Analysis
-
max time kernel
210s -
max time network
211s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 05:03
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-Installer-1.4.7.exe
Resource
win7-20231129-en
General
-
Target
TLauncher-Installer-1.4.7.exe
-
Size
24.1MB
-
MD5
86fc2557f00baf9698715dc99a8cec41
-
SHA1
75f8f54eabd25749af37d21316f02d7d5868c398
-
SHA256
9f0ffcd4852f9af353558f104dd8edf13e67971076341e87da304b8e6d8c5414
-
SHA512
521e19cc02c996fc478fead4239cd3ab24b70a441df138ed955d349eb46e7a03ccc10a3d58d8dc726292f494d6bd6efd2a92f62d3f179cb2751fc725ea7d449e
-
SSDEEP
786432:lKxabBbJyM9irrKJBH5lFRqH0fYk/pUJ8a:lKcSMQPKJBZlCUfYSpUJ8
Malware Config
Signatures
-
Downloads MZ/PE file
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 24 IoCs
Processes:
irsetup.exeTLauncher.exejre-8u51-windows-x64.exeinstaller.exebspatch.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exejavaw.exejavaws.exejavaw.exejp2launcher.exejavaws.exejp2launcher.exejavaw.exejavaw.exeTLauncher.exejavaw.exejaureg.exepid process 1992 irsetup.exe 3960 TLauncher.exe 2928 jre-8u51-windows-x64.exe 2884 installer.exe 2768 bspatch.exe 3880 unpack200.exe 3932 unpack200.exe 3972 unpack200.exe 3732 unpack200.exe 3716 unpack200.exe 2100 unpack200.exe 2084 unpack200.exe 2600 unpack200.exe 1872 javaw.exe 2924 javaws.exe 4008 javaw.exe 2616 jp2launcher.exe 1420 javaws.exe 1948 jp2launcher.exe 3404 javaw.exe 3560 javaw.exe 3784 TLauncher.exe 3664 javaw.exe 2632 jaureg.exe -
Loads dropped DLL 64 IoCs
Processes:
TLauncher-Installer-1.4.7.exeirsetup.exeiexplore.exemsiexec.exebspatch.exeinstaller.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exeunpack200.exejavaw.exejavaws.exejavaw.exejp2launcher.exepid process 2344 TLauncher-Installer-1.4.7.exe 2344 TLauncher-Installer-1.4.7.exe 2344 TLauncher-Installer-1.4.7.exe 2344 TLauncher-Installer-1.4.7.exe 1992 irsetup.exe 1992 irsetup.exe 1992 irsetup.exe 4060 iexplore.exe 1356 2596 msiexec.exe 2768 bspatch.exe 2768 bspatch.exe 2768 bspatch.exe 2884 installer.exe 3880 unpack200.exe 3932 unpack200.exe 3972 unpack200.exe 3732 unpack200.exe 3716 unpack200.exe 2100 unpack200.exe 2084 unpack200.exe 2600 unpack200.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 852 852 1872 javaw.exe 1872 javaw.exe 1872 javaw.exe 1872 javaw.exe 1872 javaw.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 2884 installer.exe 852 852 2924 javaws.exe 4008 javaw.exe 4008 javaw.exe 4008 javaw.exe 4008 javaw.exe 4008 javaw.exe 2924 javaws.exe 2616 jp2launcher.exe 2616 jp2launcher.exe 2616 jp2launcher.exe 2616 jp2launcher.exe 2616 jp2launcher.exe 2616 jp2launcher.exe 2616 jp2launcher.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral1/memory/2344-5-0x0000000003250000-0x0000000003639000-memory.dmp upx behavioral1/memory/1992-19-0x0000000000300000-0x00000000006E9000-memory.dmp upx behavioral1/memory/1992-800-0x0000000000300000-0x00000000006E9000-memory.dmp upx behavioral1/memory/1992-832-0x0000000000300000-0x00000000006E9000-memory.dmp upx behavioral1/memory/1992-1542-0x0000000000300000-0x00000000006E9000-memory.dmp upx behavioral1/memory/1992-2210-0x0000000000300000-0x00000000006E9000-memory.dmp upx C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe upx behavioral1/memory/2768-3009-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2768-3020-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\"" msiexec.exe -
Checks for any installed AV software in registry 1 TTPs 3 IoCs
Processes:
irsetup.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast irsetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast irsetup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir irsetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
installer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} installer.exe -
Drops file in System32 directory 2 IoCs
Processes:
installer.exedescription ioc process File created C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe File opened for modification C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
installer.exeunpack200.exeunpack200.exemsiexec.exeunpack200.exedescription ioc process File created C:\Program Files\Java\jre1.8.0_51\THIRDPARTYLICENSEREADME-JAVAFX.txt installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_fr.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jp2iexp.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\access-bridge-64.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\rt.jar unpack200.exe File created C:\Program Files\Java\jre1.8.0_51\bin\j2pkcs11.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\javacpl.cpl installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\resource.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\calendars.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_de.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\charsets.jar unpack200.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_ja.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_sv.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\[email protected] installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\meta-index installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\images\cursors\win32_LinkDrop32x32.gif installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\javafx.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\jsse.pack installer.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe msiexec.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jli.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\prism_d3d.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\decora_sse.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\JAWTAccessBridge-64.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\server\Xusage.txt installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_zh_TW.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\cldrdata.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\sunjce_provider.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\README.txt installer.exe File created C:\Program Files\Java\jre1.8.0_51\THIRDPARTYLICENSEREADME.txt installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\fonts\LucidaSansDemiBold.ttf installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\management\jmxremote.password.template installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\psfontj2d.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npdeployJava1.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\kinit.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\images\cursors\cursors.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\awt.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\glass.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\management\jmxremote.access installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\java-rmi.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\cmm\GRAY.pf installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\kcms.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\mlib_image.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\management-agent.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\LICENSE installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\fxplugins.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\w2k_lsa_auth.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\amd64\jvm.cfg installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\security\blacklist installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\rmid.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\net.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\javaws.jar unpack200.exe File created C:\Program Files\Java\jre1.8.0_51\bin\hprof.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\msvcr100.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\server\jvm.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_ko.properties installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\resources.jar installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\tzmappings installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\javafx_iio.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.pack installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\jsound.dll installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\ssvagent.exe installer.exe File created C:\Program Files\Java\jre1.8.0_51\lib\security\cacerts installer.exe File created C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll installer.exe -
Drops file in Windows directory 16 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f773887.ipi msiexec.exe File created C:\Windows\Installer\f77387e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6FA8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE25B.tmp msiexec.exe File opened for modification C:\Windows\Installer\f773887.ipi msiexec.exe File opened for modification C:\Windows\Installer\f77387e.msi msiexec.exe File created C:\Windows\Installer\f773881.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3CC4.tmp msiexec.exe File opened for modification C:\Windows\Installer\f773884.msi msiexec.exe File created C:\Windows\Installer\f773889.msi msiexec.exe File created C:\Windows\Installer\f773883.msi msiexec.exe File opened for modification C:\Windows\Installer\f773881.ipi msiexec.exe File created C:\Windows\Installer\f773884.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE1FC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE2CB.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = c857ffe9e1c9da01 iexplore.exe -
Processes:
iexplore.exeinstaller.exeIEXPLORE.EXEirsetup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_51\\bin" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4B5F-9EE6-34795C46E7E7} installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024" installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{236C9ED1-35D5-11EF-B7D6-72515687562C} = "0" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_51\\bin" installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_51\\bin" installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2052e3f9e1c9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab1da5dae7ac51438e392a34634d9e3600000000020000000000106600000001000020000000f8969701ee7c30420e53b7eb1367cc9a59e75f125edae2ee9e79234566e5a7ef000000000e80000000020000200000005557d1863853a3b6910d3d11e153524522f3961cef8b9068c6bd673de01ce003900000001f8dcd67d4f39d017002c6cf810ad13d260efc58a69a9936570a889c8ee33f85d4cd060884cccc0994528ba80f33fd94f0a816a6930772b2e46c4c68090506b4a550683f38bee42a936883deb52152054b0437fe50c54240cee99f8e2dae84a4953bc1216bd4bed48bbacca9079b61f419e84abe5f7660c650678e7d0f6f49cd15ad620c068452a975fa87a25bdc3e724000000064bfe6f0f755b9c7c1bee4e3483cb1e3d25fadc2edd637edb6fab27b2d5b78e65d7dfaeb5c59b15d3cb7f3bf45e50b5a8f09e1d31f950027685d2ae8ac04a114 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab1da5dae7ac51438e392a34634d9e36000000000200000000001066000000010000200000009311ca476092989f17bbc6057633d36a2788cb560239d258a1d183cc914beac6000000000e8000000002000020000000dd8bacffd2646807c4a793f9757590a1dd4b244333c8ff7e7d9f10c572b8e70f2000000050fd0e43182e1bc1ceed6d01751dbcaf82883e44c3ba71e5ee5b90cdb4ab37ba40000000f8ad6ce715eb7f54de4ea53155f638370da402db1816ddf2f0018a0a9266d9d6dac6f5f85972604edf28b25a2fb7e869dda0eb045ba4d637495e875afeef5828 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F msiexec.exe -
Modifies registry class 64 IoCs
Processes:
installer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0028-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_28" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0066-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0092-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_04" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0013-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0040-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0041-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_41" installer.exe Key deleted \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0031-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0054-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_54" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0079-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_15" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0093-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0032-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0061-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0037-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0062-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_62" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0089-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0076-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0061-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_61" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_28" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0071-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_71" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_17" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_36" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0019-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0046-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0061-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0082-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0080-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0078-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0073-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBC}\InprocServer32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0043-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_43" installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBC} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0088-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0049-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0076-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0048-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0077-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_77" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_47" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0002-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_02" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBB}\InprocServer32 installer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
jp2launcher.exejp2launcher.exemsiexec.exepid process 2616 jp2launcher.exe 1948 jp2launcher.exe 2596 msiexec.exe 2596 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
jre-8u51-windows-x64.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2928 jre-8u51-windows-x64.exe Token: SeIncreaseQuotaPrivilege 2928 jre-8u51-windows-x64.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeSecurityPrivilege 2596 msiexec.exe Token: SeCreateTokenPrivilege 2928 jre-8u51-windows-x64.exe Token: SeAssignPrimaryTokenPrivilege 2928 jre-8u51-windows-x64.exe Token: SeLockMemoryPrivilege 2928 jre-8u51-windows-x64.exe Token: SeIncreaseQuotaPrivilege 2928 jre-8u51-windows-x64.exe Token: SeMachineAccountPrivilege 2928 jre-8u51-windows-x64.exe Token: SeTcbPrivilege 2928 jre-8u51-windows-x64.exe Token: SeSecurityPrivilege 2928 jre-8u51-windows-x64.exe Token: SeTakeOwnershipPrivilege 2928 jre-8u51-windows-x64.exe Token: SeLoadDriverPrivilege 2928 jre-8u51-windows-x64.exe Token: SeSystemProfilePrivilege 2928 jre-8u51-windows-x64.exe Token: SeSystemtimePrivilege 2928 jre-8u51-windows-x64.exe Token: SeProfSingleProcessPrivilege 2928 jre-8u51-windows-x64.exe Token: SeIncBasePriorityPrivilege 2928 jre-8u51-windows-x64.exe Token: SeCreatePagefilePrivilege 2928 jre-8u51-windows-x64.exe Token: SeCreatePermanentPrivilege 2928 jre-8u51-windows-x64.exe Token: SeBackupPrivilege 2928 jre-8u51-windows-x64.exe Token: SeRestorePrivilege 2928 jre-8u51-windows-x64.exe Token: SeShutdownPrivilege 2928 jre-8u51-windows-x64.exe Token: SeDebugPrivilege 2928 jre-8u51-windows-x64.exe Token: SeAuditPrivilege 2928 jre-8u51-windows-x64.exe Token: SeSystemEnvironmentPrivilege 2928 jre-8u51-windows-x64.exe Token: SeChangeNotifyPrivilege 2928 jre-8u51-windows-x64.exe Token: SeRemoteShutdownPrivilege 2928 jre-8u51-windows-x64.exe Token: SeUndockPrivilege 2928 jre-8u51-windows-x64.exe Token: SeSyncAgentPrivilege 2928 jre-8u51-windows-x64.exe Token: SeEnableDelegationPrivilege 2928 jre-8u51-windows-x64.exe Token: SeManageVolumePrivilege 2928 jre-8u51-windows-x64.exe Token: SeImpersonatePrivilege 2928 jre-8u51-windows-x64.exe Token: SeCreateGlobalPrivilege 2928 jre-8u51-windows-x64.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 4060 iexplore.exe 4060 iexplore.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
irsetup.exeiexplore.exeIEXPLORE.EXEjp2launcher.exejp2launcher.exejavaw.exepid process 1992 irsetup.exe 1992 irsetup.exe 1992 irsetup.exe 1992 irsetup.exe 4060 iexplore.exe 4060 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2616 jp2launcher.exe 1948 jp2launcher.exe 3664 javaw.exe 3664 javaw.exe 3664 javaw.exe 3664 javaw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
TLauncher-Installer-1.4.7.exeTLauncher.exeiexplore.exemsiexec.exeinstaller.exejavaws.exedescription pid process target process PID 2344 wrote to memory of 1992 2344 TLauncher-Installer-1.4.7.exe irsetup.exe PID 2344 wrote to memory of 1992 2344 TLauncher-Installer-1.4.7.exe irsetup.exe PID 2344 wrote to memory of 1992 2344 TLauncher-Installer-1.4.7.exe irsetup.exe PID 2344 wrote to memory of 1992 2344 TLauncher-Installer-1.4.7.exe irsetup.exe PID 2344 wrote to memory of 1992 2344 TLauncher-Installer-1.4.7.exe irsetup.exe PID 2344 wrote to memory of 1992 2344 TLauncher-Installer-1.4.7.exe irsetup.exe PID 2344 wrote to memory of 1992 2344 TLauncher-Installer-1.4.7.exe irsetup.exe PID 3960 wrote to memory of 4060 3960 TLauncher.exe iexplore.exe PID 3960 wrote to memory of 4060 3960 TLauncher.exe iexplore.exe PID 3960 wrote to memory of 4060 3960 TLauncher.exe iexplore.exe PID 3960 wrote to memory of 4060 3960 TLauncher.exe iexplore.exe PID 4060 wrote to memory of 2516 4060 iexplore.exe IEXPLORE.EXE PID 4060 wrote to memory of 2516 4060 iexplore.exe IEXPLORE.EXE PID 4060 wrote to memory of 2516 4060 iexplore.exe IEXPLORE.EXE PID 4060 wrote to memory of 2516 4060 iexplore.exe IEXPLORE.EXE PID 4060 wrote to memory of 2516 4060 iexplore.exe IEXPLORE.EXE PID 4060 wrote to memory of 2516 4060 iexplore.exe IEXPLORE.EXE PID 4060 wrote to memory of 2516 4060 iexplore.exe IEXPLORE.EXE PID 4060 wrote to memory of 2928 4060 iexplore.exe jre-8u51-windows-x64.exe PID 4060 wrote to memory of 2928 4060 iexplore.exe jre-8u51-windows-x64.exe PID 4060 wrote to memory of 2928 4060 iexplore.exe jre-8u51-windows-x64.exe PID 2596 wrote to memory of 2884 2596 msiexec.exe installer.exe PID 2596 wrote to memory of 2884 2596 msiexec.exe installer.exe PID 2596 wrote to memory of 2884 2596 msiexec.exe installer.exe PID 2884 wrote to memory of 2768 2884 installer.exe bspatch.exe PID 2884 wrote to memory of 2768 2884 installer.exe bspatch.exe PID 2884 wrote to memory of 2768 2884 installer.exe bspatch.exe PID 2884 wrote to memory of 2768 2884 installer.exe bspatch.exe PID 2884 wrote to memory of 2768 2884 installer.exe bspatch.exe PID 2884 wrote to memory of 2768 2884 installer.exe bspatch.exe PID 2884 wrote to memory of 2768 2884 installer.exe bspatch.exe PID 2884 wrote to memory of 3880 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3880 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3880 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3932 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3932 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3932 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3972 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3972 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3972 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3732 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3732 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3732 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3716 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3716 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 3716 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 2100 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 2100 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 2100 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 2084 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 2084 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 2084 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 2600 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 2600 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 2600 2884 installer.exe unpack200.exe PID 2884 wrote to memory of 1872 2884 installer.exe javaw.exe PID 2884 wrote to memory of 1872 2884 installer.exe javaw.exe PID 2884 wrote to memory of 1872 2884 installer.exe javaw.exe PID 2884 wrote to memory of 2924 2884 installer.exe javaws.exe PID 2884 wrote to memory of 2924 2884 installer.exe javaws.exe PID 2884 wrote to memory of 2924 2884 installer.exe javaws.exe PID 2924 wrote to memory of 4008 2924 javaws.exe javaw.exe PID 2924 wrote to memory of 4008 2924 javaws.exe javaw.exe PID 2924 wrote to memory of 4008 2924 javaws.exe javaw.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.7.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.7.exe" "__IRCT:3" "__IRTSS:25232362" "__IRSID:S-1-5-21-3627615824-4061627003-3019543961-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/2⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4060 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5D7QYX2\jre-8u51-windows-x64.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5D7QYX2\jre-8u51-windows-x64.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe-cp "C:\Program Files\Java\jre1.8.0_51\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus4⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe-cp "C:\Program Files\Java\jre1.8.0_51\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 304⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\AU\au.msi" ALLUSERS=1 /qn4⤵
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.8.0_51-b164⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_51\installer.exe"C:\Program Files\Java\jre1.8.0_51\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_51\\" REPAIRMODE=02⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe"bspatch.exe" baseimagefam8 newimage diff3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\deploy.pack" "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\javaws.pack" "C:\Program Files\Java\jre1.8.0_51\lib\javaws.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\plugin.pack" "C:\Program Files\Java\jre1.8.0_51\lib\plugin.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\rt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\rt.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\charsets.pack" "C:\Program Files\Java\jre1.8.0_51\lib\charsets.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\jsse.pack" "C:\Program Files\Java\jre1.8.0_51\lib\jsse.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.jar"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -Xshare:dump3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -classpath "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar" com.sun.deploy.panel.JreLocator4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_51" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXIALURqYXZhLnNlY3VyaXR5LnBvbGljeT1maWxlOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcc2VjdXJpdHlcamF2YXdzLnBvbGljeQAtRHRydXN0UHJveHk9dHJ1ZQAtWHZlcmlmeTpyZW1vdGUALURqbmxweC5ob21lPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcamF2YXdzLmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcYmluXGphdmF3LmV4ZQ== -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_51" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXIALURqYXZhLnNlY3VyaXR5LnBvbGljeT1maWxlOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcc2VjdXJpdHlcamF2YXdzLnBvbGljeQAtRHRydXN0UHJveHk9dHJ1ZQAtWHZlcmlmeTpyZW1vdGUALURqbmxweC5ob21lPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcamF2YXdzLmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcYmluXGphdmF3LmV4ZQ== -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9924BB325F713431AAD933CE0503BA862⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c del "C:\Program Files\Java\jre1.8.0_51\installer.exe"3⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 242ECF00ADC6ED2250D047A7DFD0DB972⤵
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Component Object Model Hijacking
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Event Triggered Execution
1Component Object Model Hijacking
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\f773882.rbsFilesize
788KB
MD5f54d9657ac1f00449a8686ee2b22b3fc
SHA10722a5b9e0395926fb42dc7428d2196a34bd7ee6
SHA256ffdb5cd7d119e9a033ac1021adbed24ff56e30e5467fa48069026f03cc7d35ed
SHA51217bd73008ab140a095679fac332eb244077688ed9994f38cc8fbff3aba2a6febbb36984ce680be97b773314d9287064b09c652f46cfba47024294438f15adbf1
-
C:\Config.Msi\f773888.rbsFilesize
8KB
MD5576a4c97ea50dddb704bcd6c0ece63a0
SHA1ea9fde4b410b2d6d8e4f265825b80b3203c3470e
SHA2563b8e6d05c73f74d213f4414cafeaf61f1123c84342339fcc9836e8a142503f9b
SHA512ba31af879e21dd7ac9deabe0f69bf717b5f315e3df1e56621c8a2ec0a85b35e3b19aa0a1775dda098ba2af254b31f7b6b072509ea1c0f1089e66995df178db94
-
C:\Program Files\Java\jre1.8.0_51\bin\MSVCR100.dllFilesize
809KB
MD5df3ca8d16bded6a54977b30e66864d33
SHA1b7b9349b33230c5b80886f5c1f0a42848661c883
SHA2561d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
SHA512951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
-
C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npdeployJava1.dllFilesize
1.1MB
MD5cb63e262f0850bd8c3e282d6cd5493db
SHA1aca74def7a2cd033f18fc938ceb2feef2de8cb8c
SHA256b3c10bf5498457a76bba3b413d0c54b03a4915e5df72576f976e1ad6d2450012
SHA5128e3ad8c193a5b4ab22292893931dc6c8acd1f255825366fdd7390f3d8b71c5a51793103aeacecfb4c92565b559f37aec25f8b09abb8289b2012a79b0c5e8cb3b
-
C:\Program Files\Java\jre1.8.0_51\bin\javacpl.exeFilesize
75KB
MD5f49218872d803801934638f44274000d
SHA1871d70960ff7db8c6d11fad68d0a325d7fc540f1
SHA256bb80d933bf5c60ee911dc22fcc7d715e4461bc72fd2061da1c74d270c1f73528
SHA51294432d6bc93aad68ea99c52a9bcb8350f769f3ac8b823ba298c20ff39e8fa3b533ef31e55afeb12e839fd20cf33c9d74642ce922e2805ca7323c88a4f06d986d
-
C:\Program Files\Java\jre1.8.0_51\bin\javaws.exeFilesize
314KB
MD55ed6faed0b5fe8a02bb78c93c422f948
SHA1823ed6c635bd7851ccef43cbe23518267327ae9a
SHA25660f2898c91ef0f253b61d8325d2d22b2baba1a4a4e1b67d47a40ffac511e95a5
SHA5125a8470567f234d46e88740e4f0b417e616a54b58c95d13c700013988f30044a822acfef216770181314fa83183a12044e9e13e6257df99e7646df9a047244c92
-
C:\Program Files\Java\jre1.8.0_51\lib\charsets.packFilesize
1.0MB
MD545288142b863dc4761b634f9de75e5e5
SHA19d07fca553e08c47e38dd48a9c7824e376e4ce80
SHA25691517ff5c74438654956aae554f2951bf508f561b288661433894e517960c2ac
SHA512f331cd93f82d2751734eb1a51cb4401969fb6e479b2e19be609e13829454ec27cec864c57bdc116bf029317c98d551e9feafc44386b899a94c242bc0464556d8
-
C:\Program Files\Java\jre1.8.0_51\lib\deploy.packFilesize
1.8MB
MD55cfc3a1b269312f7a2d2f1d7c0497819
SHA1d048284db9ce7103156f8bbce988b4d9978786b7
SHA25680ba80d2a6c20deef6e2f3973337e15e22eec30508899ae998bf191ba725db26
SHA5128735af7c8bc5b48aac42120326a5dee21f98512ba31c57c77b6fc3906b7b1b98e5f22f57a31f26dc3e16abe63a6f15ef2e115c7fc17bbab35e846dc373da9c6b
-
C:\Program Files\Java\jre1.8.0_51\lib\javaws.packFilesize
211KB
MD55a83bc9b3e4a7e960fd757f3ad7cd263
SHA1f5f308aec7e93accb5d6714c178b8bf0840fb38d
SHA2560a95ab97c85e534b72a369b3ee75200f8075cb14e6f226196b18fd43e6ba42f5
SHA512b8e554bbf036d0500686e878597ffdefa8bcd091ab6533eae76fa04eda310cec7cac89b71911f1f81012f499c7bec890ac9032685945f7e5e6b68f7ad3f7430c
-
C:\Program Files\Java\jre1.8.0_51\lib\jsse.packFilesize
150KB
MD5168f72fd2f288a96ee9c4e845339db02
SHA1e25b521b0ed663e2b050af2b454d571c5145904f
SHA2565552e52e39c0e7ac423d6939eec367a0c15b4ca699a3a1954f2b191d48a034e6
SHA51201cdf3d8d3be0b2458d9c86976cef3f5a21131d13eb2a1c6f816aeb2c384779b67d1b419fa9233aedd3bbd16970ec7c81689bf2e25a8bebadec5de8e9b5a19f1
-
C:\Program Files\Java\jre1.8.0_51\lib\plugin.packFilesize
482KB
MD5538777ddaa33641aa2c17b8f71eed307
SHA1ac7b5fdba952ce65b5a85578f2a81b37daed0948
SHA2569948b1c18d71a790e7b5a82d773fea95d25ab67109843a3f3888f3f0ac9d1135
SHA5127a5877e0eaef6424ea473a203184fedb902cd9d47df5d95d6f617ca4efa1162f0ffd418e9bc6b7492f938cb33fc6384907237487d6ad4f6d0d2d962402529d8b
-
C:\Program Files\Java\jre1.8.0_51\lib\rt.packFilesize
13.1MB
MD5f0177701b36068c9a2bb4924dd409fa5
SHA171e4b32c95e20dd565a6603d3de3819eb4f19d33
SHA25693c1e08034b68e12d78005c2950145595327477c17c1f716248d3e16313b4eec
SHA5128e198bf60dbb95f38bf5eca67c9b7cd4fe9920890ba3d569e08de59b38c1b00830a0a37168fd74c874df86b7ff0915c8b69adb1591432b42b5ff35e5885e6641
-
C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exeFilesize
34KB
MD52e7543a4deec9620c101771ca9b45d85
SHA1fa33f3098c511a1192111f0b29a09064a7568029
SHA25632a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1
SHA5128a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d
-
C:\ProgramData\Oracle\Java\installcache_x64\diffFilesize
9.1MB
MD5d417682702b140d7131851bae877f046
SHA1aa78da727e8a62c839a9bb6f7a93b48d3a04be70
SHA2563b3657c83e4f588f0e759cd46e99309cece2ebb54af2c377f9dc087ec764fda8
SHA5129e107b7f61e42410807aa1e6761ac7adce412846f69ae8e2e21b147e39d1a95d41367e21624381750eb11c77322206c4d869a477e5442e8323405c85854c03cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950ABFilesize
834B
MD5a0af4d81b2b19a99a3d01be89d5f99d9
SHA14725c1a810005f860ede9dace7f1e5a20e5230d6
SHA256de9f05ceb1610cf9964f0def09d525005569602993c82a647743f192e9414d4a
SHA512eb98d475d51d07b929d92fe5aa00bfa21078f567906f3650eb3bebfff39c616a21918da8f0687853310acebdb160d4f65451204619a7b8085fbbc25491bb0554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
471B
MD587fb52832b75e3d4277c862750c45113
SHA1142af7416382c80cdf834715d1d63bc6858c2946
SHA256c4f05792cda8510ed77d940fc33053d288cf4ba64429b07be3d751d8926fe1e0
SHA5124d8e08cbac1589298d6c047d7245a1885ef236804cd3de48ae056d0ab65e2348c1241dea979866c16c5c44fa363e3ac0f8ab034663bf1de7ec241700bf61d881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CEFilesize
5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCEFilesize
1KB
MD51f1ec69ac8fbecfe984d61bb651462a5
SHA1cec3e5b8433a0674bfe0edd6ff4d22246aa00da9
SHA256894c3e856cd2d68c7eb86a9155a1fcc43b1ae81444f4a6b15935a11bfb7dbf85
SHA512d424470149bc1c9488b515360d7bf82f28f93005e9a0a412cdd2330244d6b08ceefe8796ad32260223ac50975ce5a0979185907c270c1c2b68e691bfa7432e8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
252B
MD519333b8192417882dd62a7a319567ea4
SHA13a0584316fe5f00eee07601835d2393862d4a230
SHA256f9d94fb4401715998a5f59c7aa61239021481ca9a625105ae6eae97ff609d909
SHA512d80db8208426708765c8e0d0f0d5ee877f90e48ef20a7ea11fb6ee80ef8f440c01432c5df7ebc5cd471fc29a354339c5b633f5c30b20c22262dbd86962eef8c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950ABFilesize
180B
MD529af4a4d1937118e7c27a2c345e2f582
SHA152a40f583487e5eef4789bd20d5f1dc8c2976b7a
SHA2562c340bf0a524fdb7c42ee5bbe9a31e9442eb15c1b339f46d29c55d34e7809a32
SHA51216ed06c50b0e812f3918de6830fa7aee7bfdc83a7ca0f7296930ff097a741342526bfb400d3d1c80b14a77b51175b4f8808037a3b307a44cf52cf25d60983a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5d403480a0f2579e27d4a058cfba0723f
SHA13f8a789abce21fe4b4c626dc41d5368d0b213d16
SHA25667a3dc438b7cac1a663c62e7c3ae95b4d2ca5eccb10c642884940bfe4dadbe23
SHA512d9b0fdb26263651480d6fe12bdc8b9fcb6a6dd0f1f0577a01ef90763ef1e4f2d17f17c3c46c9b003b2a03aa5203d6cec41cdad18f7533b690e1d4dda333f46ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5adfb98f4c1c7a380b57b3f94d01b754e
SHA1f5a3c5982661b23af9672914a0a61bffb933c10f
SHA2565ab39eb9bb1a84fa89b4d1c9d28ed86c18a86872c2e38aea1f48925729751295
SHA51291431f0222fd32bc07a023a1f0518b8cfee8846e2698723130c52a8aed9c0105e53ffd1e8209adb238304c0e26875b37bb382e52a0a76b175b538576af17a325
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5cbe69626b63c9c117d3587170220a9f7
SHA17c361985340b2f0920af1a6c8afab8e970384c70
SHA25603fa4262759794731a1cf2665ced7c9b99dad8a7f9939c470327718f674d05fa
SHA512129fedd1d9e0a65d37299e35769a50bc564c5f4266ca3cbd813fc14b88088eb3fabee5ce9b35234ba8e261403ee6803f3643db30fe708b84b287e133c4ac2e67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD53798d78ec9bdd42e144156f4971ff506
SHA1d1c3d1bc7db4f0c519914dd8dd3ac94959e64499
SHA2567b6c5d9d3b417475231832885c991f9eb834148604559dfab075be5d5b3804a6
SHA512d108ae3d09930c84c05aafe20088477316effd3feee393aa16d2f76984f6fa2564cc1cbb9a4ebe1d21cd0ccc52c03de9d894c546ceebf341328d8271479a5210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5020cb8af7b3187958a5106f86d52e544
SHA14b2c2087cd4bf672f31ac4a2f7f9730227bd5ed3
SHA25659e4afb21d20fa08b5a1f41e75536ce62cf8d290a527606202b35bd1f71ad014
SHA51230398642151ed1a89ac278b2db1dade56429b7fcd77a55087a8f66c5410c99433c97256b99f11531e3394a32effcb0ab2d1671ab77d5cc737fb7ddbafb68f5ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04Filesize
400B
MD55a235a48399c97d31a35375bc4ae342e
SHA19a5661be8d61a20d49add6c7db0681ffe696e7a6
SHA2564068e88024bbc1eb7ac3eddec1b4475efd5059534dde28367af5732c45c99ea1
SHA512c2536b092ca6395171fe767c2a6c030b98c943ce94cfc5f83d0f0a84466587639d4e048aeccf570fb68de1e6018b6bbbfbff1d74c965e54c1a19864ae20af1ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CEFilesize
398B
MD5e1ef3026e6c371e73675fcaf9ea0325b
SHA103da3d64f660039fe2599c4b0478ed241665c123
SHA256ae6970f2dc3ab1436e44bdbb57d176a2886518f7356098b64636625877fa0c4b
SHA512af86bc988833b0e5acd0f291e92e95cde95098d22cb396cd0f78bdfcc8d213383cb44cafdb2cf2cb0f8bb389322f5455c4af9182283545688c33d1d9187c7bcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCEFilesize
402B
MD56d9b665d70b21b3ccbd85722463067cd
SHA11f94bbd5ff42024b1454c9b2ef3e090a88c2df12
SHA256d30868eebb74dce96baf39c352d9d813bf874339bd7e4c244cf9f1913877a574
SHA5126bf2a1e69ed073db5cfa01597f421a95217dd16cc006a5a477a36ea2b875f86329d63569155421e52658f5d58d766a6fb7db5a588e6cb13905933be146bd5c4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD532ca149185dcd038d004dfad4b732f6a
SHA10bfdaeff52e3316763574b61f5ba5e2f359ad7f8
SHA2561daa45b5fc4b4fa957219a3e9e5e3df1dc1e1ef1886be8d0e87b7eabffb20bd9
SHA5120889c1a28dc4a13f7b627f2b5a12326dc03552a9d2fe01a95bfcff8b1e28404f72f73e9a478f40b19aaf1f179e541e625f5d59de458b378293c7a8d8e3b57253
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoFilesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.propertiesFilesize
1KB
MD5c747d062d960396fe741bc8a9861a86a
SHA129dcdf534d6dd7d9162eea017d206ac59ab26229
SHA25692d321de70ee2a21399bad24fcbd30813d9608625da1a68b912760d4fed6f84d
SHA512b2a39a5d1e5080fa2554342bcd8275561d3d8cda5a13b0e557a2c4b2aff93f66b6c75c3420b9051a0e8af590b2b81c38b5dbc94071c5b46ea7458bd8668d32b7
-
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.propertiesFilesize
1KB
MD5d6332da1043a21a4f1c59c847becd394
SHA13b16faade3763ba44d7686905c0220a60d6ff451
SHA2562913d272e2e671f7553ab459409216d2129b51d6f0fff6960a789a63c96c60f1
SHA512bf8e43b7631b34feca1a69c0d1e8a3dd8d0d67e54b44ba4ee568bfd4ed324577891be5b658671dad6f88f315f6988fdf7491fa0d554ebecc531c9a7e961d5c32
-
C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.8.0_51_x64\jre1.8.0_51.msiFilesize
38.7MB
MD51ef598379ff589e452e9fc7f93563740
SHA182ad65425fa627176592ed5e55c0093e685bfeef
SHA256d4bdc230eaebefe5a9aa3d9127d12ac09d050bf51771f0c78a6a9d79a1f9dbf2
SHA512673f4b08fc25e09e582f5f7e01b2369e361f6a5b480f0aa2f1d5991f10076ba8a9d6b1f2227979b514acc458b4fdc254fc3c14173db7e38b50793174d4697f23
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5D7QYX2\jre-8u51-windows-x64.exe.aef9fsq.partialFilesize
3.0MB
MD5e9d697a1da1314421b5c2ad2e8a59b74
SHA1913ec20590745373bc124a287ef1a201ae2bfb23
SHA2562cf4beb9c2904b1e6380df724375531ae047121a44eea43418e122bdaf29a75b
SHA5124c3f3f926f7fb31ccf094593f1ffdc9e09eebc64b825e077d05a50204c174e3d44c019a1c6954cb0b830f6e635daf464061990c0a5e70b9e1e177caba391a5ad
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V5D7QYX2\jre-8u51-windows-x64.exe.aef9fsq.partialFilesize
41.2MB
MD5b9919195f61824f980f4a088d7447a11
SHA1447fd1f59219282ec5d2f7a179ac12cc072171c3
SHA2563895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01
SHA512d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6
-
C:\Users\Admin\AppData\Local\Temp\Tar1D47.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.icoFilesize
116KB
MD5e043a9cb014d641a56f50f9d9ac9a1b9
SHA161dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA2569dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA5124ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exeFilesize
1.6MB
MD5199e6e6533c509fb9c02a6971bd8abda
SHA1b95e5ef6c4c5a15781e1046c9a86d7035f1df26d
SHA2564257d06e14dd5851e8ac75cd4cbafe85db8baec17eaebd8f8a983b576cd889f8
SHA51234d90fa78bd5c26782d16421e634caec852ca74b85154b2a3499bc85879fc183402a7743dd64f2532b27c791df6e9dd8113cc652dcb0cdf3beae656efe79c579
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMPFilesize
12KB
MD53adf5e8387c828f62f12d2dd59349d63
SHA1bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA2561d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
SHA512e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNGFilesize
43KB
MD5803866e63e1b433eafa31ddf1819d88a
SHA1e5cbdf988d8711b831981c9cc5c2695e44ecd963
SHA2563cff2eae4bc6ef69c72d163d41c4f387e8cc3413772024062d093583069fc6f1
SHA512d494faf98f9179111f0a1e6ba8261d6b0924172c57663ae26efc4aa3022c1420dfc980705ca5579169a33a68baa299bdf3c38b8f322fbf2e54ed0f36198aff98
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG16.PNGFilesize
644B
MD54c8bb522e8cf8c27b8e7fc318c7ab17b
SHA13071a7f9b977d6a27e9ab0777456b3c13753568a
SHA2563eccb1386194744d6596a9c3abf854ea591e12742d789518e90afb99fa370871
SHA512d112bbbcaed8b8ec04bf52fa0f2a320c04dc4962c862e383e27b6f4f8bff621ee201b982140f84b6de527753e92511e21be539296a9aa38e572a5d5051c7d539
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG18.PNGFilesize
40KB
MD554c173de619065c86d50c5c7cf66097a
SHA158111b16ba2075c2fcfe30ddef29ea66108cf9ad
SHA25630db6860833fe2f29801d604bda19e5a0d2a4b9f409caadce56dde13324078a7
SHA51285ec2700ebbc18bfcbee25f3b025a9c1d3b32502f6b4313c2df124f454c0d9d098414bef0a8bf44f7e5b3eeeae6e3491106c2b477d69b94158b897ea6b0f5b57
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMPFilesize
12KB
MD5f35117734829b05cfceaa7e39b2b61fb
SHA1342ae5f530dce669fedaca053bd15b47e755adc2
SHA2569c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
SHA5121805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMPFilesize
12KB
MD5f5d6a81635291e408332cc01c565068f
SHA172fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA2564c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
SHA51233333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG49.BMPFilesize
1.8MB
MD55c9fb63e5ba2c15c3755ebbef52cabd2
SHA179ce7b10a602140b89eafdec4f944accd92e3660
SHA25654ee86cd55a42cfe3b00866cd08defee9a288da18baf824e3728f0d4a6f580e7
SHA512262c50e018fd2053afb101b153511f89a77fbcfd280541d088bbfad19a9f3e54471508da8b56c90fe4c1f489b40f9a8f4de66eac7f6181b954102c6b50bdc584
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNGFilesize
438B
MD5c2d61af0e799bbc8bcde7bb15564952b
SHA109bb6c51afcff1276a9ea2a795a9cf3e5ab4494a
SHA2565ca45fb4679f8ec9671685874fe70871f1cb49e6b6f6210137864784888d070e
SHA512edc12546dc237505c698092db968d04399a697c0bd9a10e56daec05340864d24f56939e182a052275f6a750aeb4a02f32b21cda0311278ed8e0bc758bb577743
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllFilesize
325KB
MD5c333af59fa9f0b12d1cd9f6bba111e3a
SHA166ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0
SHA256fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34
SHA5122f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
3KB
MD59e63d3c5f2da3c314a27e6e244152d36
SHA17f9b459f3674051b8b8699cf7602953cc5b1b8dd
SHA2562713ef348a78ec49a7f6a554d80726784aebf8b4933e37e63a73236c8f57e99a
SHA5121c2c541f2e61a5f0f04d7879fa33e518606c5c7e8c3392f44380e174f57de3d8933db6d5eaed6eb13d28a85b203ffad33ae7b804c87720e5259f85082e124b38
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
5KB
MD5e0aa63216873fa50e711b433cd4ae23e
SHA13d1005ca0e71d15972d5424f9576067c2e7cd353
SHA2566e3a58a298a2260274e27d43b14bbb706ba428d447b208a7f9e06ada44b069d4
SHA51233e41e0b94425813899923cb6c42da6af819e5d3895cafb41f32b7d58e7377c1c8b49d9bec640ec2823f537592268102247ce3b351bdc6590b74a990d3ae2b8c
-
C:\Users\Admin\AppData\Local\Temp\jusched.logFilesize
18KB
MD516b40348206a60352d039b9ad3cdb629
SHA10e3040a6cdb8f1ac7f7a061589a3547bff8f41e6
SHA2561b89b8bf0c3b0dbbc9b53c59569cff3ec924e72e1c0de5d377c51d04b9b4f2c4
SHA512289e3f109811db8a4c6cfb847678ecfc754b9be74d69eeedd1dd4b053ad29829ad620afeec8f4dccaee578160309081044a58f9b03747a48685328531e83e16b
-
C:\Users\Admin\AppData\Local\Temp\~DF971F9B34A4248BAB.TMPFilesize
16KB
MD555862e3245f353bd387a9ad27ec686bf
SHA1edb83706585096aae06368437434cd7521ad7c40
SHA256d6adf5b7bc009d7b59a754bf21b293d640bb27217107a578349ab37a322d1f66
SHA5129da09ca75451c90a3ac87e2b6ca7b462648e788338ecd474e6cb37c8ffc19a7e5804cf43f39f7e0fc6b20eb0cded542bc3b2fe3e3e0edcfb7682078342f489dd
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exeFilesize
9.1MB
MD5833512c89f1ab92c80131d415f89f442
SHA1dd9953ddcc33278bb97502ffdc6e7462e8005680
SHA256717f80429e16e7c467a8472dfb0404e22fdf2d67ecd94018b6536dc9d995bff6
SHA512f23201251ea19b6122f60a788a027bd59aca1233b17b265709a51a2babc1eea1394a4400eadcc6792bb5f9843d73a95660f60f487779cbfc05766f53fa3ef3d1
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNGFilesize
45KB
MD5baf26cf75bcc4e8d89ab634d96191627
SHA17b3acdb1ea5cc827b079cd2b5ebffcffedc1da9a
SHA25681b942e871ef52c2fcd67c769f400e3f9f9bdd5921b4eb77f85c9653bf8715f0
SHA5121162675a91229ce9c92161b17ab765693d455956f8217dc71ae916364a289a37bbebeef23415ffc5b6b8374321838dd259b26184d6aa3865c69d92a254068ec9
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNGFilesize
206B
MD519cc60490b1c2ff33fd88054ea0b08fa
SHA1e0efb3ffe0e9de359922d134c68f67371d0fe21a
SHA25649708851bdda2b324cbe7fa391af81ff3fab72de28c88b073035b1ec87fc5e57
SHA512452fb6a1f9b7a908f6bfc7634a6f9de848adbe37fa080977060d5b2eea7da1207b87b1449b37a909d6be8e748fc39c6e7d30829546751f9c60c2490f2bf46aa6
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG14.PNGFilesize
41KB
MD51cde7f4b65d7915806fffa1dc22bb527
SHA1fe0dce2a7ea338b44e1d264288379ac14289c430
SHA25604079a342d1ada8ef6ae3ca5503a307a72637061c6d34cae90a3dfb342ff9727
SHA51284bc5e70bbc6ac35a351e271796af476aaa7dc40edbb5adfc6b85978dc855787c1d20060792e9efdfe4e8aeb6f271efc4df4a757d79ee53d057bcac3d79587d7
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNGFilesize
475B
MD5aed347c1520185c3d1ca24604e5689e2
SHA1d1a213e4df60376d3cd9c4c8d97051a74c5a42e3
SHA256c6c1a74804e7ef24c8f0fe671f9776ffaa96fd78f8cf609be29394ec4b528580
SHA5127b7ad53f205fce8c0b19c68a33affa41d79e780fa10a67fba11239bf3c06b7995764f237ba0dcce3d6f9fdbd9038c6ecb73f3c504066bd71f2dd4224d8d86aa5
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNGFilesize
368B
MD529bacaeca4131335a6821277b65aec45
SHA1050fbd5270b614c3ec14ae4609f91667922f5416
SHA25620c7e42db9c1f0df908dcaf4fa7536ea9d236b747a30d55d1744a286ae8d9e06
SHA512747b3cbbed596517c19eab89830a781ec4fc0f52cdae642250b1a941092dbc0f40e6096e423f496e6e267f99e164a97031359568d842691c432cc445af7410e6
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xmlFilesize
23KB
MD5156262fb13e5fd8f954b8541aaef47b4
SHA1f4cfa165de33fb31e19c1a755aad0e4b2c461440
SHA2566e42a2d230ea32003afe9f4b2e5f3550594b82ad36d24be0041e1da4076d23d8
SHA51278279b1cbec3a5211cb9356f48c9fc7e14b6da373a8ca1b45b316d41ee5d8d880d2d0342deada877408e2a846abc9a67adb667dcb36f6e80f6afe7f341790ba4
-
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xmlFilesize
4KB
MD51309abb4d7695b135de1bccb3d0383bd
SHA16435990c33f357ecdad2f72f11da62a766c4abd8
SHA256d705428077945f54aea3cb29ccf04123369634444a578cd9f01ab1b947d454c3
SHA51205440cbc9f24a56083a4ad63b42cc02b782c46abecdf4b23de9f7d6f8f66b196bcc9fa21920575ba1899735bd2bf398166151e95d2a802288d637ae4ec2ec83a
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\2.923\dependencies.jsonFilesize
17KB
MD524817047786540dd5d8cbfb94132c84d
SHA1ff45f1ae7748fab985e0580c5746b0327a4b59ac
SHA256a5584b00241e6aa455dce9c0d584d61f8350a7bc07a4137e9289e23f46878721
SHA5126e048803859517d052d88d8c96c382d481620c1d930e219051264cb2c4d096b5b68d8e8e66ba2244ef7343df99f120600f8763f67bcf060c3132743eca7934ef
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\2.923\resources.jsonFilesize
17KB
MD58ab0113596cd48af76657e53d5d93e70
SHA13ab4244668932e0396022372d8f311c62ce1b89b
SHA256b0a6157bb0f4da765f93d13ca167017144c5eb15955015b0b42f7d7c0b70599d
SHA51255fb4d7ed644ae5e47ee376b00323199788baf596b493b4959ec4c88bdb37295ee59e34d3a7d4310fc9e35d776e1ae19fcead53c09d3a440dcfec8dc6736b170
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\appConfig.jsonFilesize
3KB
MD5a9bd1871a6a69e12bb017e1375b0a659
SHA10cc4c515fea150c982d02fa73acf73cfa68810e7
SHA256f725e50dc4377a28b06589b028cd3cff58845d5ed882b22b17129c4413f8b9b3
SHA5120595d54b19805f57a1b09a492c90c4c9f655d6a501179966b1a282b0aec90b27eeba634ee4a54fb9982f80ae046e6feb2b3e2097f14a0a3e051e80c162a83bd6
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\javaConfig.jsonFilesize
3KB
MD5e2cbea0a8a22b79e63558273dded5e6c
SHA1bfbbbba0679adcbcf9e079ed3c7c7a60cb0b2d61
SHA25610d0f3646be0a7d73942d7bdd1e55c4b8df0c34cad7ad15a9dc23b2932155007
SHA512a6aa26ff49c911fb4705df1e8e434c72e206b20fdaae0abc529e2734f5db49c75da35c3d75769e0ac1b6795de540de4c7e1089b387217fc58f8b19b023064e5a
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\COPYRIGHTFilesize
35B
MD54586c3797f538d41b7b2e30e8afebbc9
SHA13419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA2567afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
SHA512f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\LICENSEFilesize
33B
MD516989bab922811e28b64ac30449a5d05
SHA151ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA25686e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
SHA51286571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFOFilesize
51B
MD5494903d6add168a732e73d7b0ba059a0
SHA1f85c0fd9f8b04c4de25d85de56d4db11881e08ca
SHA2560a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
SHA512b6e0968c9fd9464623bfa595bf47faf8f6bc1c55b09a415724c709ef8a3bcf8a954079cce1e0e6c91d34c607da2cecc2a6454d08c370a618fb9a4d7d9a078b24
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTIONFilesize
46B
MD5c62a00c3520dc7970a526025a5977c34
SHA1f81a2bcb42ccbf898d92f59a4dc4b63fef6c2848
SHA256a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
SHA51260907d1910b6999b8210b450c6695b7cc35a0c50c25d6569cf8bb975a5967ca4e53f0985bee474b20379df88bb0891068347ecf3e9c42900ed19a1dcbc2d56ec
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\LICENSEFilesize
35B
MD5f815ea85f3b4676874e42320d4b8cfd7
SHA13a2ddf103552fefe391f67263b393509eee3e807
SHA25601a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
SHA512ddf09f482536966ac17313179552a5efc1b230fa5f270ebde5df6adebf07ee911b9ef433dfbfcb4e5236922da390f44e355709ecaf390c741648dd2a17084950
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4UP6JPUV.txtFilesize
512B
MD5e47bcb68d23d2addf6424b5269be4346
SHA16d29fc189809a19d33006a8d83783b42e73cddc1
SHA256447dd0cfb0b11e6cb5d8f983adaa16af23fd8e3e671b2519c5109f50f85ef274
SHA5122430c401469c9e4072f73eeb9065f9fa28662870e01611dc11ffece92d8bd8deaf0b4ecd65c3a7e997b5ac23cbef9a710df5f9aa5679b7cd1d6a0f002b6f68b8
-
C:\Windows\Installer\f773889.msiFilesize
660KB
MD54afca17a0a4d54c04b8c3af40fb2a775
SHA196934a0657f09b25640b6ad18f26af6bd928d62f
SHA256b15d3a450b7b3e5ce3194ab9e518796cc5f164c3e28762ffe36966990dcd2fe8
SHA512ee76f5fcfdd9c1202fd5abdc2bbde8fb2543cee83265f6d2fb5458d1a086152ff6bdd4bf62a88150d325ea282bd2ecd66dd5f127bdd847cfa69cdb88985a8305
-
\Program Files\Java\jre1.8.0_51\bin\unpack200.exeFilesize
192KB
MD55b071854133d3eb6848a301a2a75c9b2
SHA1ffa1045c55b039760aa2632a227012bb359d764f
SHA256cc8d67216b1e04d7a41bf62f9c1088cd65a3d21796c5a562851e841b3afa28cf
SHA512f9858ec0a1bfb7540512ede3756653d094ff9fe258d13a8431599280db945e8d9ea94c57595c6a21aa4fbfcd733eea9b887bfcf87e84279a7e632db55380920c
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmdFilesize
1.7MB
MD5dabd469bae99f6f2ada08cd2dd3139c3
SHA16714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b
SHA25689acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606
SHA5129c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmdFilesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.2MB
MD5af9bb57e1893112a57a47df0908bc3d1
SHA139f31da08004741fd4b9fb31b04e29368f1e317e
SHA2561cf4f5e5d5bed48b7c989e34bb80507ca623cb1ac1fc1596f07cfd1dc7aec60e
SHA5123a8cd6660a0147101f4898c20a6fec1192b4196ae8e46cd3e730dc43c8bd7feed9c576590b6aa79c7763e5942466ac9118d44177edbc2ff1ddf1af3da5234040
-
memory/1872-3282-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1948-3478-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1948-3416-0x0000000000360000-0x000000000036A000-memory.dmpFilesize
40KB
-
memory/1948-3477-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1948-3471-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1948-3415-0x0000000000360000-0x000000000036A000-memory.dmpFilesize
40KB
-
memory/1992-800-0x0000000000300000-0x00000000006E9000-memory.dmpFilesize
3.9MB
-
memory/1992-2210-0x0000000000300000-0x00000000006E9000-memory.dmpFilesize
3.9MB
-
memory/1992-1542-0x0000000000300000-0x00000000006E9000-memory.dmpFilesize
3.9MB
-
memory/1992-833-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/1992-686-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/1992-19-0x0000000000300000-0x00000000006E9000-memory.dmpFilesize
3.9MB
-
memory/1992-832-0x0000000000300000-0x00000000006E9000-memory.dmpFilesize
3.9MB
-
memory/1992-687-0x0000000000240000-0x0000000000243000-memory.dmpFilesize
12KB
-
memory/1992-801-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/2344-5-0x0000000003250000-0x0000000003639000-memory.dmpFilesize
3.9MB
-
memory/2344-834-0x0000000003250000-0x0000000003639000-memory.dmpFilesize
3.9MB
-
memory/2344-16-0x0000000003250000-0x0000000003639000-memory.dmpFilesize
3.9MB
-
memory/2616-3366-0x0000000000170000-0x000000000017A000-memory.dmpFilesize
40KB
-
memory/2616-3367-0x0000000000170000-0x000000000017A000-memory.dmpFilesize
40KB
-
memory/2616-3411-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2616-3405-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2768-3009-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2768-3014-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/2768-3016-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/2768-3015-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/2768-3020-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3404-3523-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3404-3526-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3560-3543-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/3664-3735-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-3945-0x0000000001D50000-0x0000000001D5A000-memory.dmpFilesize
40KB
-
memory/3664-3598-0x0000000001D50000-0x0000000001D5A000-memory.dmpFilesize
40KB
-
memory/3664-3698-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-3709-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-3719-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-3727-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-3734-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-3642-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-3601-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-3944-0x0000000001D50000-0x0000000001D5A000-memory.dmpFilesize
40KB
-
memory/3664-3599-0x0000000001D50000-0x0000000001D5A000-memory.dmpFilesize
40KB
-
memory/3664-3564-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-5146-0x0000000001D50000-0x0000000001D52000-memory.dmpFilesize
8KB
-
memory/3664-3615-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3664-3664-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3784-3554-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3960-2213-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4008-3362-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB