Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 21:54
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-Installer-1.4.7.exe
Resource
win7-20240508-en
General
-
Target
TLauncher-Installer-1.4.7.exe
-
Size
24.1MB
-
MD5
86fc2557f00baf9698715dc99a8cec41
-
SHA1
75f8f54eabd25749af37d21316f02d7d5868c398
-
SHA256
9f0ffcd4852f9af353558f104dd8edf13e67971076341e87da304b8e6d8c5414
-
SHA512
521e19cc02c996fc478fead4239cd3ab24b70a441df138ed955d349eb46e7a03ccc10a3d58d8dc726292f494d6bd6efd2a92f62d3f179cb2751fc725ea7d449e
-
SSDEEP
786432:lKxabBbJyM9irrKJBH5lFRqH0fYk/pUJ8a:lKcSMQPKJBZlCUfYSpUJ8
Malware Config
Signatures
-
Downloads MZ/PE file
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 24 IoCs
Processes:
irsetup.exeTLauncher.exejre-8u51-windows-x64.exeinstaller.exebspatch.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exejavaw.exejavaws.exejavaw.exejp2launcher.exejavaws.exejp2launcher.exejavaw.exejavaw.exejaureg.exeTLauncher.exejavaw.exepid process 1320 irsetup.exe 3280 TLauncher.exe 1608 jre-8u51-windows-x64.exe 2140 installer.exe 1936 bspatch.exe 3124 unpack200.exe 3184 unpack200.exe 3228 unpack200.exe 1640 unpack200.exe 2088 unpack200.exe 3432 unpack200.exe 3580 unpack200.exe 3652 unpack200.exe 3692 javaw.exe 4048 javaws.exe 4064 javaw.exe 2312 jp2launcher.exe 892 javaws.exe 1420 jp2launcher.exe 2252 javaw.exe 1800 javaw.exe 3184 jaureg.exe 2036 TLauncher.exe 3208 javaw.exe -
Loads dropped DLL 64 IoCs
Processes:
TLauncher-Installer-1.4.7.exeirsetup.exeiexplore.exemsiexec.exebspatch.exeinstaller.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exejavaw.exejavaws.exejavaw.exejp2launcher.exepid process 1928 TLauncher-Installer-1.4.7.exe 1928 TLauncher-Installer-1.4.7.exe 1928 TLauncher-Installer-1.4.7.exe 1928 TLauncher-Installer-1.4.7.exe 1320 irsetup.exe 1320 irsetup.exe 1320 irsetup.exe 3384 iexplore.exe 1196 876 msiexec.exe 1936 bspatch.exe 1936 bspatch.exe 1936 bspatch.exe 2140 installer.exe 3124 unpack200.exe 3184 unpack200.exe 3228 unpack200.exe 1640 unpack200.exe 2088 unpack200.exe 3432 unpack200.exe 3580 unpack200.exe 3652 unpack200.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 852 852 3692 javaw.exe 3692 javaw.exe 3692 javaw.exe 3692 javaw.exe 3692 javaw.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 2140 installer.exe 852 852 4048 javaws.exe 4064 javaw.exe 4064 javaw.exe 4064 javaw.exe 4064 javaw.exe 4064 javaw.exe 4048 javaws.exe 2312 jp2launcher.exe 2312 jp2launcher.exe 2312 jp2launcher.exe 2312 jp2launcher.exe 2312 jp2launcher.exe 2312 jp2launcher.exe 2312 jp2launcher.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral1/memory/1320-19-0x00000000010A0000-0x0000000001489000-memory.dmp upx behavioral1/memory/1320-801-0x00000000010A0000-0x0000000001489000-memory.dmp upx behavioral1/memory/1320-2197-0x00000000010A0000-0x0000000001489000-memory.dmp upx C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe upx behavioral1/memory/1936-2953-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/1936-2978-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\"" msiexec.exe -
Checks for any installed AV software in registry 1 TTPs 3 IoCs
Processes:
irsetup.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast irsetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast irsetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir irsetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
installer.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" installer.exe -
Drops file in System32 directory 2 IoCs
Processes:
installer.exedescription ioc process File opened for modification C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe File created C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
installer.exeunpack200.exemsiexec.exeunpack200.exejavaw.exedescription ioc process File created C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\access-bridge-64.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\fonts\LucidaBrightRegular.ttf installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\security\javaws.policy installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\plugin.pack installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\fxplugins.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jsdt.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\net.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\servertool.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\images\cursors\win32_LinkDrop32x32.gif installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.jar unpack200.exe File created C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npdeployJava1.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\server\Xusage.txt installer.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe msiexec.exe File created C:\Program Files\Java\jre1.8.0_51\bin\dt_socket.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\classlist installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\sunmscapi.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\security\local_policy.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\deploy.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\fontmanager.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jfxwebkit.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\cmm\LINEAR_RGB.pf installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.pack installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\keytool.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\plugin2\msvcr100.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\dnsns.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\jvm.hprof.txt installer.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe msiexec.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jawt.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\javacpl.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\ktab.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\meta-index installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\fonts\LucidaBrightItalic.ttf installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jfr.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\verify.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_ko.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\logging.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jabswitch.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\java.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\nashorn.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\jce.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\security\java.policy installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\charsets.jar unpack200.exe File created C:\Program Files\Java\jre1.8.0_51\lib\images\cursors\win32_LinkNoDrop32x32.gif installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\management\management.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\security\cacerts installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\tzdb.dat installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\gstreamer-lite.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\mlib_image.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_zh_CN.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\splash.gif installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\images\cursors\invalid32x32.gif installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\jfr\profile.jfc installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\security\blacklisted.certs installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jjs.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\wsdetect.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\cmm\GRAY.pf installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\ffjcext.zip installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\sunpkcs11.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\meta-index installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\rt.pack installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\server\classes.jsa javaw.exe -
Drops file in Windows directory 16 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\f770a2e.msi msiexec.exe File created C:\Windows\Installer\f770a31.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f770a31.ipi msiexec.exe File created C:\Windows\Installer\f770a34.msi msiexec.exe File created C:\Windows\Installer\f770a33.msi msiexec.exe File opened for modification C:\Windows\Installer\f770a37.ipi msiexec.exe File created C:\Windows\Installer\f770a2e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB87.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3D62.tmp msiexec.exe File created C:\Windows\Installer\f770a37.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4A12.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4AA1.tmp msiexec.exe File opened for modification C:\Windows\Installer\f770a34.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI488B.tmp msiexec.exe File created C:\Windows\Installer\f770a39.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 08e56efda5c9da01 iexplore.exe -
Processes:
iexplore.exeinstaller.exeirsetup.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000015cfd5f54d591bf81a9c22080e28afdf968359f31844899e8376449f0d81238d000000000e8000000002000020000000fd970c4eabac06c80ddff484764577ab82cc5b3b193ba1719603feb928de0c25900000004529d55130e8f1f1b8b2bb878d5b676a09325e84d12d4f58749c834a27c6882e25bab09f9556826634a9b3dfd2bf50548b450ea07dd3618f3351c8272bb48a1e9245443db35fb2cd69ebfe59db40db9c73465344d148dfa6370f67d971519c4e258a0540280bf991ffdaace2c2ac230b9d80a8c88a004caa60aca1142398ee68a80b2ed1798ba4683b001a5216648e84400000000c2d21ada066c079617f1e11289f53cf9575058e059c4f916359ee813a7835544a702705432e361d854ec6c675d0f4a76d53dac7481e62ccdf2b61ecf84cd9d5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iexplore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000024367b69011c31eae750b87d2409605719931c4a11ba1b921045f5b82c4cfbdf000000000e8000000002000020000000afdeafa2d7efa5f766f7cbe98f34ef357a6691ed3f5cd82d64998be2e9d9432720000000bc9c06764c10acb66acfe47e2e33bd704b74b5ac7530277a8bf5b2df6c579fc040000000e51a4e0d9067b499d7071886a79fa7e9ce492aed2a164cef93afc7b935c34af90d4d5969983e3163ba2be11039a864a0a064ed1e9a44b2798b73a18a8006e3c9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37483C21-3599-11EF-B0DE-E64BF8A7A69F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07a820da6c9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_51\\bin" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_51\\bin" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4B5F-9EE6-34795C46E7E7} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_51\\bin" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} installer.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe -
Modifies registry class 64 IoCs
Processes:
installer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\JavaPlugin.11512 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_11" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\VersionIndependentProgID installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0076-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_08" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0050-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0051-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0084-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_84" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0051-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0098-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_98" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0028-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0039-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0040-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0049-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0049-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0065-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_65" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0041-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_41" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0077-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0015-ABCDEFFEDCBC}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0084-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_84" installer.exe Key deleted \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0075-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0031-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_02" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0000-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0030-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0028-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_19" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0075-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_75" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_68" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0000-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0049-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_17" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0043-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_35" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0056-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0084-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0038-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_38" installer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
jp2launcher.exejp2launcher.exemsiexec.exepid process 2312 jp2launcher.exe 1420 jp2launcher.exe 876 msiexec.exe 876 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
jre-8u51-windows-x64.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1608 jre-8u51-windows-x64.exe Token: SeIncreaseQuotaPrivilege 1608 jre-8u51-windows-x64.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeSecurityPrivilege 876 msiexec.exe Token: SeCreateTokenPrivilege 1608 jre-8u51-windows-x64.exe Token: SeAssignPrimaryTokenPrivilege 1608 jre-8u51-windows-x64.exe Token: SeLockMemoryPrivilege 1608 jre-8u51-windows-x64.exe Token: SeIncreaseQuotaPrivilege 1608 jre-8u51-windows-x64.exe Token: SeMachineAccountPrivilege 1608 jre-8u51-windows-x64.exe Token: SeTcbPrivilege 1608 jre-8u51-windows-x64.exe Token: SeSecurityPrivilege 1608 jre-8u51-windows-x64.exe Token: SeTakeOwnershipPrivilege 1608 jre-8u51-windows-x64.exe Token: SeLoadDriverPrivilege 1608 jre-8u51-windows-x64.exe Token: SeSystemProfilePrivilege 1608 jre-8u51-windows-x64.exe Token: SeSystemtimePrivilege 1608 jre-8u51-windows-x64.exe Token: SeProfSingleProcessPrivilege 1608 jre-8u51-windows-x64.exe Token: SeIncBasePriorityPrivilege 1608 jre-8u51-windows-x64.exe Token: SeCreatePagefilePrivilege 1608 jre-8u51-windows-x64.exe Token: SeCreatePermanentPrivilege 1608 jre-8u51-windows-x64.exe Token: SeBackupPrivilege 1608 jre-8u51-windows-x64.exe Token: SeRestorePrivilege 1608 jre-8u51-windows-x64.exe Token: SeShutdownPrivilege 1608 jre-8u51-windows-x64.exe Token: SeDebugPrivilege 1608 jre-8u51-windows-x64.exe Token: SeAuditPrivilege 1608 jre-8u51-windows-x64.exe Token: SeSystemEnvironmentPrivilege 1608 jre-8u51-windows-x64.exe Token: SeChangeNotifyPrivilege 1608 jre-8u51-windows-x64.exe Token: SeRemoteShutdownPrivilege 1608 jre-8u51-windows-x64.exe Token: SeUndockPrivilege 1608 jre-8u51-windows-x64.exe Token: SeSyncAgentPrivilege 1608 jre-8u51-windows-x64.exe Token: SeEnableDelegationPrivilege 1608 jre-8u51-windows-x64.exe Token: SeManageVolumePrivilege 1608 jre-8u51-windows-x64.exe Token: SeImpersonatePrivilege 1608 jre-8u51-windows-x64.exe Token: SeCreateGlobalPrivilege 1608 jre-8u51-windows-x64.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe Token: SeRestorePrivilege 876 msiexec.exe Token: SeTakeOwnershipPrivilege 876 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 3384 iexplore.exe 3384 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
irsetup.exeiexplore.exeIEXPLORE.EXEjp2launcher.exejp2launcher.exejavaw.exepid process 1320 irsetup.exe 1320 irsetup.exe 1320 irsetup.exe 1320 irsetup.exe 3384 iexplore.exe 3384 iexplore.exe 3440 IEXPLORE.EXE 3440 IEXPLORE.EXE 2312 jp2launcher.exe 1420 jp2launcher.exe 3208 javaw.exe 3208 javaw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
TLauncher-Installer-1.4.7.exeTLauncher.exeiexplore.exemsiexec.exeinstaller.exejavaws.exedescription pid process target process PID 1928 wrote to memory of 1320 1928 TLauncher-Installer-1.4.7.exe irsetup.exe PID 1928 wrote to memory of 1320 1928 TLauncher-Installer-1.4.7.exe irsetup.exe PID 1928 wrote to memory of 1320 1928 TLauncher-Installer-1.4.7.exe irsetup.exe PID 1928 wrote to memory of 1320 1928 TLauncher-Installer-1.4.7.exe irsetup.exe PID 1928 wrote to memory of 1320 1928 TLauncher-Installer-1.4.7.exe irsetup.exe PID 1928 wrote to memory of 1320 1928 TLauncher-Installer-1.4.7.exe irsetup.exe PID 1928 wrote to memory of 1320 1928 TLauncher-Installer-1.4.7.exe irsetup.exe PID 3280 wrote to memory of 3384 3280 TLauncher.exe iexplore.exe PID 3280 wrote to memory of 3384 3280 TLauncher.exe iexplore.exe PID 3280 wrote to memory of 3384 3280 TLauncher.exe iexplore.exe PID 3280 wrote to memory of 3384 3280 TLauncher.exe iexplore.exe PID 3384 wrote to memory of 3440 3384 iexplore.exe IEXPLORE.EXE PID 3384 wrote to memory of 3440 3384 iexplore.exe IEXPLORE.EXE PID 3384 wrote to memory of 3440 3384 iexplore.exe IEXPLORE.EXE PID 3384 wrote to memory of 3440 3384 iexplore.exe IEXPLORE.EXE PID 3384 wrote to memory of 3440 3384 iexplore.exe IEXPLORE.EXE PID 3384 wrote to memory of 3440 3384 iexplore.exe IEXPLORE.EXE PID 3384 wrote to memory of 3440 3384 iexplore.exe IEXPLORE.EXE PID 3384 wrote to memory of 1608 3384 iexplore.exe jre-8u51-windows-x64.exe PID 3384 wrote to memory of 1608 3384 iexplore.exe jre-8u51-windows-x64.exe PID 3384 wrote to memory of 1608 3384 iexplore.exe jre-8u51-windows-x64.exe PID 876 wrote to memory of 2140 876 msiexec.exe installer.exe PID 876 wrote to memory of 2140 876 msiexec.exe installer.exe PID 876 wrote to memory of 2140 876 msiexec.exe installer.exe PID 2140 wrote to memory of 1936 2140 installer.exe bspatch.exe PID 2140 wrote to memory of 1936 2140 installer.exe bspatch.exe PID 2140 wrote to memory of 1936 2140 installer.exe bspatch.exe PID 2140 wrote to memory of 1936 2140 installer.exe bspatch.exe PID 2140 wrote to memory of 1936 2140 installer.exe bspatch.exe PID 2140 wrote to memory of 1936 2140 installer.exe bspatch.exe PID 2140 wrote to memory of 1936 2140 installer.exe bspatch.exe PID 2140 wrote to memory of 3124 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3124 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3124 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3184 2140 installer.exe jaureg.exe PID 2140 wrote to memory of 3184 2140 installer.exe jaureg.exe PID 2140 wrote to memory of 3184 2140 installer.exe jaureg.exe PID 2140 wrote to memory of 3228 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3228 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3228 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 1640 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 1640 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 1640 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 2088 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 2088 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 2088 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3432 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3432 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3432 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3580 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3580 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3580 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3652 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3652 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3652 2140 installer.exe unpack200.exe PID 2140 wrote to memory of 3692 2140 installer.exe javaw.exe PID 2140 wrote to memory of 3692 2140 installer.exe javaw.exe PID 2140 wrote to memory of 3692 2140 installer.exe javaw.exe PID 2140 wrote to memory of 4048 2140 installer.exe javaws.exe PID 2140 wrote to memory of 4048 2140 installer.exe javaws.exe PID 2140 wrote to memory of 4048 2140 installer.exe javaws.exe PID 4048 wrote to memory of 4064 4048 javaws.exe javaw.exe PID 4048 wrote to memory of 4064 4048 javaws.exe javaw.exe PID 4048 wrote to memory of 4064 4048 javaws.exe javaw.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.7.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.7.exe" "__IRCT:3" "__IRTSS:25232362" "__IRSID:S-1-5-21-268080393-3149932598-1824759070-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/2⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3384 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NVDR4C1U\jre-8u51-windows-x64.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NVDR4C1U\jre-8u51-windows-x64.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe-cp "C:\Program Files\Java\jre1.8.0_51\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus4⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe-cp "C:\Program Files\Java\jre1.8.0_51\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 304⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\AU\au.msi" ALLUSERS=1 /qn4⤵
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.8.0_51-b164⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_51\installer.exe"C:\Program Files\Java\jre1.8.0_51\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_51\\" REPAIRMODE=02⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe"bspatch.exe" baseimagefam8 newimage diff3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\deploy.pack" "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\javaws.pack" "C:\Program Files\Java\jre1.8.0_51\lib\javaws.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\plugin.pack" "C:\Program Files\Java\jre1.8.0_51\lib\plugin.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\rt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\rt.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\charsets.pack" "C:\Program Files\Java\jre1.8.0_51\lib\charsets.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\jsse.pack" "C:\Program Files\Java\jre1.8.0_51\lib\jsse.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -Xshare:dump3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -classpath "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar" com.sun.deploy.panel.JreLocator4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_51" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXIALURqYXZhLnNlY3VyaXR5LnBvbGljeT1maWxlOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcc2VjdXJpdHlcamF2YXdzLnBvbGljeQAtRHRydXN0UHJveHk9dHJ1ZQAtWHZlcmlmeTpyZW1vdGUALURqbmxweC5ob21lPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcamF2YXdzLmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcYmluXGphdmF3LmV4ZQ== -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_51" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXIALURqYXZhLnNlY3VyaXR5LnBvbGljeT1maWxlOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcc2VjdXJpdHlcamF2YXdzLnBvbGljeQAtRHRydXN0UHJveHk9dHJ1ZQAtWHZlcmlmeTpyZW1vdGUALURqbmxweC5ob21lPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcamF2YXdzLmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcYmluXGphdmF3LmV4ZQ== -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 33DB59C23C76812227AA571BD06381A82⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c del "C:\Program Files\Java\jre1.8.0_51\installer.exe"3⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F82474278DBBDCD7EC712FDCDFC15CFD2⤵
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Component Object Model Hijacking
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Event Triggered Execution
1Component Object Model Hijacking
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\f770a32.rbsFilesize
788KB
MD5c37419a28e518ae1c07750855f57a173
SHA1facd510498e9f4f7cf9dc7ebaaa6bac45e7ded86
SHA2562e3bf0666d270801dbfff996ad5c6faec4c944b0b994be520b31ce9bd8a78e4c
SHA51253ec773292d56dc01d76acc7d1e0831b61c4a5a5b7abd52196e0cd8d4339d6bd24dafb931089914a926f7a4f3b2865ff71f48ca2618d2e70b825b0ed30f18046
-
C:\Config.Msi\f770a38.rbsFilesize
8KB
MD59984918645fb01ad8c2ef1e00456b524
SHA168e7ad15ea55d105976f0395cd3cae333adde98c
SHA2563422c1803c0d6d57d2dc8c5508bad594de9a69df34d388ddcd222bbb7ee5c886
SHA512eb708cb45abec9f2b9de3806379a46dc58d565bbce0576f66a0131d28de34e69290248c81e764c37fb7e543fb8c7f0c93c7b2a855b61721cea5baff2982f1869
-
C:\Program Files\Java\jre1.8.0_51\bin\MSVCR100.dllFilesize
809KB
MD5df3ca8d16bded6a54977b30e66864d33
SHA1b7b9349b33230c5b80886f5c1f0a42848661c883
SHA2561d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
SHA512951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
-
C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npdeployJava1.dllFilesize
1.1MB
MD5cb63e262f0850bd8c3e282d6cd5493db
SHA1aca74def7a2cd033f18fc938ceb2feef2de8cb8c
SHA256b3c10bf5498457a76bba3b413d0c54b03a4915e5df72576f976e1ad6d2450012
SHA5128e3ad8c193a5b4ab22292893931dc6c8acd1f255825366fdd7390f3d8b71c5a51793103aeacecfb4c92565b559f37aec25f8b09abb8289b2012a79b0c5e8cb3b
-
C:\Program Files\Java\jre1.8.0_51\bin\javacpl.exeFilesize
75KB
MD5f49218872d803801934638f44274000d
SHA1871d70960ff7db8c6d11fad68d0a325d7fc540f1
SHA256bb80d933bf5c60ee911dc22fcc7d715e4461bc72fd2061da1c74d270c1f73528
SHA51294432d6bc93aad68ea99c52a9bcb8350f769f3ac8b823ba298c20ff39e8fa3b533ef31e55afeb12e839fd20cf33c9d74642ce922e2805ca7323c88a4f06d986d
-
C:\Program Files\Java\jre1.8.0_51\bin\javaws.exeFilesize
314KB
MD55ed6faed0b5fe8a02bb78c93c422f948
SHA1823ed6c635bd7851ccef43cbe23518267327ae9a
SHA25660f2898c91ef0f253b61d8325d2d22b2baba1a4a4e1b67d47a40ffac511e95a5
SHA5125a8470567f234d46e88740e4f0b417e616a54b58c95d13c700013988f30044a822acfef216770181314fa83183a12044e9e13e6257df99e7646df9a047244c92
-
C:\Program Files\Java\jre1.8.0_51\lib\charsets.packFilesize
1.0MB
MD545288142b863dc4761b634f9de75e5e5
SHA19d07fca553e08c47e38dd48a9c7824e376e4ce80
SHA25691517ff5c74438654956aae554f2951bf508f561b288661433894e517960c2ac
SHA512f331cd93f82d2751734eb1a51cb4401969fb6e479b2e19be609e13829454ec27cec864c57bdc116bf029317c98d551e9feafc44386b899a94c242bc0464556d8
-
C:\Program Files\Java\jre1.8.0_51\lib\deploy.packFilesize
1.8MB
MD55cfc3a1b269312f7a2d2f1d7c0497819
SHA1d048284db9ce7103156f8bbce988b4d9978786b7
SHA25680ba80d2a6c20deef6e2f3973337e15e22eec30508899ae998bf191ba725db26
SHA5128735af7c8bc5b48aac42120326a5dee21f98512ba31c57c77b6fc3906b7b1b98e5f22f57a31f26dc3e16abe63a6f15ef2e115c7fc17bbab35e846dc373da9c6b
-
C:\Program Files\Java\jre1.8.0_51\lib\javaws.packFilesize
211KB
MD55a83bc9b3e4a7e960fd757f3ad7cd263
SHA1f5f308aec7e93accb5d6714c178b8bf0840fb38d
SHA2560a95ab97c85e534b72a369b3ee75200f8075cb14e6f226196b18fd43e6ba42f5
SHA512b8e554bbf036d0500686e878597ffdefa8bcd091ab6533eae76fa04eda310cec7cac89b71911f1f81012f499c7bec890ac9032685945f7e5e6b68f7ad3f7430c
-
C:\Program Files\Java\jre1.8.0_51\lib\jsse.packFilesize
150KB
MD5168f72fd2f288a96ee9c4e845339db02
SHA1e25b521b0ed663e2b050af2b454d571c5145904f
SHA2565552e52e39c0e7ac423d6939eec367a0c15b4ca699a3a1954f2b191d48a034e6
SHA51201cdf3d8d3be0b2458d9c86976cef3f5a21131d13eb2a1c6f816aeb2c384779b67d1b419fa9233aedd3bbd16970ec7c81689bf2e25a8bebadec5de8e9b5a19f1
-
C:\Program Files\Java\jre1.8.0_51\lib\plugin.packFilesize
482KB
MD5538777ddaa33641aa2c17b8f71eed307
SHA1ac7b5fdba952ce65b5a85578f2a81b37daed0948
SHA2569948b1c18d71a790e7b5a82d773fea95d25ab67109843a3f3888f3f0ac9d1135
SHA5127a5877e0eaef6424ea473a203184fedb902cd9d47df5d95d6f617ca4efa1162f0ffd418e9bc6b7492f938cb33fc6384907237487d6ad4f6d0d2d962402529d8b
-
C:\Program Files\Java\jre1.8.0_51\lib\rt.packFilesize
13.1MB
MD5f0177701b36068c9a2bb4924dd409fa5
SHA171e4b32c95e20dd565a6603d3de3819eb4f19d33
SHA25693c1e08034b68e12d78005c2950145595327477c17c1f716248d3e16313b4eec
SHA5128e198bf60dbb95f38bf5eca67c9b7cd4fe9920890ba3d569e08de59b38c1b00830a0a37168fd74c874df86b7ff0915c8b69adb1591432b42b5ff35e5885e6641
-
C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exeFilesize
34KB
MD52e7543a4deec9620c101771ca9b45d85
SHA1fa33f3098c511a1192111f0b29a09064a7568029
SHA25632a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1
SHA5128a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d
-
C:\ProgramData\Oracle\Java\installcache_x64\diffFilesize
9.1MB
MD5d417682702b140d7131851bae877f046
SHA1aa78da727e8a62c839a9bb6f7a93b48d3a04be70
SHA2563b3657c83e4f588f0e759cd46e99309cece2ebb54af2c377f9dc087ec764fda8
SHA5129e107b7f61e42410807aa1e6761ac7adce412846f69ae8e2e21b147e39d1a95d41367e21624381750eb11c77322206c4d869a477e5442e8323405c85854c03cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950ABFilesize
834B
MD5a0af4d81b2b19a99a3d01be89d5f99d9
SHA14725c1a810005f860ede9dace7f1e5a20e5230d6
SHA256de9f05ceb1610cf9964f0def09d525005569602993c82a647743f192e9414d4a
SHA512eb98d475d51d07b929d92fe5aa00bfa21078f567906f3650eb3bebfff39c616a21918da8f0687853310acebdb160d4f65451204619a7b8085fbbc25491bb0554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
471B
MD587fb52832b75e3d4277c862750c45113
SHA1142af7416382c80cdf834715d1d63bc6858c2946
SHA256c4f05792cda8510ed77d940fc33053d288cf4ba64429b07be3d751d8926fe1e0
SHA5124d8e08cbac1589298d6c047d7245a1885ef236804cd3de48ae056d0ab65e2348c1241dea979866c16c5c44fa363e3ac0f8ab034663bf1de7ec241700bf61d881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CEFilesize
5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCEFilesize
1KB
MD553a9f05239a10b7a4740d9e7e8da6a46
SHA18f526b3e94b5d02f3be9bc3c41eb715fb2a5d118
SHA256be468dfa7dc23940d54455379df4339eda8afa9a4160198e244002ef65d431ab
SHA512469c9d84f85a4643ca7163166231cbaf5f7eb0b910cf7c2db53fae66c2056905da40fccd68d41d252c2c7c90895b0779d967557d0e8f40d230910362a05247d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950ABFilesize
180B
MD58040ccbde8d115381ea83abc2baabfb3
SHA1eebc13711f79f57d66dafd32114167be4c85a840
SHA256daec45fc5447c6c55c773fe214a4aa7cb98dfdbd9183e4e829e6ddda8a78ba12
SHA512c79eee398d6ee8a43889db63b6402706cb6212dd7675db7c808316f08e0bf9e76749887b9e0e019c584c954f4a7aee08e9a2ab0bc55583fcd9c570014e4bf17c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5d52364cb0237afebc8bb20ba7005dd5d
SHA167a1e98b5a590b2668cd5bd631b2dd6311edc9b2
SHA2569e0ae442222f0f5bdc9d2c2dda23af90558d49a2e99516a4b19a3bc360aababf
SHA5121f37308baa1256c00cc1426d1aca87e36cd158430f134253b5d4e6475449675ace7ea95dbd2fd1424981dd158a1ed1a9d19cc4f6de7fb9a3bbbd92d70eb18e37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5ce48ec4e812bbcf2341c0d350efce64b
SHA13e3a71e44da02fc98d0cc408784a69721909d4ee
SHA256822830cd9c7f06f1c892955f48a74d976cba15c98c8538f3c6ad3e7bf6b62888
SHA51222e3af1fa5bb3b1272038500555615fa4946c483dc391f92b73385c6a30a108bbc836c9b175af9b6e2b762521b938b647fbc63559b0c0c6599a70ee42ae0a289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5adb096eb6da171b0c411b5509f1397a3
SHA148cb3a4233e8e6d0030e698a00093b1f648c7844
SHA2565113bb912e7e4034269e229df7d43b0711cd007a44515957cca533100e479bc9
SHA51238ff103319894fe80c3259d5426ef1d6eed61c19c0bd0064f42afdcebc9e4d8c3cc7e705bf466ebae6678508132f4316343419648f1d75a3ae6cc065ce76024c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD51a679aec5ee640b7b6ebe9a0ee5fb8e1
SHA1c734bde69cc7316339ca2ceed896b61c31c14354
SHA25610c32a1fe56c16129bbe2246b38c568f9c323e686eaf22631507b3346a408e56
SHA512d1406121b1d0d719d4105ffe13b879b5d76d6599904a4d7568860b8e31ae21020b8e1f85235473f6360403a256d615d013e0f13b6c14fe4d03901f6a2e69e283
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD55e549bbaf5a99982040d377b09beff09
SHA15388fdeabe7e45687524578214863d82fe5762b5
SHA25697dd6ee9014d57b1e7c38513d72f225424097d233fca8f8ec7caae5f3d6d8e65
SHA51231ceb39db76be39847d1c6046de2900dc847651f6284701468464b262bc9041d7cfb25f84ce7fa49dbd93de9b706896ae84adcb915a6f5d40b77c5aba13e6ca4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD55b6d5c7f9f16946bb09f9de20225c68c
SHA1dd971e9f39ea39ec449414f0083dae13bdc6fd37
SHA256c0944e66888c2668b5f8deb5213c1671a1aec0900bde0fa57f31946e60bc1d1f
SHA51257b3e088b491b775693eb02230579105bd373dae65e222d87974b13c3b8205e505ee834454e4da60321c525761d2f3cfb3dbf30f4d2ad35529ee799700a94616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5e6d76b5c2547dd4032dcb965aab029b5
SHA1d127230b0eac2bd1f738bad0d996fb21ab9f7b41
SHA2567ebcb1ff05feed90349eea2dad3bd7a679540f89c18ed49b402d0d775bc4424a
SHA512bd6d6fc0b6b009822c0bc88a44e30df817b9d4cdd3004c731dc1297031db7e2ff2b122dcb9780078ec526b7e6c5e513f1565d9237a12386c92df91e4a5e24960
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
400B
MD537d50c2d7fc1cb2d2a9738f9da51349d
SHA1c31e5792d32662c6430663c2f93627836af770ff
SHA2560f0ef3560dd91e5905b418a5afff18cd03561612abe6224840b4a5252c092eaa
SHA51218c2580db4cceeb25b79a2fc0e33b336b1ee43d3df90e97d908dab3670ed985bd0417f0b0137d554c21552dabfd9628d096b07e7c3b2ef885704187b080f380f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CEFilesize
398B
MD564c68bf2f24148351d729dfb62723000
SHA1be258fe521791ae0acfa1e77ac7b8abfeee4c67d
SHA2562d55c6e15afe3c28236f1422fcbc737becb3bf6c34cf69c95b2c6e6c023a2a55
SHA512b217cb38111fc18d1cbadbbbe45d3fa9c39c698e17e6c8ea9f0d35333f6ddb824f24ad25e4b36eeeaa08c270ed392f512a3c028e53d46d10ad3cb81784bac8b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCEFilesize
402B
MD5da9a56b82fc2b2b961fb72bbbb4ffb85
SHA13a78d11ad7279f110175e600277e78e07d14a7b3
SHA256b002a25dd7ae8ce9d8968e8e5c8c1e2b76b48460d6e28ac2417db34e2dfcfbe5
SHA51249721eb97627d3ddac28161e1b7e9464cfda756d09d15fa9e297ad7520870601df790660ed11e2f0697021ea419a987f4856e319b4d2f91efbebd278a2805b8d
-
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.propertiesFilesize
1KB
MD5eaa7458aa208da39e166ca8387653105
SHA1976eb99f8162c257f62adf48f2632cf742654a62
SHA2565f9cd90486ab6cf93e86cdf67d216ebc61c20c9c8596bd2f6351135edc599e29
SHA51200eeacb4f091549837981ab5777bf21a8c6bffbe0f769c54b87cf97026ebb91f21f4e7e507c541a90443b32a8d6a6a6a1f6c28ad107ba4134d44c71a5f6384e9
-
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.propertiesFilesize
1KB
MD5bf715ab337d47203b2a5ac64a0855c92
SHA1bc9531291fd23a2e5c5cfc2f7e5ddd6ffde705a1
SHA25687681bb9a3ad831280284f63b7f8b4030cfe9c94ff93e4985a0e232f93d3a1e3
SHA512eb7b02c7b56649c6f75cb4abe0b78a57be9e3217cf95ff5dbfa6c47b5f5bcd428ca0d03d9a3ed7e4bd181c9a6dcf415a625ebb5dd220259af8b66acb780859df
-
C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.8.0_51_x64\jre1.8.0_51.msiFilesize
38.7MB
MD51ef598379ff589e452e9fc7f93563740
SHA182ad65425fa627176592ed5e55c0093e685bfeef
SHA256d4bdc230eaebefe5a9aa3d9127d12ac09d050bf51771f0c78a6a9d79a1f9dbf2
SHA512673f4b08fc25e09e582f5f7e01b2369e361f6a5b480f0aa2f1d5991f10076ba8a9d6b1f2227979b514acc458b4fdc254fc3c14173db7e38b50793174d4697f23
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NVDR4C1U\jre-8u51-windows-x64.exe.ooy7o8u.partialFilesize
41.2MB
MD5b9919195f61824f980f4a088d7447a11
SHA1447fd1f59219282ec5d2f7a179ac12cc072171c3
SHA2563895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01
SHA512d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6
-
C:\Users\Admin\AppData\Local\Temp\Tar3155.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.icoFilesize
116KB
MD5e043a9cb014d641a56f50f9d9ac9a1b9
SHA161dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA2569dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA5124ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exeFilesize
1.6MB
MD5199e6e6533c509fb9c02a6971bd8abda
SHA1b95e5ef6c4c5a15781e1046c9a86d7035f1df26d
SHA2564257d06e14dd5851e8ac75cd4cbafe85db8baec17eaebd8f8a983b576cd889f8
SHA51234d90fa78bd5c26782d16421e634caec852ca74b85154b2a3499bc85879fc183402a7743dd64f2532b27c791df6e9dd8113cc652dcb0cdf3beae656efe79c579
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMPFilesize
12KB
MD53adf5e8387c828f62f12d2dd59349d63
SHA1bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA2561d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
SHA512e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNGFilesize
43KB
MD5803866e63e1b433eafa31ddf1819d88a
SHA1e5cbdf988d8711b831981c9cc5c2695e44ecd963
SHA2563cff2eae4bc6ef69c72d163d41c4f387e8cc3413772024062d093583069fc6f1
SHA512d494faf98f9179111f0a1e6ba8261d6b0924172c57663ae26efc4aa3022c1420dfc980705ca5579169a33a68baa299bdf3c38b8f322fbf2e54ed0f36198aff98
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG16.PNGFilesize
644B
MD54c8bb522e8cf8c27b8e7fc318c7ab17b
SHA13071a7f9b977d6a27e9ab0777456b3c13753568a
SHA2563eccb1386194744d6596a9c3abf854ea591e12742d789518e90afb99fa370871
SHA512d112bbbcaed8b8ec04bf52fa0f2a320c04dc4962c862e383e27b6f4f8bff621ee201b982140f84b6de527753e92511e21be539296a9aa38e572a5d5051c7d539
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG18.PNGFilesize
40KB
MD554c173de619065c86d50c5c7cf66097a
SHA158111b16ba2075c2fcfe30ddef29ea66108cf9ad
SHA25630db6860833fe2f29801d604bda19e5a0d2a4b9f409caadce56dde13324078a7
SHA51285ec2700ebbc18bfcbee25f3b025a9c1d3b32502f6b4313c2df124f454c0d9d098414bef0a8bf44f7e5b3eeeae6e3491106c2b477d69b94158b897ea6b0f5b57
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMPFilesize
12KB
MD5f35117734829b05cfceaa7e39b2b61fb
SHA1342ae5f530dce669fedaca053bd15b47e755adc2
SHA2569c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
SHA5121805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMPFilesize
12KB
MD5f5d6a81635291e408332cc01c565068f
SHA172fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA2564c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
SHA51233333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG49.BMPFilesize
1.8MB
MD55c9fb63e5ba2c15c3755ebbef52cabd2
SHA179ce7b10a602140b89eafdec4f944accd92e3660
SHA25654ee86cd55a42cfe3b00866cd08defee9a288da18baf824e3728f0d4a6f580e7
SHA512262c50e018fd2053afb101b153511f89a77fbcfd280541d088bbfad19a9f3e54471508da8b56c90fe4c1f489b40f9a8f4de66eac7f6181b954102c6b50bdc584
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNGFilesize
438B
MD5c2d61af0e799bbc8bcde7bb15564952b
SHA109bb6c51afcff1276a9ea2a795a9cf3e5ab4494a
SHA2565ca45fb4679f8ec9671685874fe70871f1cb49e6b6f6210137864784888d070e
SHA512edc12546dc237505c698092db968d04399a697c0bd9a10e56daec05340864d24f56939e182a052275f6a750aeb4a02f32b21cda0311278ed8e0bc758bb577743
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
7KB
MD5626167c63254a317c9301d0f948e32de
SHA1e01d079e79782ea5803ca84b3908f2c827a38151
SHA2565aa4d0e1ee250355b245946671b1f402f24a7e367e34df19a4230e3e0e5df75d
SHA51280eb7428e9433463704a1db9f06d6331c10d1a3a920a3ef6e865acce15c72a1509e51d557ae39cbcc1b6173465dcace90623449dfea5e0c510e684a06ed4a8d5
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
18KB
MD55d9fd7113158545a8a0da2ffe10c611d
SHA1d518cfda8303d12ce2aed7c249504ce6cf4d4fff
SHA256f176359031952b6ac845e316d88e361fbd2ec1531f944a077f8774e1a7d7afb7
SHA512a6f1ee9d69dc1286827aa33f345ea4ccb489a792edea4f63f9cfc85cbaae26b1ae9c31b6f79da6112f83ce655e9c2ccf7ec9958a0186a4f989acd3dff3f1ae91
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exeFilesize
9.1MB
MD5833512c89f1ab92c80131d415f89f442
SHA1dd9953ddcc33278bb97502ffdc6e7462e8005680
SHA256717f80429e16e7c467a8472dfb0404e22fdf2d67ecd94018b6536dc9d995bff6
SHA512f23201251ea19b6122f60a788a027bd59aca1233b17b265709a51a2babc1eea1394a4400eadcc6792bb5f9843d73a95660f60f487779cbfc05766f53fa3ef3d1
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNGFilesize
45KB
MD5baf26cf75bcc4e8d89ab634d96191627
SHA17b3acdb1ea5cc827b079cd2b5ebffcffedc1da9a
SHA25681b942e871ef52c2fcd67c769f400e3f9f9bdd5921b4eb77f85c9653bf8715f0
SHA5121162675a91229ce9c92161b17ab765693d455956f8217dc71ae916364a289a37bbebeef23415ffc5b6b8374321838dd259b26184d6aa3865c69d92a254068ec9
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNGFilesize
206B
MD519cc60490b1c2ff33fd88054ea0b08fa
SHA1e0efb3ffe0e9de359922d134c68f67371d0fe21a
SHA25649708851bdda2b324cbe7fa391af81ff3fab72de28c88b073035b1ec87fc5e57
SHA512452fb6a1f9b7a908f6bfc7634a6f9de848adbe37fa080977060d5b2eea7da1207b87b1449b37a909d6be8e748fc39c6e7d30829546751f9c60c2490f2bf46aa6
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG14.PNGFilesize
41KB
MD51cde7f4b65d7915806fffa1dc22bb527
SHA1fe0dce2a7ea338b44e1d264288379ac14289c430
SHA25604079a342d1ada8ef6ae3ca5503a307a72637061c6d34cae90a3dfb342ff9727
SHA51284bc5e70bbc6ac35a351e271796af476aaa7dc40edbb5adfc6b85978dc855787c1d20060792e9efdfe4e8aeb6f271efc4df4a757d79ee53d057bcac3d79587d7
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNGFilesize
475B
MD5aed347c1520185c3d1ca24604e5689e2
SHA1d1a213e4df60376d3cd9c4c8d97051a74c5a42e3
SHA256c6c1a74804e7ef24c8f0fe671f9776ffaa96fd78f8cf609be29394ec4b528580
SHA5127b7ad53f205fce8c0b19c68a33affa41d79e780fa10a67fba11239bf3c06b7995764f237ba0dcce3d6f9fdbd9038c6ecb73f3c504066bd71f2dd4224d8d86aa5
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNGFilesize
368B
MD529bacaeca4131335a6821277b65aec45
SHA1050fbd5270b614c3ec14ae4609f91667922f5416
SHA25620c7e42db9c1f0df908dcaf4fa7536ea9d236b747a30d55d1744a286ae8d9e06
SHA512747b3cbbed596517c19eab89830a781ec4fc0f52cdae642250b1a941092dbc0f40e6096e423f496e6e267f99e164a97031359568d842691c432cc445af7410e6
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xmlFilesize
23KB
MD596a1ad2e74a181a7fd8de600a7935b13
SHA181fa49bd195828707dbe6f4cb4793eb1c380c559
SHA256e7c612897feb4b04c660b17b552237eaebdb6ba9ba70c0c4770501186b41e0a7
SHA5124f85c05a850cd93b1c82f74ef344f17ecfc88e4523a0b0f7df4b83352b4d6a7577ac2da2153468a8fb3b8891cb5b33a4282b611daaa29ff5b220f74ef5cb43cf
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xmlFilesize
4KB
MD58a9e256b76914b4b5bf3f3ce1ba6a57c
SHA1e46ebea66c094072811af26ada1159b92099ee11
SHA256953c4d799255b5ca3d9b0d9bfa2d520f2952d73b77df9919f196f9b2d01e673f
SHA5123335bdd21801be2d996f96acfce82aef397f67d0d8e033a2c30351f83d5d3200455a717b9dbd0cad7f4525f2ad3ff3c15cde5af5d54b3a8855c69436f7f5027d
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\2.923\dependencies.jsonFilesize
17KB
MD524817047786540dd5d8cbfb94132c84d
SHA1ff45f1ae7748fab985e0580c5746b0327a4b59ac
SHA256a5584b00241e6aa455dce9c0d584d61f8350a7bc07a4137e9289e23f46878721
SHA5126e048803859517d052d88d8c96c382d481620c1d930e219051264cb2c4d096b5b68d8e8e66ba2244ef7343df99f120600f8763f67bcf060c3132743eca7934ef
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\2.923\resources.jsonFilesize
17KB
MD58ab0113596cd48af76657e53d5d93e70
SHA13ab4244668932e0396022372d8f311c62ce1b89b
SHA256b0a6157bb0f4da765f93d13ca167017144c5eb15955015b0b42f7d7c0b70599d
SHA51255fb4d7ed644ae5e47ee376b00323199788baf596b493b4959ec4c88bdb37295ee59e34d3a7d4310fc9e35d776e1ae19fcead53c09d3a440dcfec8dc6736b170
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\appConfig.jsonFilesize
3KB
MD5a9bd1871a6a69e12bb017e1375b0a659
SHA10cc4c515fea150c982d02fa73acf73cfa68810e7
SHA256f725e50dc4377a28b06589b028cd3cff58845d5ed882b22b17129c4413f8b9b3
SHA5120595d54b19805f57a1b09a492c90c4c9f655d6a501179966b1a282b0aec90b27eeba634ee4a54fb9982f80ae046e6feb2b3e2097f14a0a3e051e80c162a83bd6
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\javaConfig.jsonFilesize
3KB
MD5e2cbea0a8a22b79e63558273dded5e6c
SHA1bfbbbba0679adcbcf9e079ed3c7c7a60cb0b2d61
SHA25610d0f3646be0a7d73942d7bdd1e55c4b8df0c34cad7ad15a9dc23b2932155007
SHA512a6aa26ff49c911fb4705df1e8e434c72e206b20fdaae0abc529e2734f5db49c75da35c3d75769e0ac1b6795de540de4c7e1089b387217fc58f8b19b023064e5a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\N9UDVAVJ.txtFilesize
512B
MD5850b6b229bb2346d5873a547b964872f
SHA158a44289032051800a858a06c122c42de7d460d1
SHA25604da2ab54d92c54a8ca296bdbc8cf77d4f9f118cd7017c055d1cc54a02ab7d7b
SHA512b85a2484a3909f4e21ec237faaa86d52cdee972e83ee4a0fb5a9eba1f6d872ba6bb0e8b0e4f9fc7580c24a8127d0f48cf2b0e94aa917cc748182ddc9a91f3438
-
C:\Windows\Installer\f770a39.msiFilesize
660KB
MD54afca17a0a4d54c04b8c3af40fb2a775
SHA196934a0657f09b25640b6ad18f26af6bd928d62f
SHA256b15d3a450b7b3e5ce3194ab9e518796cc5f164c3e28762ffe36966990dcd2fe8
SHA512ee76f5fcfdd9c1202fd5abdc2bbde8fb2543cee83265f6d2fb5458d1a086152ff6bdd4bf62a88150d325ea282bd2ecd66dd5f127bdd847cfa69cdb88985a8305
-
\Program Files\Java\jre1.8.0_51\bin\unpack200.exeFilesize
192KB
MD55b071854133d3eb6848a301a2a75c9b2
SHA1ffa1045c55b039760aa2632a227012bb359d764f
SHA256cc8d67216b1e04d7a41bf62f9c1088cd65a3d21796c5a562851e841b3afa28cf
SHA512f9858ec0a1bfb7540512ede3756653d094ff9fe258d13a8431599280db945e8d9ea94c57595c6a21aa4fbfcd733eea9b887bfcf87e84279a7e632db55380920c
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmdFilesize
1.7MB
MD5dabd469bae99f6f2ada08cd2dd3139c3
SHA16714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b
SHA25689acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606
SHA5129c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmdFilesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.2MB
MD5af9bb57e1893112a57a47df0908bc3d1
SHA139f31da08004741fd4b9fb31b04e29368f1e317e
SHA2561cf4f5e5d5bed48b7c989e34bb80507ca623cb1ac1fc1596f07cfd1dc7aec60e
SHA5123a8cd6660a0147101f4898c20a6fec1192b4196ae8e46cd3e730dc43c8bd7feed9c576590b6aa79c7763e5942466ac9118d44177edbc2ff1ddf1af3da5234040
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllFilesize
325KB
MD5c333af59fa9f0b12d1cd9f6bba111e3a
SHA166ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0
SHA256fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34
SHA5122f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4
-
memory/1320-685-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/1320-687-0x0000000000430000-0x0000000000433000-memory.dmpFilesize
12KB
-
memory/1320-19-0x00000000010A0000-0x0000000001489000-memory.dmpFilesize
3.9MB
-
memory/1320-801-0x00000000010A0000-0x0000000001489000-memory.dmpFilesize
3.9MB
-
memory/1320-802-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/1320-2197-0x00000000010A0000-0x0000000001489000-memory.dmpFilesize
3.9MB
-
memory/1420-3418-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/1420-3417-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/1420-3411-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/1420-3373-0x0000000000560000-0x000000000056A000-memory.dmpFilesize
40KB
-
memory/1420-3374-0x0000000000560000-0x000000000056A000-memory.dmpFilesize
40KB
-
memory/1800-3483-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/1800-3485-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/1928-15-0x0000000003520000-0x0000000003909000-memory.dmpFilesize
3.9MB
-
memory/1928-14-0x0000000003520000-0x0000000003909000-memory.dmpFilesize
3.9MB
-
memory/1936-2962-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/1936-2953-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1936-2961-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/1936-2978-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1936-2960-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/2036-3552-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2252-3463-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2252-3466-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2312-3363-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2312-3369-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2312-3326-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/2312-3325-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/3208-3725-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3562-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3599-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3613-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3646-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3597-0x0000000001BA0000-0x0000000001BAA000-memory.dmpFilesize
40KB
-
memory/3208-3972-0x0000000001BA0000-0x0000000001BAA000-memory.dmpFilesize
40KB
-
memory/3208-3674-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3971-0x0000000001BA0000-0x0000000001BAA000-memory.dmpFilesize
40KB
-
memory/3208-3596-0x0000000001BA0000-0x0000000001BAA000-memory.dmpFilesize
40KB
-
memory/3208-3697-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3711-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3747-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3728-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3731-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3208-3739-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/3280-2200-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3692-3241-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/4064-3321-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB