02B04635CC103F2A10E7F0C610621AF303D01D643C33E4B3C1328443DE400C77806
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC
- Size 404B
- SHA256 34499d12481ae061cf8afda6f65de02969dd7d73275f865f9472e1bbf859e348
- MD5 a5bbe8e326aaea14bca3e38bacc4de8d
- SHA1 f584c367ca4255874c7e589d955bde09dd41f98d
- SHA512 b2c6fc68f7310268774eb6fea30fb319cdc811ce80673e20617ee4c71d63f09c4e720a4c7d2a5543582d8504e22e0c5c1bea8827854689a4b30178257e7a96c4
- TLSH T19CE07D1422F7817DF1A2E938C9D9B126495BF611040931FB00A52306BB12B010C51D31
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_05\Data1.cab
- Size 16.7MB
- SHA256 b2088613a94b75c7a0cca03fd89d0ef948e51e11c5ec896b369177a6336163ff
- MD5 c93c7b9e9031c54c6e113d4475a50ba9
- SHA1 df4369d61d1ca69754892882f88947103f5e0b06
- SHA512 b12e3c2adadfe735fd5de58e2a4a3f1ee71be350da0805084e05ba74c98c92e018d00f8a5a420c890279648db8488abed8e6965164bcee6c6a204bfc705f7458
- SSDEEP 393216:J2ZaQ4A+VfDpRr4lnk+SD9THvY8LACOxidr/47R8gRe5v:AZj4A0Knk+SD1P9lInGv
- TLSH T16E07339CE6D5FD128821AAABC7F9F6899390B733D11F0C25160AA5FC941DB1934F9CC2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.7.0_05\jre1.7.0_05.msi
- Size 847KB
- SHA256 6678c80643d073961134b52368496ecc0685a90c61e45da9389e4b6928e7d2a3
- MD5 8d986517cae2dc137a2c41f63d702d9c
- SHA1 0108445def1c08c13ac5ff252097c7bf39b807e4
- SHA512 d6b1f3de9b4fbce4709b51223b766d4db52bdf223c7c935497620271b766ef27556a0870cd0a855deff1e13d6623071113fbe6bbb84993f38e4bac429656fb6d
- SSDEEP 12288:O7L89V8iWgR0s/GvSi1/7zgM39ElWrlhsG0:O7A9V8iR/Wl/gc9nhsG0
- TLSH T112053B52F641B236E49607310DBA8B59057FBEB92B7161C733C872AA9FF13D30935682
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI401C.tmp
- Size 167KB
- SHA256 d0a420ed019a36cbc3d11aa5d7d6463f8be8b63bb5f3f25a7bf2a1cec4b26807
- MD5 fca173cad911aa5071396cc7e68573d1
- SHA1 2019b902f6527a3f0c88c79ed5f5e489a47b4384
- SHA512 33f2e327968da4adaac2acb3996ec51c1281a7666d013d7c4c7d49812b9eb767ec8c37fce8e37092c93bf2bb783bbf42477a9003ad4c2c1dfe95add145d202b8
- SSDEEP 1536:1evOAFFokyUGg9Mj66d5HrTwFaiqUCTEMyErpsupM9e1AwxssrMz71A59alOBW5u:1eWOGLj60t/wiTE/8/LVm7E9QSxn9dJ
- TLSH T150F36D12B251D036F4A7103C152CCAB29D7F7A3557AAA4C3B36A1B6A7FB43C15A39313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4148.tmp
- Size 265KB
- SHA256 c2b74111399f06ebe8de5ec0659ab6e78d2fe5315d8fedf473f5ab9947ad5d81
- MD5 bd2a821cb5dd0e4b17386407d3be2503
- SHA1 07aa634279c6b4c62f81a558ace4ca4461037170
- SHA512 bb972308a539b3a9b69c016dda1f68e9c903803914455f664ced0a9fff3fba249b677e2d4657e9820a83442e4149665c59a58f963fbd2f6a1c790fa24b2d28ca
- SSDEEP 3072:uTteeYjzL448rbu2wDlWrqAhHNyoSCJQH0XbUELdjPwjRDK:A+j2riTDlWrlhnHCWRq
- TLSH T13344281026D092B6F5F7123245F99B59193EFA715B3622CB7364238E9AF0BD24C79B03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 23KB
- SHA256 27a5ff5cc16846168c6f0aa05690caf666f6cd782ed80f3f2c90e471a8b0c79e
- MD5 24190cedcb08bffd5611020113c24785
- SHA1 8a81030653d91de22fb2096cd05bdf04021ba8ba
- SHA512 659c702e2be9b178e3fc8ab2c8c4931a64337b8ec8f6fc0980015554d323a103b87553ee3f50490596b50b8b51c8c9d100f2108956e17b5f2a18fa004bf7f064
- SSDEEP 192:cRPCZLnLBZtMsDTjvN4u5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mv:cRaZLPtlTOsTigiTbKM51G0v
- TLSH T108B2986570FFF67923E3785962A4EBED92425C38258F8A373FC40AC0971C9D076EA512
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 24KB
- SHA256 4cc91c4630eeb8dfde885f1621743b22510f7315e491b840655798252cd68aac
- MD5 be51f2499808c1b12d801cf7b70edf66
- SHA1 a4e9f62caacc29fe108c3bdbad7d21abd2674248
- SHA512 2924b81bb8ed88b8501be608199977ccdd4eab60bf23ecacc75a5a1d9e6fe52632dcf16ad80dd9a38721359db79015c21748d58611c8f36fb62f6838af16dedf
- SSDEEP 192:cRPCZLnLBZtMsDTjvN4u5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEIdl:cRaZLPtlTOsTigiTbKM51G0EO
- TLSH T122B2A96570FFF67923E3784962A4EBED92425C38258F8A373FC50AC0971C9D076EA512
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 25KB
- SHA256 ed41de3534f66696a332e3969cace30841a8390d5079d958b581555d814805f1
- MD5 a7ca17921e0f5a9c9a769949bc151a03
- SHA1 ac988678e5b6acb0034b50eb59b9058017eb3d5f
- SHA512 d2a4ffa43c3c70c61474e3d6addb46aaefb6b435d3af100d48992e0f8ecb06b80ea3f81aa773d748b86d6328784b89f63fda3e0b3576990fadfef0e68f39a193
- SSDEEP 192:cRPCZLnLBZtMsDTjvN4u5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEIdGIx8:cRaZLPtlTOsTigiTbKM51G0E1t
- TLSH T1F5B2BB6570FFF67923E3784962A4EBED92425C3C258F8A363FC50AC0971C9D076EA512
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 25KB
- SHA256 b87c06c5fe1f9349085a5ee1705a8fecbfdcfb144f103d8a3e10cf9160fed50a
- MD5 2d8757c4729ca65119902d6ae57a20e0
- SHA1 c7473f5be1b263e7689f4c56721bf26b7bb7e156
- SHA512 663169779a2ac5442b0ed0f8321a89ee83462512cbbd9c771fb2547fedf7bed1f87995e2e25dd3c7d38f460472e8fdfa4a614a331d8b135b453066387e7518ab
- SSDEEP 192:cRPCZLnLBZtMsDTjvN4u5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEIdGIx3A0F:cRaZLPtlTOsTigiTbKM51G0E1Kd
- TLSH T161C2CC6570FFF27923E3784962A4EBED92465C3C258F8A363FC50AC0971C9D076EA512
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 26KB
- SHA256 14c2f4a856444cabd220a6893207b9e0c202d81ef0db739907648eda3d29dd84
- MD5 e30bc4d4d5b9b5d9e193b619d67ee84e
- SHA1 a821e18da3f644108d200b78555f01aa97f16f11
- SHA512 ff3956adb9a9825ca13008a8f8885d149f4b37709c313160b78e7b54f8acffecf9962a89d881fe2546c4d17686de83ad070abb67fb83c4b9073ac3d9df4cde75
- SSDEEP 192:cRPCZLnLBZtMsDTjvN4u5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEIdGIx3A0GSD:cRaZLPtlTOsTigiTbKM51G0E1K+M
- TLSH T139C2DE6570FFF27923E3784962A4EBED92465C3C258F8A363FC50AC0971C9D076EA512
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 26KB
- SHA256 e4dbf2ca791264e577c46062e112d983c903892e4daf80e378ecb6c23fd3db61
- MD5 f77b1e341895fc8159269ab3ae1392fa
- SHA1 e976366fe1ccb5e573ec78d39f8998bb9b6b694e
- SHA512 a224f71d83077d65f24f61de120d9e85f86f310bc0815e8b1c4790898e61ff9747cc1aa981f418ce353f5bf4291b27b02d1f45078f4c1e9a6c92a0cdfd5469e6
- SSDEEP 192:cRPCZLnLBZtMsDTjvN4u5dGIiDgy5TbTifYG9ZMMEcG+TSmK439mEIdGIx3A0GS2:cRaZLPtlTOsTigiTbKM51G0E1K+68ain
- TLSH T182C2EF6570FFE27923E3784962A4EBED92465C3C258F8A363FC50AC0971C9D076EB512
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\java_install.log
- Size 27KB
- SHA256 25a6de3ef541e375568d01be5f4e712f17738644248370e15a59862e306b339b
- MD5 3e2aaef001c2095d8928d92c2fa2d9e2
- SHA1 674812635e29abfb157e1b4bd23a63b04ee21f8b
- SHA512 81b3c5c223378c3ca63ee850ae95c819996747eeb9e77f3daea5954b466b93965257b8f26360f64715d39c1430e8a87248fd664a7e952f447af67b9ba8e1eff1
- SSDEEP 384:cRaZLPtlTOsTigiTbKM51G0E1K+68aiX4o:UaZL1lyWIKM51Y1K+kiIo
- TLSH T18EC2F02570FFE27923E3784962A4EBED92465C3C258F8A363FC50AC1971C9D076EB512
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
- Size 2KB
- SHA256 b2a1e663c7be1d30d654192cd5f4388dac85f9ccbd4b4801512de4f13290c302
- MD5 53536c9d0d4f01dfc5f07d44f6b7fc68
- SHA1 5bf47003448eac04c71fe43889f877d35501ef36
- SHA512 56ca09b970adbc5913f2ccd9ec55695b5f578533faac0ad8be47c4feed90ac32981d13427b6db6ba6c9aff01db2ff5f8c3df65b0263cc32db1ac12d19c8cf9b0
- TLSH T126413D134483C3E4B012ADC16386AC9B824D8DBC379D056D6396DE4FD3E5E09629BBE5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\jusched.log
- Size 163KB
- SHA256 e1b36ed4d2ae14a669cc1bd6a63e8e577b209caa6886897add871774d9237cab
- MD5 a10b627483db3d4986a9ab9b2c3ccc8b
- SHA1 93a4f052087656d154144b9fc7f5993bce62e83d
- SHA512 acb933cc36bb0a239b2752eb28f113ecca58b45e832e818b02f992762bdec4890624a61af41407fb7989c7339d2cc8f0b625801f19b1cef7489b629e2c9b3b11
- SSDEEP 3072:dcg9hg7oi5BN4HW5QCNdg7Yer6433lvbNQBf2Q1TIO/:Jlwx
- TLSH T1F3F385CB889E44FB30630BE3C7695C645656162E43AE4A1D31EF82CFA458E03D56E4EF
- MD5 SHA1 SHA512 SSDEEP TLSH