Analysis Overview
SHA256
7efd1055ea05a8fb0e8dab395b68017720d468d3ffb3ef3baeb501f809528827
Threat Level: Known bad
The file TLauncher-2.876-Installer-1.0.6-global.exe was found to be: Known bad.
Malicious Activity Summary
BazarBackdoor
Bazar/Team9 Backdoor payload
Downloads MZ/PE file
Blocklisted process makes network request
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Reads user/profile data of web browsers
Registers COM server for autorun
UPX packed file
Installs/modifies Browser Helper Object
Enumerates connected drives
Checks installed software on the system
Drops file in System32 directory
Drops file in Windows directory
Drops file in Program Files directory
Enumerates physical storage devices
Suspicious use of FindShellTrayWindow
Modifies registry class
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
Checks processor information in registry
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Modifies system certificate store
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-03-13 19:13
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-03-13 19:13
Reported
2023-03-13 19:19
Platform
win7-20230220-es
Max time kernel
178s
Max time network
189s
Command Line
Signatures
BazarBackdoor
Bazar/Team9 Backdoor payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
Downloads MZ/PE file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Registers COM server for autorun
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0097-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0068-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0076-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0091-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0042-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0036-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0044-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0063-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0048-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0083-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0067-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0098-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0048-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0058-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0048-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0065-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0069-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBC}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0047-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0041-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0096-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0034-ABCDEFFEDCBB}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0039-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBA}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBC}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBC}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0045-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0097-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0089-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0053-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks installed software on the system
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\D: | C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\D: | C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\system32\WindowsAccessBridge-64.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\security\policy\unlimited\local_policy.jar | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\dcpr.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\cmm\sRGB.pf | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\ext\sunpkcs11.jar | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\fonts\LucidaTypewriterBold.ttf | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\net.properties | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-process-l1-1-0.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\dt_socket.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\plugin2\npjp2.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\legal\javafx\glib.md | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\legal\javafx\icu_web.md | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-multibyte-l1-1-0.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\meta-index | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-synch-l1-1-0.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\legal\javafx\libffi.md | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\legal\jdk\dynalink.md | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\rt.pack | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\jfr\default.jfc | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\mlib_image.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\cmm\LINEAR_RGB.pf | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages_sv.properties | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\ext\sunec.jar | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\fonts\LucidaTypewriterRegular.ttf | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-rtlsupport-l1-1-0.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-string-l1-1-0.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\plugin2\msvcp140.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\javafx.properties | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\policytool.exe | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\jce.jar | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\management\jmxremote.password.template | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\security\java.policy | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\orbd.exe | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\calendars.properties | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages_de.properties | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\ext\dnsns.jar | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-util-l1-1-0.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-locale-l1-1-0.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\legal\jdk\cldr.md | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages_es.properties | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\jvm.hprof.txt | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\fonts\LucidaBrightDemiBold.ttf | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\server\classes.jsa | C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-sysinfo-l1-1-0.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-crt-filesystem-l1-1-0.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\glass.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\gstreamer-lite.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\rmid.exe | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\jaas_nt.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\jp2iexp.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\security\blacklist | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\security\public_suffix_list.dat | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\j2pcsc.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\rmiregistry.exe | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\deploy\messages.properties | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\sound.properties | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\api-ms-win-core-processthreads-l1-1-1.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\fxplugins.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\legal\javafx\libxml2.md | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\jfr\profile.jfc | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\lib\security\cacerts | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\THIRDPARTYLICENSEREADME.txt | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| File created | C:\Program Files\Java\jre1.8.0_351\bin\fontmanager.dll | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Installer\6e5d9b.msi | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\6e5d9d.ipi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\ | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI6675.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\6e5d9f.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\6e5d9b.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI62CB.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI65F8.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI66C4.tmp | C:\Windows\system32\msiexec.exe | N/A |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\system32\msiexec.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\system32\msiexec.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main | C:\Users\Admin\AppData\Local\Temp\jds7217433.tmp\jre-windows.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_351\\bin" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0063-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0077-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0078-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0079-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0054-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0073-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0073-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0081-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_81" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0051-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0058-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0044-ABCDEFFEDCBC} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0053-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0089-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_89" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0041-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0042-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_42" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0043-ABCDEFFEDCBC} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_14" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0032-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0042-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0052-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0057-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_18" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_66" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0082-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0085-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0074-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0077-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0065-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0066-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0046-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0089-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_89" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Keyboard Layout | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0077-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0053-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0055-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0056-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_56" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_23" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_45" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0065-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0041-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0077-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0090-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0080-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0037-ABCDEFFEDCBA}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\TypeLib | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0071-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_71" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0077-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_34" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0061-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_61" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Programmable | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0090-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_90" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0096-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0032-ABCDEFFEDCBB}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0081-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0091-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_91" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0057-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_57" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0058-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0064-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0092-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0093-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_93" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0051-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0034-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_34" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0058-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_58" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0055-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_55" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0037-ABCDEFFEDCBC} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0055-ABCDEFFEDCBC} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0097-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0049-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_49" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_67" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBC} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0040-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0054-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0073-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_73" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0049-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_49" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0085-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\ = "Java Plug-in 1.5.0_23" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0043-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0084-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\INPROCSERVER32 | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_04" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_09" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key deleted | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0079-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6C5ADB75C34456D42B33823269140800\4EA42A62D9304AC4784BF2468130150F | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_351\\bin\\jp2iexp.dll" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB} | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Java\jre1.8.0_351\installer.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 | C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 | C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 | C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 | C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 | C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 | C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\jds7217433.tmp\jre-windows.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\jds7217433.tmp\jre-windows.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\jds7217433.tmp\jre-windows.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\jds7217433.tmp\jre-windows.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.6-global.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.6-global.exe"
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:23643746" "__IRSID:S-1-5-21-2647223082-2067913677-935928954-1000"
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-2647223082-2067913677-935928954-1000"
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x1a4,0x1a8,0x1ac,0x178,0x1b0,0x70f924a8,0x70f924b8,0x70f924c4
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
"C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=es --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=680 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230313201707" --session-guid=043cff1c-325c-4950-805e-ccb7552f248d --server-tracking-blob=MDMyNmE5YjVjZTBmMjY2Y2I3MzE1YjFlMDY5MzU0ZjhmNTQ2MWU5NjExNzlkZjc2NjUxYmRjOGM0ODA5NGUwZTp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjciLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNjc4NzM1MDIyLjI0NDYiLCJ1c2VyYWdlbnQiOiJTZXR1cCBGYWN0b3J5IDkuMCIsInV0bSI6eyJjYW1wYWlnbiI6Ik9wZXJhRGVza3RvcCIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik1TVEwifSwidXVpZCI6IjU2ZTZlYTc3LThkOWMtNGRhNS04ODA1LWM1ZDAzZmIyZDZmYiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0C03000000000000
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x1b0,0x1b4,0x1b8,0x178,0x1bc,0x704f24a8,0x704f24b8,0x704f24c4
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\_sfx.exe"
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\assistant_installer.exe" --version
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x10a6c28,0x10a6c38,0x10a6c44
C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
C:\Users\Admin\AppData\Local\Temp\jds7217433.tmp\jre-windows.exe
"C:\Users\Admin\AppData\Local\Temp\jds7217433.tmp\jre-windows.exe" "STATIC=1"
C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 228C6EA5B6817671DC745C51D915FC67
C:\Program Files\Java\jre1.8.0_351\installer.exe
"C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}
C:\ProgramData\Oracle\Java\installcache_x64\7239866.tmp\bspatch.exe
"bspatch.exe" baseimagefam8 newimage diff
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/plugin.pack" "C:\Program Files\Java\jre1.8.0_351\lib/plugin.jar"
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/javaws.pack" "C:\Program Files\Java\jre1.8.0_351\lib/javaws.jar"
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/deploy.pack" "C:\Program Files\Java\jre1.8.0_351\lib/deploy.jar"
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/rt.pack" "C:\Program Files\Java\jre1.8.0_351\lib/rt.jar"
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/jsse.pack" "C:\Program Files\Java\jre1.8.0_351\lib/jsse.jar"
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/charsets.pack" "C:\Program Files\Java\jre1.8.0_351\lib/charsets.jar"
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
"C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.pack" "C:\Program Files\Java\jre1.8.0_351\lib/ext/localedata.jar"
C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_351\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe
"C:\Program Files\Java\jre1.8.0_351\bin\ssvagent.exe" -doHKCUSSVSetup
C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
"C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe" -wait -fix -permissions -silent
C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe
"C:\Program Files\Java\jre1.8.0_351\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_351" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8zNTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzM1MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMzUxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | dl2.tlauncher.org | udp |
| US | 104.20.234.70:443 | dl2.tlauncher.org | tcp |
| US | 8.8.8.8:53 | net.geo.opera.com | udp |
| NL | 185.26.182.112:443 | net.geo.opera.com | tcp |
| US | 8.8.8.8:53 | tlauncher.org | udp |
| US | 104.20.234.70:443 | tlauncher.org | tcp |
| US | 8.8.8.8:53 | autoupdate.geo.opera.com | udp |
| US | 8.8.8.8:53 | desktop-netinstaller-sub.osp.opera.software | udp |
| NL | 82.145.217.121:443 | desktop-netinstaller-sub.osp.opera.software | tcp |
| NL | 185.26.182.124:443 | autoupdate.geo.opera.com | tcp |
| NL | 185.26.182.124:443 | autoupdate.geo.opera.com | tcp |
| US | 8.8.8.8:53 | features.opera-api2.com | udp |
| US | 8.8.8.8:53 | download.opera.com | udp |
| NL | 185.26.182.118:443 | features.opera-api2.com | tcp |
| NL | 185.26.182.122:443 | download.opera.com | tcp |
| US | 8.8.8.8:53 | download5.operacdn.com | udp |
| US | 104.18.3.211:443 | download5.operacdn.com | tcp |
| NL | 82.145.217.121:443 | desktop-netinstaller-sub.osp.opera.software | tcp |
| US | 8.8.8.8:53 | javadl.oracle.com | udp |
| NL | 69.192.71.29:80 | javadl.oracle.com | tcp |
| NL | 69.192.71.29:443 | javadl.oracle.com | tcp |
| US | 8.8.8.8:53 | sdlc-esd.oracle.com | udp |
| NL | 173.223.112.78:443 | sdlc-esd.oracle.com | tcp |
| NL | 82.145.217.121:443 | desktop-netinstaller-sub.osp.opera.software | tcp |
| US | 8.8.8.8:53 | javadl-esd-secure.oracle.com | udp |
| FR | 23.40.2.175:443 | javadl-esd-secure.oracle.com | tcp |
| US | 8.8.8.8:53 | rps-svcs.oracle.com | udp |
| FR | 23.40.2.175:443 | rps-svcs.oracle.com | tcp |
| US | 8.8.8.8:53 | javadl.oracle.com | udp |
| NL | 69.192.71.29:443 | javadl.oracle.com | tcp |
| US | 8.8.8.8:53 | sdlc-esd.oracle.com | udp |
| NL | 173.223.112.78:443 | sdlc-esd.oracle.com | tcp |
Files
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
memory/1976-68-0x0000000002E10000-0x00000000031F8000-memory.dmp
memory/1976-69-0x0000000002E10000-0x00000000031F8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
| MD5 | 80d93d38badecdd2b134fe4699721223 |
| SHA1 | e829e58091bae93bc64e0c6f9f0bac999cfda23d |
| SHA256 | c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59 |
| SHA512 | 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4 |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
| MD5 | 80d93d38badecdd2b134fe4699721223 |
| SHA1 | e829e58091bae93bc64e0c6f9f0bac999cfda23d |
| SHA256 | c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59 |
| SHA512 | 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
memory/1988-219-0x0000000000AA0000-0x0000000000E88000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
| MD5 | e043a9cb014d641a56f50f9d9ac9a1b9 |
| SHA1 | 61dc6aed3d0d1f3b8afe3d161410848c565247ed |
| SHA256 | 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946 |
| SHA512 | 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
| MD5 | da1d0cd400e0b6ad6415fd4d90f69666 |
| SHA1 | de9083d2902906cacf57259cf581b1466400b799 |
| SHA256 | 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575 |
| SHA512 | f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
| MD5 | 1bbf5dd0b6ca80e4c7c77495c3f33083 |
| SHA1 | e0520037e60eb641ec04d1e814394c9da0a6a862 |
| SHA256 | bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b |
| SHA512 | 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab |
memory/1988-365-0x0000000010000000-0x0000000010051000-memory.dmp
memory/1988-366-0x0000000002320000-0x0000000002323000-memory.dmp
memory/1988-367-0x0000000000AA0000-0x0000000000E88000-memory.dmp
memory/1988-369-0x0000000000AA0000-0x0000000000E88000-memory.dmp
memory/1988-370-0x0000000000AA0000-0x0000000000E88000-memory.dmp
memory/1988-371-0x0000000010000000-0x0000000010051000-memory.dmp
memory/1988-386-0x0000000000AA0000-0x0000000000E88000-memory.dmp
memory/1988-387-0x0000000010000000-0x0000000010051000-memory.dmp
memory/1988-394-0x0000000000AA0000-0x0000000000E88000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
| MD5 | 3e4f9ad22e78d1916883ba8ec1b40391 |
| SHA1 | 4eb8e83f9e4f24d6252c83640061cf6fbf8daf08 |
| SHA256 | 20ed02f9caeab1a1947e436aa39f99f8e69653e6f9ba5da3b88e31a461676e88 |
| SHA512 | d80793d15dc318fa2ab89252d153398ee5924391b0d3ff63b1063bea076c6681f9692284b6e744dd68abdca240c3c1b3eaa224a0449eddadd2c7bd7e943e8190 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG
| MD5 | 342916f21c1e06bea05bbf019607713c |
| SHA1 | 93a20cbead12b1d710aa30b7ad11f322b6e253fc |
| SHA256 | 93fb9f9ed1a680f419d545084a11db8a1ff1a9466cedec71ac33d78f39c367d1 |
| SHA512 | 321a5b6120008c510cbb43813b56eefeacbba3cc67fe1d9fc579579a6b8577999ac1a14e17301c4a3bdf3c98644a1c3519c63b6d079d06e614eca4b79fdc7518 |
memory/1988-431-0x0000000000AA0000-0x0000000000E88000-memory.dmp
memory/1988-432-0x0000000010000000-0x0000000010051000-memory.dmp
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
memory/1988-450-0x0000000004B30000-0x0000000004B40000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
| MD5 | 27e7f3d4f0383f5aa2747a73b2247056 |
| SHA1 | bab94178cde996a35dfaa905cede8015da321552 |
| SHA256 | 71d7808cae47025784d1a5a759d80c07704d5c745661c07d2bb5f883e821a7b7 |
| SHA512 | 56f486ca2dff3a94db51696f402d73b43b9f7adc576299c7fca1472dd1194c03cc36c9933dccb94579aaf87d6943c0b108a26a09b269f8fab07bec26067a9ac7 |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
| MD5 | 80d93d38badecdd2b134fe4699721223 |
| SHA1 | e829e58091bae93bc64e0c6f9f0bac999cfda23d |
| SHA256 | c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59 |
| SHA512 | 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4 |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
| MD5 | 80d93d38badecdd2b134fe4699721223 |
| SHA1 | e829e58091bae93bc64e0c6f9f0bac999cfda23d |
| SHA256 | c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59 |
| SHA512 | 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG
| MD5 | 343b2dec000aeb270da2da3d091cccee |
| SHA1 | 8ab8987520beb6f4ee7ecf85f5d3caf88afb4c9c |
| SHA256 | 36d9a038c082d934df2209fccdd5ddf7bfd15b393581bfd48f510cc161db5232 |
| SHA512 | 3ab0006fe9be943285f8294752d9ee14959284103676af7418fa2f59c967056bb2646fd48432af0e97be00c608ba493f08b160aa725898084bc726c904ffaa0c |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
| MD5 | eb5068631114b29fccae1d25e97b0c84 |
| SHA1 | 990a929650dfe6e0acd72dc5a9cd2164a218c984 |
| SHA256 | cc6b5045c62dbee603a0b77c809e65dd292ed2694496df96fae157e33c714d09 |
| SHA512 | eafd6e5128fb1021453889a06a86e74ba089419c85cf0c0985676e93210a528992523c42332e96b6e636cab83d2705d80027c4e8161e19a1942efad7ee77ae2a |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
| MD5 | 51be149c8e20df63087c584165516ecd |
| SHA1 | feabbb95b65e6929f086266b06ee1cfef83539a7 |
| SHA256 | b949eb246d81688efea07a7655652107ad435f37d493d93dd68c88a9fe6f3e33 |
| SHA512 | 6f24e4caafd6af85c2f8641d7f2b066dfafa7d6abb512fa62f3642eaa42b549692b15043a3bf0e13cb1fae377fc1d3139dcf5cea3d4def24de197f75297e17f0 |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
memory/568-490-0x0000000002C60000-0x0000000003048000-memory.dmp
memory/568-491-0x0000000002C60000-0x0000000003048000-memory.dmp
memory/1264-492-0x0000000000E80000-0x0000000001268000-memory.dmp
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
memory/1988-510-0x0000000000AA0000-0x0000000000E88000-memory.dmp
memory/1264-514-0x0000000000BD0000-0x0000000000BE0000-memory.dmp
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
\Users\Admin\AppData\Local\Temp\Opera_installer_230313201702694680.dll
| MD5 | 02cdbf798a668878b72b920b6e265272 |
| SHA1 | 2301a19f2e1003656463d77d536aa18d27cdd513 |
| SHA256 | c9da947548474485935e7e8780b765fa6b8b4ad3afc4a1ad216fbe1097f8ad94 |
| SHA512 | d4b10633b2bd5845b05c6880f3a4812f69e590e157c45e49d59594d8c78fbc385b89dfec058ae1461cac6175cb318d27839d7f462e550cf3d2338933c4b18aaf |
memory/1264-545-0x0000000000E80000-0x0000000001268000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
memory/680-550-0x0000000002CA0000-0x00000000031EA000-memory.dmp
memory/1624-551-0x0000000000DB0000-0x00000000012FA000-memory.dmp
memory/680-561-0x0000000000DB0000-0x00000000012FA000-memory.dmp
\Users\Admin\AppData\Local\Temp\Opera_installer_2303132017039421624.dll
| MD5 | 02cdbf798a668878b72b920b6e265272 |
| SHA1 | 2301a19f2e1003656463d77d536aa18d27cdd513 |
| SHA256 | c9da947548474485935e7e8780b765fa6b8b4ad3afc4a1ad216fbe1097f8ad94 |
| SHA512 | d4b10633b2bd5845b05c6880f3a4812f69e590e157c45e49d59594d8c78fbc385b89dfec058ae1461cac6175cb318d27839d7f462e550cf3d2338933c4b18aaf |
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
memory/680-599-0x0000000003AE0000-0x000000000402A000-memory.dmp
memory/1484-600-0x0000000001270000-0x00000000017BA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2303132017054551484.dll
| MD5 | 02cdbf798a668878b72b920b6e265272 |
| SHA1 | 2301a19f2e1003656463d77d536aa18d27cdd513 |
| SHA256 | c9da947548474485935e7e8780b765fa6b8b4ad3afc4a1ad216fbe1097f8ad94 |
| SHA512 | d4b10633b2bd5845b05c6880f3a4812f69e590e157c45e49d59594d8c78fbc385b89dfec058ae1461cac6175cb318d27839d7f462e550cf3d2338933c4b18aaf |
memory/1484-607-0x0000000001270000-0x00000000017BA000-memory.dmp
\Users\Admin\AppData\Local\Temp\Opera_installer_2303132017054551484.dll
| MD5 | 02cdbf798a668878b72b920b6e265272 |
| SHA1 | 2301a19f2e1003656463d77d536aa18d27cdd513 |
| SHA256 | c9da947548474485935e7e8780b765fa6b8b4ad3afc4a1ad216fbe1097f8ad94 |
| SHA512 | d4b10633b2bd5845b05c6880f3a4812f69e590e157c45e49d59594d8c78fbc385b89dfec058ae1461cac6175cb318d27839d7f462e550cf3d2338933c4b18aaf |
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
| MD5 | 3558397fb4d5f68860a1316b476463c9 |
| SHA1 | a6d931ab76e4f1a58db0cdddf63b8b8e82837e09 |
| SHA256 | 9f6f4bee98f1d7578e102ca028adc59af3b6833de740df0a5e78b8f9a2e0c32e |
| SHA512 | e284d650fcfac8a60b02e1c40adaf48176db17b0f3d2ce6347382aa8096a8a96ae1d2900b761fdca023c92fbadb0f6cc5c8eaf79d434b6aa8f1ac0cb627785bd |
\Users\Admin\AppData\Local\Temp\Opera_installer_2303132017089801652.dll
| MD5 | 02cdbf798a668878b72b920b6e265272 |
| SHA1 | 2301a19f2e1003656463d77d536aa18d27cdd513 |
| SHA256 | c9da947548474485935e7e8780b765fa6b8b4ad3afc4a1ad216fbe1097f8ad94 |
| SHA512 | d4b10633b2bd5845b05c6880f3a4812f69e590e157c45e49d59594d8c78fbc385b89dfec058ae1461cac6175cb318d27839d7f462e550cf3d2338933c4b18aaf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8e7cf96c8db21640ce63b2306ce5d69f |
| SHA1 | 588042d128225408e73377b6b5c05018c78536d2 |
| SHA256 | 5563b1ce59cecf5fe1c366212a36237f0d8f93453718bd8b48df5f596055f64b |
| SHA512 | 3973dea3782456bf0e01f2d236b17e8999a0530d6d4585121ca1b535aa7a03fdff58d5cc387486cae5c5ac7dec2873edf27d9b3ea7c26283dad2985348b65116 |
C:\Users\Admin\AppData\Local\Temp\Cab908D.tmp
| MD5 | fc4666cbca561e864e7fdf883a9e6661 |
| SHA1 | 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5 |
| SHA256 | 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b |
| SHA512 | c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d |
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
| MD5 | a4121a722d71c85677995fb299efc4b6 |
| SHA1 | a7a00759ab6e0bd3e18d53920cba229b7b065957 |
| SHA256 | 525aab81fb89b241f92e7f47f17dfc81fcf943d68cc447677f52c7ebe863cd7b |
| SHA512 | c8669f6c7f80f39e78317bb26e9b7960ee0c92e3b5ce42e885a8aadedabdf7da373f10a55fd0765429381cb03b7193c0877e0255dd4929ac4dfde50534f55745 |
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
| MD5 | a4121a722d71c85677995fb299efc4b6 |
| SHA1 | a7a00759ab6e0bd3e18d53920cba229b7b065957 |
| SHA256 | 525aab81fb89b241f92e7f47f17dfc81fcf943d68cc447677f52c7ebe863cd7b |
| SHA512 | c8669f6c7f80f39e78317bb26e9b7960ee0c92e3b5ce42e885a8aadedabdf7da373f10a55fd0765429381cb03b7193c0877e0255dd4929ac4dfde50534f55745 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
| MD5 | bbb16a91df9dde2869871f861bc4353e |
| SHA1 | 0fe8c5580b6f0fa61ceeb0fb13723be089596e11 |
| SHA256 | 1d990b6da4b7912f5d01e8ffa705fcc14269be6fdabdb746312646f7d72b96b1 |
| SHA512 | 8299a7d3f35d6e56f8fb2f99d2735901377ec9c2e2b1ca6a75f4de70e43620b5a49ad370e82332a9fa5446911d58633b9dbdde3e3d15c8a6c998e5ee035c1a3f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
| MD5 | c52eeb80c0e1b5b44ad0e3e81d59a64b |
| SHA1 | a25dd0b36bfc962e0a6fb8c5685270a257f5552b |
| SHA256 | 02acceac1473c19cc046b0305982f472141364aa7c6b0de76f2aa3c5f4bd66b4 |
| SHA512 | 90c8f4e85c731b4215d38b235738d3b4eb92acd222a7ee99aae941a5edcd784f8d2fd65bf8f40e5ea1e6e0424925b00aa5e70506a7ad8f6d55b2862eb0ea3d64 |
\Users\Admin\AppData\Local\Temp\Opera_installer_230313201708809604.dll
| MD5 | 02cdbf798a668878b72b920b6e265272 |
| SHA1 | 2301a19f2e1003656463d77d536aa18d27cdd513 |
| SHA256 | c9da947548474485935e7e8780b765fa6b8b4ad3afc4a1ad216fbe1097f8ad94 |
| SHA512 | d4b10633b2bd5845b05c6880f3a4812f69e590e157c45e49d59594d8c78fbc385b89dfec058ae1461cac6175cb318d27839d7f462e550cf3d2338933c4b18aaf |
memory/680-645-0x0000000004190000-0x00000000046DA000-memory.dmp
memory/604-647-0x0000000002BD0000-0x000000000311A000-memory.dmp
memory/1652-648-0x0000000000DB0000-0x00000000012FA000-memory.dmp
memory/604-646-0x0000000000DB0000-0x00000000012FA000-memory.dmp
memory/1988-652-0x0000000000AA0000-0x0000000000E88000-memory.dmp
memory/1988-662-0x0000000004B30000-0x0000000004B40000-memory.dmp
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG29.PNG
| MD5 | 9fb892cb12987eb85b303745c00e0005 |
| SHA1 | 4afed97947228ae2eb97579c04681241471101bd |
| SHA256 | 328f2d535ce6695219d02681949aa63be40433be6c51b5727d0b7865440d2949 |
| SHA512 | adf7d20b5096f5c985d931f2e222e388dc34ef8a168b061c9e6250f6ecea944204ec3d616857c4d447985bc5e6a5bc8384e207a00f50ad4a119bf0b3fea13059 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG
| MD5 | 1c9e24d780e12c81094546db7dba85ac |
| SHA1 | 9a21b5304a8326f4d115f1aeed413191969f82ca |
| SHA256 | 06fd6ea5ff0c58b5dd1ee0ff062e79f66f40a2ab4a0cb3937949781db90b0ad7 |
| SHA512 | a0d66cdf4e11fcb991acf2faae92f91dbb2144694a353a41e450ede37c9de605cedf5772744c90967eddcd88055023ba6e4a9bf1a8a6875f8750aedffcf6618a |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG11.PNG
| MD5 | fe236f1182935dcbcfec9b864cbaba81 |
| SHA1 | ef04ae2217dc030047133cb2a7f5ab7d3b45363d |
| SHA256 | 700ff688c18f645159807cbeac403f852646ad2d1d4a4f3a62410e214c23db96 |
| SHA512 | 59fc89ac345f0f931fbbec93a930d32adae4d6d1b5ec89057988f060ad6bc893d681d957915a7c59d45875275a6d3019d786f71e84401a5ae3d67eba60b2a6da |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
| MD5 | c00a190340711134584dc004bf18b506 |
| SHA1 | 72bbbf9ab0e5b3fbf825b0a46da1b25641fbf346 |
| SHA256 | db127cc179eb800b489b1d0d014d6d5b5bf04988b23b55ce7b2d108a4852f343 |
| SHA512 | 597ce1ae67201158e554f2e85218f2bb3321d0b47593c845d5130d80f7817b5ad4b92f30053ef0809315c4f02299edfe09fa67870e11cdc6095390683c0b4d56 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
| MD5 | 59fffe29deaeaafed4cc62a8213f81b8 |
| SHA1 | dd77ee28c564de56d78fc423714fb9dcb93d7eb2 |
| SHA256 | 300669d0147823dde86fa07c105b7bc67b4bb95314d2a1dfd4d279da1266aa9f |
| SHA512 | 45c2eb1ed7e54a3d0a83ecde25579904406799841114f8eda8c932237a525455f582438a67c5c8ba8d4c3f1bfcf5b9a239e38e2e290c5c3e5e4258106daee7d7 |
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
| MD5 | f08d9bbc61cff8e8c3504524c3220bef |
| SHA1 | b4268c667469620bb528c04eaa819d508159b398 |
| SHA256 | 2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb |
| SHA512 | a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG
| MD5 | 96df483076fe5b82a193e0f74ae9427c |
| SHA1 | e2914a84864c5a0507406b7e013c915eb64c5d88 |
| SHA256 | b08c9f5d1d5375498e555889886992e45c805658e7fb18def814a4ea6539c096 |
| SHA512 | 732dc92695e193f359b42bd0eea7310406fade281ab3965727ca22b707ccedbae4c7f7706597b8b23ba93f9c259229e9c14a1d1efd959c6acb17905b36d52769 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG8.BMP
| MD5 | d2b43decae0a14deb90423bfb687dc63 |
| SHA1 | c191705fcb927d476d4fc639860bd52e324a274c |
| SHA256 | 3266fb3a33a97fac7d71652129865c3d0dd06e70af6ed5a3b2506d842eb69e70 |
| SHA512 | 3cd903b0c4590e25502cd0f91b678c1e798989211e174d5a6dbfd52b343a426b867204979cc078a4919d63a4c4401c4f8eaa295227cec0ccc043c7e285d3d2df |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP
| MD5 | 0b445ace8798426e7185f52b7b7b6d1e |
| SHA1 | 7a77b46e0848cc9b32283ccb3f91a18c0934c079 |
| SHA256 | 2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6 |
| SHA512 | 51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG46.PNG
| MD5 | bd8b796fabf29bce107b327cd690807f |
| SHA1 | edde96dc69ec4c6a8374069e56b27cfa98b50694 |
| SHA256 | 8f65c8b2c3c27ce8bb37fc64aba53eb01ded825f26f9f09bd4b03c6bc41b6ca2 |
| SHA512 | b4091792afe29bb346350928b7726c1a4411bbae732f4d7a862faa909453b6efb79417053a10db1c70f11315a2064682842655bdbd2c374cb6564693f5f1fbfa |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG
| MD5 | 82b5905aadccafd519f5baaba8b4235c |
| SHA1 | ac20c24c050d67ac9cf6d5d012f6c4e3e109dc6d |
| SHA256 | 7b0e92663780a8c412e31cde6f5abc18ed58bb19e3791208e8bd77ff9df2a4e7 |
| SHA512 | 28a04532b8416eec31022493b725150711036cab5b87a7e4a39284ff4799e024abb34b808fc2182318cdad282c75958210d68368222ecc583ac139e6c1f0b802 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG73.PNG
| MD5 | 6d9cad201627bf9b04e0ca95d8b1cbdc |
| SHA1 | 9bc353075f733d583e7a7258064df4f601f5c59e |
| SHA256 | fc6960c7e3a746b86faf4cf6a84e1369367485cbe0814573444807576f81ea0d |
| SHA512 | 5f51c62de85c36cd842cf9666d78c946306a616f93e4ab55b8eb0fc64b218c1088bbf30f7abf72bcca354a0830abd9d8c004ecdc2aa88ce50657daa8afe6abd9 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG
| MD5 | f2664610dabb317dfe1120518e323887 |
| SHA1 | 33f8a173d6a0d4b7ecd4b5be9fd052795d689919 |
| SHA256 | 67d18f4a1cdf8906751fed972deb353a773101fea9c62929e434cf4a31124cc9 |
| SHA512 | 16ef6bd74c99e4c805ddc53d2cfb6ea3913f8e78ca674e3f61c3b49510c40d7b2b7a96f80e72dd428a28334deebe6859f59d3fdd40e44a0356224695c8cb8eb9 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG54.PNG
| MD5 | f77565ceb1fdad8d7eb1b0a5bfac2206 |
| SHA1 | 0cdd715372c5e59cea9784b3723cc7571a08a791 |
| SHA256 | 926e2ea2f76a728d04e792b0f3959ce71c09509769f6d0e4ce0c947888750bac |
| SHA512 | 7001b182d9a92e25a4cac3c36f3c8546679ad46a612ac52d946b798cb129be026c05ef62259fd9b61eab91557198ec693c9c87ba8b7e23b3e7ab6dee1152ee04 |
C:\Users\Admin\AppData\Local\Temp\TarB761.tmp
| MD5 | 73b4b714b42fc9a6aaefd0ae59adb009 |
| SHA1 | efdaffd5b0ad21913d22001d91bf6c19ecb4ac41 |
| SHA256 | c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd |
| SHA512 | 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG
| MD5 | 8691619d3729db635b36abf4cb92b722 |
| SHA1 | 5f65a27c0b8d2a25a3c107eadcde937a6c9620b1 |
| SHA256 | 386db08587c847acba938e16a37f345f8d95cc1c77ed562b3c2cc71c1ccbfc1c |
| SHA512 | 0f2e192e6f23a512c7e0b75ecf54bfe8cdfcd4c18f48cb4a4ccbb879881ece3308e1fb97891583f1248c2a833c36509e8e1b81bf39958189676b05d9bd9605a6 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
| MD5 | 1bbf5dd0b6ca80e4c7c77495c3f33083 |
| SHA1 | e0520037e60eb641ec04d1e814394c9da0a6a862 |
| SHA256 | bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b |
| SHA512 | 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
| MD5 | da1d0cd400e0b6ad6415fd4d90f69666 |
| SHA1 | de9083d2902906cacf57259cf581b1466400b799 |
| SHA256 | 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575 |
| SHA512 | f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG124.PNG
| MD5 | add45fcce9e1d8992e60401842562c2e |
| SHA1 | 7869dc6ad6116e2c864f32b959a489ee4100aa2e |
| SHA256 | 4c9e68ac4cebbfde2f2f5a9318b597825f3d7a41f32cd288e3fa964b95a69fff |
| SHA512 | 2f98fc864d4bf46c8595f94c4296e6d4213d90591ee197679b2c4f5f4a27b248a52a941b811fceca2f8d32044d42dfe589ec981baaba86a7e4d844d687d048fb |
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\opera_package
| MD5 | 52059f9908aca2af15df265bfb73517f |
| SHA1 | 141ce7239b067ee7b266594ea6bb23e730f73621 |
| SHA256 | 7b8ee89686128fb3e73542395e49eec5da3f730039de32ac2cfe58a4e7525b73 |
| SHA512 | 191df166c778d6ddd9cbb4ba17d24945aeb6554183eff1084dfa07221114f3d420074176a329fb561fe75600ee874e115b7c32a4ca3f795096e907ca3f601266 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
| MD5 | a9bd5c298f84886a96fecaa0a1ac4207 |
| SHA1 | 12d15f88e61d417fce8c240b6591d76276fae985 |
| SHA256 | 7988ed09615eb10e19e6522c589535a8747f614f000704a138f8c63d673ef559 |
| SHA512 | c900d40286a8a838bcb77044156dff60d5e2c02ca166d88f4ca08a3112041a6c70c7e63901922b98b75631993aeeaa39fd8af0296c90eb09cd1f630b3c82d3ef |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG92.PNG
| MD5 | ea96bd465b5cc6f02a328606810482d6 |
| SHA1 | ffd69d92498767a78431276bf0a77fef17fc8e30 |
| SHA256 | a4dfc277e282e9f917d29fd98b4682e98017c24dc7c8a96b1ae56fe71c5bbe64 |
| SHA512 | 6bced983a20fc1b413f579b6a668f0182ae3283516fedb8b71d3c4345bd6512ca836aac4784589fd5dc2f9ac91c4144f640a4b4e9b9ed84c8962263eb6a0208f |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG
| MD5 | e0901ba1513ace1b39991bfa0b911498 |
| SHA1 | 4ce82072212487c2f484bacf1de20e179b3fac6e |
| SHA256 | c571b49df24291011ff427f5f450b673531409c7b4576c34ca3f284ef3c55493 |
| SHA512 | 7ff181c9ea32ca2828ef7d1e34c96c6855dac906108eb680a90da5dd9f2008d815c96969263b3314b7db1a83bf7032da631c878dfa4a99976d8cabf79ea62b8d |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG
| MD5 | d0283575c47a16d567f02b70550e22a9 |
| SHA1 | 189ce85ca43d3aa4336c2e7719cf206691257999 |
| SHA256 | 44464fa74b703a959540202a83383c33cee05f7affc69898e0d3b541b1e87970 |
| SHA512 | 5b70a22b0a48aa3c6e88123c4d3ff928b02bbe158d63e565bd558aa990482a4d9a98e710ec3dded8fef6042eedb5a1ed62ffc632fe9d102a9cb49342727c515d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | e71c8443ae0bc2e282c73faead0a6dd3 |
| SHA1 | 0c110c1b01e68edfacaeae64781a37b1995fa94b |
| SHA256 | 95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72 |
| SHA512 | b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6 |
memory/1988-1490-0x0000000000AA0000-0x0000000000E88000-memory.dmp
memory/1988-1491-0x0000000010000000-0x0000000010051000-memory.dmp
memory/680-1493-0x0000000002CA0000-0x00000000031EA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\TarC6B9.tmp
| MD5 | be2bec6e8c5653136d3e72fe53c98aa3 |
| SHA1 | a8182d6db17c14671c3d5766c72e58d87c0810de |
| SHA256 | 1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd |
| SHA512 | 0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff |
memory/680-1515-0x0000000003AE0000-0x000000000402A000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | e71c8443ae0bc2e282c73faead0a6dd3 |
| SHA1 | 0c110c1b01e68edfacaeae64781a37b1995fa94b |
| SHA256 | 95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72 |
| SHA512 | b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8229d977e860dd1e5fcb18c1f2985690 |
| SHA1 | d6793ee14305827ca69e9973ac9903838fd3abd7 |
| SHA256 | 1a23f1aad8b2e7ed19dd3cfb63732f2e353169cdbdf5fe982454e9ec0ae25fc7 |
| SHA512 | bf6b26516234d52c933fd198f4799e478b20dde77260e9a6bbab6aa566441c840d928cf28c40ee9e652e2df533da5ba9cf7e2967ba4fcb8abf3270be4ba772d6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 871302d23911d85ac4f11ae1fdd74790 |
| SHA1 | 2ef8bb842e9496d4473f74612465c66e3334b48a |
| SHA256 | 6ee2f8404c07898d72936e508e80f2add6d6f2065631f8df241ed6841af51031 |
| SHA512 | a530bed49be0aa211f5416b9a9e4e9ee1cfcb08064ee0f4118f28760930d0b6370545fc8f564f3d898cbaf635899ee50edacc117699fe63896fb4b59d257e367 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 871302d23911d85ac4f11ae1fdd74790 |
| SHA1 | 2ef8bb842e9496d4473f74612465c66e3334b48a |
| SHA256 | 6ee2f8404c07898d72936e508e80f2add6d6f2065631f8df241ed6841af51031 |
| SHA512 | a530bed49be0aa211f5416b9a9e4e9ee1cfcb08064ee0f4118f28760930d0b6370545fc8f564f3d898cbaf635899ee50edacc117699fe63896fb4b59d257e367 |
memory/680-1606-0x0000000004190000-0x00000000046DA000-memory.dmp
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\opera_package
| MD5 | 52059f9908aca2af15df265bfb73517f |
| SHA1 | 141ce7239b067ee7b266594ea6bb23e730f73621 |
| SHA256 | 7b8ee89686128fb3e73542395e49eec5da3f730039de32ac2cfe58a4e7525b73 |
| SHA512 | 191df166c778d6ddd9cbb4ba17d24945aeb6554183eff1084dfa07221114f3d420074176a329fb561fe75600ee874e115b7c32a4ca3f795096e907ca3f601266 |
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\opera_package
| MD5 | 52059f9908aca2af15df265bfb73517f |
| SHA1 | 141ce7239b067ee7b266594ea6bb23e730f73621 |
| SHA256 | 7b8ee89686128fb3e73542395e49eec5da3f730039de32ac2cfe58a4e7525b73 |
| SHA512 | 191df166c778d6ddd9cbb4ba17d24945aeb6554183eff1084dfa07221114f3d420074176a329fb561fe75600ee874e115b7c32a4ca3f795096e907ca3f601266 |
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\additional_file0.tmp
| MD5 | b386cdcb413405daa8219af8e4cbd318 |
| SHA1 | ce275ff8514fef0629c915a6ee7b5ac481b9043d |
| SHA256 | 408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e |
| SHA512 | 91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626 |
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\_sfx.exe
| MD5 | b386cdcb413405daa8219af8e4cbd318 |
| SHA1 | ce275ff8514fef0629c915a6ee7b5ac481b9043d |
| SHA256 | 408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e |
| SHA512 | 91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626 |
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\_sfx.exe
| MD5 | b386cdcb413405daa8219af8e4cbd318 |
| SHA1 | ce275ff8514fef0629c915a6ee7b5ac481b9043d |
| SHA256 | 408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e |
| SHA512 | 91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626 |
memory/1988-1630-0x0000000000AA0000-0x0000000000E88000-memory.dmp
memory/1988-1632-0x0000000010000000-0x0000000010051000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\_sfx.exe
| MD5 | b386cdcb413405daa8219af8e4cbd318 |
| SHA1 | ce275ff8514fef0629c915a6ee7b5ac481b9043d |
| SHA256 | 408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e |
| SHA512 | 91f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626 |
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\assistant_installer.exe
| MD5 | 2f3d9e21e232b9bfea064d3b2264db06 |
| SHA1 | bafddc657d8d1bb531683b29b0342cc065ee51d2 |
| SHA256 | 25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d |
| SHA512 | 94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5 |
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\assistant_installer.exe
| MD5 | 2f3d9e21e232b9bfea064d3b2264db06 |
| SHA1 | bafddc657d8d1bb531683b29b0342cc065ee51d2 |
| SHA256 | 25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d |
| SHA512 | 94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5 |
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202303132017071\assistant\assistant_installer.exe
| MD5 | 2f3d9e21e232b9bfea064d3b2264db06 |
| SHA1 | bafddc657d8d1bb531683b29b0342cc065ee51d2 |
| SHA256 | 25528c314aed2b5391ca1d08c736a3807142aab21ae99d5970f2a862c8258d5d |
| SHA512 | 94e81aa3015b7e112bf772b52b2dd6092f5634746e201171b34b2493a62b08fbbf53a6d6c60c904c424c06e802aae6810c6dd88cf7a882846bc0a4793c3b32e5 |
memory/2976-1653-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/2976-1654-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/1988-1655-0x0000000000AA0000-0x0000000000E88000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\jusched.log
| MD5 | 631a2818e33c3788f76bf1178fae3a35 |
| SHA1 | 4ee2b9d5c9c7a379ff7a431c829e0a8934842e4d |
| SHA256 | 9c17e24d3a8705f2d150886fe519ec5fdc9dbdbb0de4b89df8fc76f519f5834f |
| SHA512 | dba1b9d7b80e429bcb92d4acdfad77192d6e204b829cea9d09bb4a18ad7b03fccd364be1eed894b47d3c95b653792618706d75bf7edb6c5f2bd73e841bf080e1 |
C:\Users\Admin\AppData\Local\Temp\jusched.log
| MD5 | 5365f91697409b4871e54091b08f0aef |
| SHA1 | 1f74928f164f2c3248328d8b50b6533c6c6f7064 |
| SHA256 | 8486882e9df4b4eea58a3b3fbff62ab2ef72b349004730620aae7dfcaeee550d |
| SHA512 | 32643b2698eb907658dfe39dd87ab24420ee93c26291c8bf1b98ad62743befb16a26a90a8ef8451f85d6389657cd469026e3f26031fa9bd6d33a2b910d868678 |
C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.8.0_351\Java3BillDevices.png
| MD5 | b3c9f084b052e95aa3014e492d16bfa6 |
| SHA1 | 0e33962b2191e7b1a5d85102cdf3c74fcd1254e4 |
| SHA256 | a68ddd67f6fcb0bbf1defa0778ee543e92c1074c442197ab623f733cc6285948 |
| SHA512 | 06f51ac2962a0ec5f05ad6c90a2ba85b851d1fa2f0c079dc264fe930316cead959f68f6e34ff591b131867b482c266ac42400b06385dae712637ff0a90f902d4 |
memory/1988-1851-0x0000000010000000-0x0000000010051000-memory.dmp
C:\Windows\Installer\MSI66C4.tmp
| MD5 | 62cfeb86f117ad91b8bb52f1dda6f473 |
| SHA1 | c753b488938b3e08f7f47df209359c7b78764448 |
| SHA256 | f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e |
| SHA512 | c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e |
C:\Windows\Installer\6e5d9b.msi
| MD5 | 1794aaa17d114a315a95473c9780fc8b |
| SHA1 | 7f250c022b916b88e22254985e7552bc3ac8db04 |
| SHA256 | 7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4 |
| SHA512 | fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516 |
memory/2712-2008-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2712-2009-0x0000000000230000-0x0000000000247000-memory.dmp
memory/2712-2010-0x0000000000230000-0x0000000000247000-memory.dmp
memory/2712-2011-0x0000000000230000-0x0000000000247000-memory.dmp
memory/2712-2019-0x0000000000400000-0x0000000000417000-memory.dmp
C:\Program Files\Java\jre1.8.0_351\bin\unpack200.exe
| MD5 | 691f68efcd902bfdfb60b556a3e11c2c |
| SHA1 | c279fa09293185bddfd73d1170b6a73bd266cf07 |
| SHA256 | 471d70ebf91bdc762dcacbea9f6ca883f97921938e83269fef911dbf83598a70 |
| SHA512 | a4816ae0654f41bd130d56e44839d9f29ab48bd2f99c3d6db38ce3358ac46c1cef09da09184c6291dd378018a49f9e56173c35d780d3eaefcce459592c75de3f |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Documentación de Referencia.lnk
| MD5 | b5e1de7d05841796c6d96dfe5b8b338c |
| SHA1 | c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547 |
| SHA256 | 062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d |
| SHA512 | 963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d |
C:\Program Files\Java\jre1.8.0_351\bin\javacpl.exe
| MD5 | 7a9d69862a2021508931a197cd6501ec |
| SHA1 | a0f7d313a874552f4972784d15042b564e4067fc |
| SHA256 | 51ff63cbac78bd133333e98d91b02b652c88cd57cedd0052519051a17be77856 |
| SHA512 | 5c331e6deefc8256ea203d63770484f6b485d4c3832a60ecf4a540dff3cb75a76dbde37980fe1763ca487401b68126f58f8d1a4c72ee610f5144c624c4736850 |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Obtener Ayuda.url
| MD5 | 7fadb9e200dbbd992058cefa41212796 |
| SHA1 | e2525d7ba66bb07bc1cd5ba93f88c54e7e2042b4 |
| SHA256 | b05abacd15117b1ffcd2a288308f50c0542214d264b852eddfa9025307ac401b |
| SHA512 | 94b7bf1f1f5cea2a74f8c326113dd25652cb14e5fa356ac83d16b6ac5a5cac26c9d2b20259f5c2cf8ebc1e022490511e2996335a5d8dd7f5b64dce429fb6dfb1 |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visite Java.com.url
| MD5 | 3b1c6b5701ef2829986a6bdc3f6fbf94 |
| SHA1 | 1a2fe685aba9430625cba281d1a8f7ba9d392af0 |
| SHA256 | 6a2cdce88637830202e1031bc8c11f083103a6bbb8c1ce16fb805671a46633c8 |
| SHA512 | f3391d790bb6acb1c25b82253b19c334e7cd73648e9821b7050fefbd5b0bc4b48a0cedd97e425a83c788f9b798337d33dee2e989771604c4f886da46d2debea0 |
C:\Program Files\Java\jre1.8.0_351\bin\javaws.exe
| MD5 | 24ccb37646e1f52ce4f47164cccf2b91 |
| SHA1 | bc265e26417026286d6ed951904305086c4f693c |
| SHA256 | adf2d659c2b2a4afff1ca58f3a742d27d767d27eabeca6a8b6ee243e9c913a39 |
| SHA512 | cb174e7a219f6ffae3715e37beb428979bc1462202729c05a25fa7b8da90e2dd6faa92c03cd9ca21567d354dce7acc1852669f4071298e953d6a286243794e32 |
C:\Program Files\Java\jre1.8.0_351\bin\dtplugin\npdeployJava1.dll
| MD5 | ff91ac355dc6b1df63795886125bccf8 |
| SHA1 | 90979fc6ea3a89031598d2146bf5cdbbb6db6b77 |
| SHA256 | 14b30467cfea0071dffc658dd31b8a25b7b4e79608933f171911c2cba6aa9a0a |
| SHA512 | 77aa8c7930730004bdb8d49a82712e1042db978102f6eca0d38317b6fd98ef03e52279130eadc7a0da1148e759db6589f7f8334d4c2eccfb2613e8f19542e197 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-03-13 19:13
Reported
2023-03-13 19:19
Platform
win10v2004-20230220-es
Max time kernel
229s
Max time network
227s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.6-global.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks installed software on the system
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\mspaint.exe | N/A |
| N/A | N/A | C:\Windows\system32\mspaint.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.6-global.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.6-global.exe"
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:23643746" "__IRSID:S-1-5-21-2275444769-3691835758-4097679484-1000"
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-2275444769-3691835758-4097679484-1000"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\NewDismount.jpe" /ForceBootstrapPaint3D
Network
| Country | Destination | Domain | Proto |
| US | 209.197.3.8:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 117.18.237.29:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 117.18.237.29:80 | tcp | |
| US | 8.8.8.8:53 | 203.33.253.131.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 39.146.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | dl2.tlauncher.org | udp |
| US | 104.20.234.70:443 | dl2.tlauncher.org | tcp |
| US | 8.8.8.8:53 | 70.234.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.38.195.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tlauncher.org | udp |
| US | 104.20.234.70:443 | tlauncher.org | tcp |
| US | 8.8.8.8:53 | 226.21.18.104.in-addr.arpa | udp |
| US | 52.152.108.96:443 | tcp | |
| US | 8.8.8.8:53 | 199.176.139.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.238.32.23.in-addr.arpa | udp |
| FR | 40.79.141.153:443 | tcp | |
| NL | 173.223.113.164:443 | tcp | |
| NL | 173.223.113.131:80 | tcp | |
| US | 204.79.197.203:80 | tcp | |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.36.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 63.13.109.52.in-addr.arpa | udp |
| US | 209.197.3.8:80 | tcp | |
| US | 8.8.8.8:53 | 254.17.250.8.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
| MD5 | 5b4c988e2c4f9b703e7c14ea3ba5115d |
| SHA1 | 6191f653571a192ed43f637be0be2d0713c355de |
| SHA256 | 6a295ca07cc92c2d463b1ae9606f9c3017814edee923073737a4af9022f7fa69 |
| SHA512 | 5a51728631c11391c92f3f46e55ad574c3bf63de896689249127922f5c42db80cf131353ded2ba04446e5f4e0f459f487d964b973a9f91bd8242132570077473 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
| MD5 | 80d93d38badecdd2b134fe4699721223 |
| SHA1 | e829e58091bae93bc64e0c6f9f0bac999cfda23d |
| SHA256 | c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59 |
| SHA512 | 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
| MD5 | 80d93d38badecdd2b134fe4699721223 |
| SHA1 | e829e58091bae93bc64e0c6f9f0bac999cfda23d |
| SHA256 | c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59 |
| SHA512 | 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4 |
memory/112-147-0x0000000000830000-0x0000000000C18000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
| MD5 | e043a9cb014d641a56f50f9d9ac9a1b9 |
| SHA1 | 61dc6aed3d0d1f3b8afe3d161410848c565247ed |
| SHA256 | 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946 |
| SHA512 | 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
| MD5 | da1d0cd400e0b6ad6415fd4d90f69666 |
| SHA1 | de9083d2902906cacf57259cf581b1466400b799 |
| SHA256 | 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575 |
| SHA512 | f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
| MD5 | da1d0cd400e0b6ad6415fd4d90f69666 |
| SHA1 | de9083d2902906cacf57259cf581b1466400b799 |
| SHA256 | 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575 |
| SHA512 | f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
| MD5 | 1bbf5dd0b6ca80e4c7c77495c3f33083 |
| SHA1 | e0520037e60eb641ec04d1e814394c9da0a6a862 |
| SHA256 | bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b |
| SHA512 | 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
| MD5 | 1bbf5dd0b6ca80e4c7c77495c3f33083 |
| SHA1 | e0520037e60eb641ec04d1e814394c9da0a6a862 |
| SHA256 | bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b |
| SHA512 | 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab |
memory/112-440-0x0000000010000000-0x0000000010051000-memory.dmp
memory/112-441-0x0000000003520000-0x0000000003523000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
| MD5 | 3e4f9ad22e78d1916883ba8ec1b40391 |
| SHA1 | 4eb8e83f9e4f24d6252c83640061cf6fbf8daf08 |
| SHA256 | 20ed02f9caeab1a1947e436aa39f99f8e69653e6f9ba5da3b88e31a461676e88 |
| SHA512 | d80793d15dc318fa2ab89252d153398ee5924391b0d3ff63b1063bea076c6681f9692284b6e744dd68abdca240c3c1b3eaa224a0449eddadd2c7bd7e943e8190 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG
| MD5 | 342916f21c1e06bea05bbf019607713c |
| SHA1 | 93a20cbead12b1d710aa30b7ad11f322b6e253fc |
| SHA256 | 93fb9f9ed1a680f419d545084a11db8a1ff1a9466cedec71ac33d78f39c367d1 |
| SHA512 | 321a5b6120008c510cbb43813b56eefeacbba3cc67fe1d9fc579579a6b8577999ac1a14e17301c4a3bdf3c98644a1c3519c63b6d079d06e614eca4b79fdc7518 |
memory/112-482-0x0000000000830000-0x0000000000C18000-memory.dmp
memory/112-483-0x0000000010000000-0x0000000010051000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
| MD5 | aa4de04ccc16b74a4c2301da8d621ec1 |
| SHA1 | d05c6d8200f6e6b1283df82d24d687adc47d9664 |
| SHA256 | e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b |
| SHA512 | 28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG
| MD5 | 343b2dec000aeb270da2da3d091cccee |
| SHA1 | 8ab8987520beb6f4ee7ecf85f5d3caf88afb4c9c |
| SHA256 | 36d9a038c082d934df2209fccdd5ddf7bfd15b393581bfd48f510cc161db5232 |
| SHA512 | 3ab0006fe9be943285f8294752d9ee14959284103676af7418fa2f59c967056bb2646fd48432af0e97be00c608ba493f08b160aa725898084bc726c904ffaa0c |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG
| MD5 | bd8b796fabf29bce107b327cd690807f |
| SHA1 | edde96dc69ec4c6a8374069e56b27cfa98b50694 |
| SHA256 | 8f65c8b2c3c27ce8bb37fc64aba53eb01ded825f26f9f09bd4b03c6bc41b6ca2 |
| SHA512 | b4091792afe29bb346350928b7726c1a4411bbae732f4d7a862faa909453b6efb79417053a10db1c70f11315a2064682842655bdbd2c374cb6564693f5f1fbfa |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
| MD5 | 27e7f3d4f0383f5aa2747a73b2247056 |
| SHA1 | bab94178cde996a35dfaa905cede8015da321552 |
| SHA256 | 71d7808cae47025784d1a5a759d80c07704d5c745661c07d2bb5f883e821a7b7 |
| SHA512 | 56f486ca2dff3a94db51696f402d73b43b9f7adc576299c7fca1472dd1194c03cc36c9933dccb94579aaf87d6943c0b108a26a09b269f8fab07bec26067a9ac7 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
| MD5 | 80d93d38badecdd2b134fe4699721223 |
| SHA1 | e829e58091bae93bc64e0c6f9f0bac999cfda23d |
| SHA256 | c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59 |
| SHA512 | 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
| MD5 | 80d93d38badecdd2b134fe4699721223 |
| SHA1 | e829e58091bae93bc64e0c6f9f0bac999cfda23d |
| SHA256 | c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59 |
| SHA512 | 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
| MD5 | e801c5847f5f9d207db53aaaf5c6f3a2 |
| SHA1 | 8e6818ce66555e2cca92e5c5f32551fb4a91645e |
| SHA256 | 196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03 |
| SHA512 | 303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3 |
memory/1332-531-0x0000000000060000-0x0000000000448000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
| MD5 | 48a4cf795b53e38a621f559719e4bf93 |
| SHA1 | 4fe13aedde7fc87b1387b89d7dc74910242f8629 |
| SHA256 | 99e412ed73d915a78ae565b0e5542ffa6b4dc1bae8ab36b25134f41e90caafe8 |
| SHA512 | a674944f1a09f3d90af1fda23cf8bd5c06925865a7f4dda41b469a1b468e17af66981295aacd42b3ad5d3eb535d18dae471e7140149d29b5904f1aea71c2affb |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
| MD5 | 51be149c8e20df63087c584165516ecd |
| SHA1 | feabbb95b65e6929f086266b06ee1cfef83539a7 |
| SHA256 | b949eb246d81688efea07a7655652107ad435f37d493d93dd68c88a9fe6f3e33 |
| SHA512 | 6f24e4caafd6af85c2f8641d7f2b066dfafa7d6abb512fa62f3642eaa42b549692b15043a3bf0e13cb1fae377fc1d3139dcf5cea3d4def24de197f75297e17f0 |
memory/1332-580-0x0000000000060000-0x0000000000448000-memory.dmp
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
| MD5 | 4f7be9736242579cb8afa1af86980dfe |
| SHA1 | 1c486393847996db4f6b78532dd7bd9a0a924549 |
| SHA256 | 9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4 |
| SHA512 | 4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
| MD5 | c00a190340711134584dc004bf18b506 |
| SHA1 | 72bbbf9ab0e5b3fbf825b0a46da1b25641fbf346 |
| SHA256 | db127cc179eb800b489b1d0d014d6d5b5bf04988b23b55ce7b2d108a4852f343 |
| SHA512 | 597ce1ae67201158e554f2e85218f2bb3321d0b47593c845d5130d80f7817b5ad4b92f30053ef0809315c4f02299edfe09fa67870e11cdc6095390683c0b4d56 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG11.PNG
| MD5 | fe236f1182935dcbcfec9b864cbaba81 |
| SHA1 | ef04ae2217dc030047133cb2a7f5ab7d3b45363d |
| SHA256 | 700ff688c18f645159807cbeac403f852646ad2d1d4a4f3a62410e214c23db96 |
| SHA512 | 59fc89ac345f0f931fbbec93a930d32adae4d6d1b5ec89057988f060ad6bc893d681d957915a7c59d45875275a6d3019d786f71e84401a5ae3d67eba60b2a6da |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG19.PNG
| MD5 | 1c9e24d780e12c81094546db7dba85ac |
| SHA1 | 9a21b5304a8326f4d115f1aeed413191969f82ca |
| SHA256 | 06fd6ea5ff0c58b5dd1ee0ff062e79f66f40a2ab4a0cb3937949781db90b0ad7 |
| SHA512 | a0d66cdf4e11fcb991acf2faae92f91dbb2144694a353a41e450ede37c9de605cedf5772744c90967eddcd88055023ba6e4a9bf1a8a6875f8750aedffcf6618a |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG29.PNG
| MD5 | 9fb892cb12987eb85b303745c00e0005 |
| SHA1 | 4afed97947228ae2eb97579c04681241471101bd |
| SHA256 | 328f2d535ce6695219d02681949aa63be40433be6c51b5727d0b7865440d2949 |
| SHA512 | adf7d20b5096f5c985d931f2e222e388dc34ef8a168b061c9e6250f6ecea944204ec3d616857c4d447985bc5e6a5bc8384e207a00f50ad4a119bf0b3fea13059 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG
| MD5 | 82b5905aadccafd519f5baaba8b4235c |
| SHA1 | ac20c24c050d67ac9cf6d5d012f6c4e3e109dc6d |
| SHA256 | 7b0e92663780a8c412e31cde6f5abc18ed58bb19e3791208e8bd77ff9df2a4e7 |
| SHA512 | 28a04532b8416eec31022493b725150711036cab5b87a7e4a39284ff4799e024abb34b808fc2182318cdad282c75958210d68368222ecc583ac139e6c1f0b802 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG
| MD5 | 96df483076fe5b82a193e0f74ae9427c |
| SHA1 | e2914a84864c5a0507406b7e013c915eb64c5d88 |
| SHA256 | b08c9f5d1d5375498e555889886992e45c805658e7fb18def814a4ea6539c096 |
| SHA512 | 732dc92695e193f359b42bd0eea7310406fade281ab3965727ca22b707ccedbae4c7f7706597b8b23ba93f9c259229e9c14a1d1efd959c6acb17905b36d52769 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP
| MD5 | 0b445ace8798426e7185f52b7b7b6d1e |
| SHA1 | 7a77b46e0848cc9b32283ccb3f91a18c0934c079 |
| SHA256 | 2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6 |
| SHA512 | 51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG8.BMP
| MD5 | d2b43decae0a14deb90423bfb687dc63 |
| SHA1 | c191705fcb927d476d4fc639860bd52e324a274c |
| SHA256 | 3266fb3a33a97fac7d71652129865c3d0dd06e70af6ed5a3b2506d842eb69e70 |
| SHA512 | 3cd903b0c4590e25502cd0f91b678c1e798989211e174d5a6dbfd52b343a426b867204979cc078a4919d63a4c4401c4f8eaa295227cec0ccc043c7e285d3d2df |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG54.PNG
| MD5 | f77565ceb1fdad8d7eb1b0a5bfac2206 |
| SHA1 | 0cdd715372c5e59cea9784b3723cc7571a08a791 |
| SHA256 | 926e2ea2f76a728d04e792b0f3959ce71c09509769f6d0e4ce0c947888750bac |
| SHA512 | 7001b182d9a92e25a4cac3c36f3c8546679ad46a612ac52d946b798cb129be026c05ef62259fd9b61eab91557198ec693c9c87ba8b7e23b3e7ab6dee1152ee04 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG
| MD5 | f2664610dabb317dfe1120518e323887 |
| SHA1 | 33f8a173d6a0d4b7ecd4b5be9fd052795d689919 |
| SHA256 | 67d18f4a1cdf8906751fed972deb353a773101fea9c62929e434cf4a31124cc9 |
| SHA512 | 16ef6bd74c99e4c805ddc53d2cfb6ea3913f8e78ca674e3f61c3b49510c40d7b2b7a96f80e72dd428a28334deebe6859f59d3fdd40e44a0356224695c8cb8eb9 |
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG73.PNG
| MD5 | 6d9cad201627bf9b04e0ca95d8b1cbdc |
| SHA1 | 9bc353075f733d583e7a7258064df4f601f5c59e |
| SHA256 | fc6960c7e3a746b86faf4cf6a84e1369367485cbe0814573444807576f81ea0d |
| SHA512 | 5f51c62de85c36cd842cf9666d78c946306a616f93e4ab55b8eb0fc64b218c1088bbf30f7abf72bcca354a0830abd9d8c004ecdc2aa88ce50657daa8afe6abd9 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG
| MD5 | add45fcce9e1d8992e60401842562c2e |
| SHA1 | 7869dc6ad6116e2c864f32b959a489ee4100aa2e |
| SHA256 | 4c9e68ac4cebbfde2f2f5a9318b597825f3d7a41f32cd288e3fa964b95a69fff |
| SHA512 | 2f98fc864d4bf46c8595f94c4296e6d4213d90591ee197679b2c4f5f4a27b248a52a941b811fceca2f8d32044d42dfe589ec981baaba86a7e4d844d687d048fb |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG108.PNG
| MD5 | 8691619d3729db635b36abf4cb92b722 |
| SHA1 | 5f65a27c0b8d2a25a3c107eadcde937a6c9620b1 |
| SHA256 | 386db08587c847acba938e16a37f345f8d95cc1c77ed562b3c2cc71c1ccbfc1c |
| SHA512 | 0f2e192e6f23a512c7e0b75ecf54bfe8cdfcd4c18f48cb4a4ccbb879881ece3308e1fb97891583f1248c2a833c36509e8e1b81bf39958189676b05d9bd9605a6 |
memory/112-1260-0x0000000000830000-0x0000000000C18000-memory.dmp
memory/112-1284-0x0000000010000000-0x0000000010051000-memory.dmp
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
| MD5 | f10b9a94ea39206c71d6fcdac035a6ae |
| SHA1 | 3fa5155b3b353eca7fa0110670d16150252ab034 |
| SHA256 | 04a77b62afa5da3cec226ed6287a4c96959f58f13d837e5c5496dfeb8113d78b |
| SHA512 | 6e38de842cfabcc6272e790ad9a91ecf8ab881a9e1f2079157e5667710c748ef141fed651a2c640a9c8a7f9d5129913295d8050328647d2a897f0e8fd1633b65 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG
| MD5 | d0283575c47a16d567f02b70550e22a9 |
| SHA1 | 189ce85ca43d3aa4336c2e7719cf206691257999 |
| SHA256 | 44464fa74b703a959540202a83383c33cee05f7affc69898e0d3b541b1e87970 |
| SHA512 | 5b70a22b0a48aa3c6e88123c4d3ff928b02bbe158d63e565bd558aa990482a4d9a98e710ec3dded8fef6042eedb5a1ed62ffc632fe9d102a9cb49342727c515d |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG
| MD5 | e0901ba1513ace1b39991bfa0b911498 |
| SHA1 | 4ce82072212487c2f484bacf1de20e179b3fac6e |
| SHA256 | c571b49df24291011ff427f5f450b673531409c7b4576c34ca3f284ef3c55493 |
| SHA512 | 7ff181c9ea32ca2828ef7d1e34c96c6855dac906108eb680a90da5dd9f2008d815c96969263b3314b7db1a83bf7032da631c878dfa4a99976d8cabf79ea62b8d |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG92.PNG
| MD5 | ea96bd465b5cc6f02a328606810482d6 |
| SHA1 | ffd69d92498767a78431276bf0a77fef17fc8e30 |
| SHA256 | a4dfc277e282e9f917d29fd98b4682e98017c24dc7c8a96b1ae56fe71c5bbe64 |
| SHA512 | 6bced983a20fc1b413f579b6a668f0182ae3283516fedb8b71d3c4345bd6512ca836aac4784589fd5dc2f9ac91c4144f640a4b4e9b9ed84c8962263eb6a0208f |
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
| MD5 | f08d9bbc61cff8e8c3504524c3220bef |
| SHA1 | b4268c667469620bb528c04eaa819d508159b398 |
| SHA256 | 2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb |
| SHA512 | a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4 |
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG112.PNG
| MD5 | 86b43fb6bc008940b9fca56df7edc7db |
| SHA1 | b75507cfc870e267aaef54b5f52ba16a769e94ae |
| SHA256 | d0d41f09676e52c73885fdd628e35997605790aa0339f5d5828466db026a1203 |
| SHA512 | 2181a959e7701dbaf74e94dc5ac30c5c8243c8e8260e0122260f118b4bb5e3eee44b542f73488bf39a5a270a2f62a9e7f64666bf747f8eca450fc767a1defc85 |
memory/112-1537-0x0000000000830000-0x0000000000C18000-memory.dmp
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
| MD5 | f08d9bbc61cff8e8c3504524c3220bef |
| SHA1 | b4268c667469620bb528c04eaa819d508159b398 |
| SHA256 | 2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb |
| SHA512 | a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4 |
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
| MD5 | f08d9bbc61cff8e8c3504524c3220bef |
| SHA1 | b4268c667469620bb528c04eaa819d508159b398 |
| SHA256 | 2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb |
| SHA512 | a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4 |
memory/3816-1645-0x0000000000400000-0x0000000000417000-memory.dmp
memory/112-1831-0x0000000000830000-0x0000000000C18000-memory.dmp
memory/4796-1838-0x0000000002250000-0x0000000002251000-memory.dmp
memory/4796-1845-0x0000000002250000-0x0000000002251000-memory.dmp
memory/4796-1860-0x0000000002250000-0x0000000002251000-memory.dmp
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
| MD5 | f08d9bbc61cff8e8c3504524c3220bef |
| SHA1 | b4268c667469620bb528c04eaa819d508159b398 |
| SHA256 | 2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb |
| SHA512 | a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4 |
memory/6056-1865-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4796-1874-0x0000000002250000-0x0000000002251000-memory.dmp
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
| MD5 | f08d9bbc61cff8e8c3504524c3220bef |
| SHA1 | b4268c667469620bb528c04eaa819d508159b398 |
| SHA256 | 2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb |
| SHA512 | a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4 |
memory/4796-1878-0x0000000002250000-0x0000000002251000-memory.dmp
memory/4084-1881-0x0000000000400000-0x0000000000417000-memory.dmp
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
| MD5 | 76b2d8ead71f34642c02bdeb6fc599db |
| SHA1 | 8b773644d45af50b2eb452c448b79fb90b81a77b |
| SHA256 | a17f88dc46572916dcf14f7a9c1377d09415fe9a4305a905e77632d4431b76ba |
| SHA512 | 4b010c097e31417e6778a084c8495d55f55d72d3ca013c78c4952fac71fc2e7f830a4037eb4ce494faf4dcd3a52f53547d0ea45f98cc56d9ebbb59a145d06fbb |
memory/6080-1889-0x00000000026E0000-0x00000000026E1000-memory.dmp
C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties
| MD5 | ba7fb72b6f75baaf25aa70ea488e4b5a |
| SHA1 | cad4ce3bd4c994700cf684612ee549bb11773724 |
| SHA256 | daa4e7bdf6a07edb1dfee2dbdbbdc9f411115a40e918d33eb2e99f2009757bdc |
| SHA512 | b32788c69c856f1f4e08a65f36df5f3f00ac7736acb27f1f8e9be52d86185852291de07b8ea54cf52916f43607592bc05804302d817ee74fb7aece4ac2d573b4 |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar
| MD5 | 65912196b6e91f2ceb933001c1fb5c94 |
| SHA1 | af799dd7e23e6fe8c988da12314582072b07edcb |
| SHA256 | 663728123fb9a6b79ea39ae289e5d56b4113e1b8e9413eb792f91e53a6dd5868 |
| SHA512 | 60b15182130ddfd801dd0438058d641dd5ba9122f2d1e081eb63f5e2c12fff0271d9d47c58925be0be8267ed22ae893ea9d1b251faba17dc1d2552b5d93056de |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar
| MD5 | 04177054e180d09e3998808efa0401c7 |
| SHA1 | 0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8 |
| SHA256 | 0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08 |
| SHA512 | 3f44a932d8c00cfeee2eb057bcd7c301a2d029063e0a916e1e20b3aec4877d19d67a2fd8aaf58fa2d5a00133d1602128a7f50912ffb6cabc7b0fdc7fbda3f8a1 |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar
| MD5 | 41f66d1d4d250efebde3bbf8b2d55dfa |
| SHA1 | eeb69005da379a10071aa4948c48d89250febb07 |
| SHA256 | 9b9df27a5b8c7864112b4137fd92b36c3f1395bfe57be42fedf2f520ead1a93e |
| SHA512 | 109a1595668293b32376e885ad59e0e4c0e088ea00f58119f0f7d0d2055f03eb93a9f92d974b6dbd56ef721792ac03c889d9add3a2850aa7ccd732c2682d17ef |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar
| MD5 | 289075e48b909e9e74e6c915b3631d2e |
| SHA1 | 6975da39a7040257bd51d21a231b76c915872d38 |
| SHA256 | 91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff |
| SHA512 | e126b7ccf3e42fd1984a0beef1004a7269a337c202e59e04e8e2af714280d2f2d8d2ba5e6f59481b8dcd34aaf35c966a688d0b48ec7e96f102c274dc0d3b381e |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar
| MD5 | 43bfc49bdc7324f6daaa60c1ee9f3972 |
| SHA1 | 6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9 |
| SHA256 | 58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4 |
| SHA512 | 834f2bf4a5b35edffde0263409649aeaf34ca9a742ba511a06bb9b01626f9e774d2d3c8ba91a7905929dc8cd5e6471de29f7d0ab10260ece2af709b7fdbe4bc3 |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar
| MD5 | 39c6476e4de3d4f90ad4ca0ddca48ec2 |
| SHA1 | ee9e9eaa0a35360dcfeac129ff4923215fd65904 |
| SHA256 | 26c5856e954b5f864db76f13b86919b59c6eecf9fd930b96baa8884626baf2f5 |
| SHA512 | fd04c19bce810a1548b2d2eaadb915cff2cbc81a81ec5258aafc1ba329100daedc49edad1fc7b254ab892996796124283d7004b5414f662c0efa3979add9ca5f |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar
| MD5 | 8667a442ee77e509fbe8176b94726eb2 |
| SHA1 | 5fe28b9518e58819180a43a850fbc0dd24b7c050 |
| SHA256 | 734c8356420cc8e30c795d64fd1fcd5d44ea9d90342a2cc3262c5158fbc6d98b |
| SHA512 | b1b556692341a240f8b81f8f71b8b5c0225ccf857ce1b185e7fe6d7a9bb2a4d77823496cd6e2697a20386e7f3ba02d476a0e4ff38071367beb3090104544922d |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\log4j\log4j\1.2.17\log4j-1.2.17.jar
| MD5 | 04a41f0a068986f0f73485cf507c0f40 |
| SHA1 | 5af35056b4d257e4b64b9e8069c0746e8b08629f |
| SHA256 | 1d31696445697720527091754369082a6651bd49781b6005deb94e56753406f9 |
| SHA512 | 3f12937a69ba60d0f5e86265168d6a0d069ce20d95b99a3ace463987655e7c63053f4d7e36e32f2b53f86992b888ca477bf81253ad04c721896b397f94ee57fc |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar
| MD5 | 51050e595b308c4aec8ac314f66e18bc |
| SHA1 | 9c64274b7dbb65288237216e3fae7877fd3f2bee |
| SHA256 | 86f30fa8775fa3a62cdb39d1ed78a6019164c1058864048d42cbee244e26e840 |
| SHA512 | c5c130bf22f24f61b57fc0c6243e7f961ca2a8928416e8bb288aec6650c1c1c06ace4383913cd1277fc6785beb9a74458807ea7e3d6b2e09189cfaf2fb9ab7e1 |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar
| MD5 | 948dda787593340a7af1a18e328b7b7f |
| SHA1 | 9141212b8507ab50a45525b545b39d224614528b |
| SHA256 | ade7402a70667a727635d5c4c29495f4ff96f061f12539763f6f123973b465b0 |
| SHA512 | 6e41ff42f12deedb8da06cbed73d0a9a5389660b7ee058436f8fcb6b14a6ab3105faf8e3f2c007d38ccc85af1e704505b84be5a80d8e68a434aae82b54b85f70 |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.7\picture-bundle-3.7.jar
| MD5 | 904094a40b7d81b12936f43b49952922 |
| SHA1 | 5ccf048dd51a7d0cdd59a1ea6ce2e3b167feacf3 |
| SHA256 | 0cd5746118a3a38b7e6126770bc53c0f7c4641fab786e3d6004a4caace4fc536 |
| SHA512 | 36e2bc67d73319b8f10a572ee3ca6f541aa51ca16c1efea9430111f3a058c9c922a43865b064811117f1c3892e39aee3bc79d7fc5ce20ccd75a13d447ca68911 |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar
| MD5 | 13a8e72587ac6eacfb0986f75e51eb7c |
| SHA1 | 6c3daf89705427f73e6106d2d4d9619e99c5ecb5 |
| SHA256 | 1fcffa073f722737431e2699b1f3ea48b92a3b825397d8f0d1464e4d4d15a014 |
| SHA512 | 134735390415f60d0c42ff33a060bda508e273b35fc9aab271c20ff23f331b51cf3fa36443009e0987049f6bfb22c4098a1473e65ea0349e719fbf4b528f344e |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar
| MD5 | acbc8aa5ba5cdddf5f1e67befe8cc597 |
| SHA1 | 63b4bf89744b532e65c1afa3294743d2b3798f2b |
| SHA256 | 1f46b3a163012f9729905633b5e5e03ce385066ae43138a564729c942f9ca6b9 |
| SHA512 | d974a032d9af451c0dd51fbc0d64840f3e03eb502f40e4ab60d6722913b8a48d44a75752fcff60656e4d19089570a894222959745af11bcdf93ea1544192fee3 |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar
| MD5 | 75a215b9e921044cd2c88e73f6cb9745 |
| SHA1 | 18cc717b85af0b12ba922abf415c2ff4716f8219 |
| SHA256 | 7c764fa1af319b98ff452189ab31bb722ea74ed7a52b17b0c6282249c10a61fc |
| SHA512 | 1a44af2f3f8dbfbf38ad5f71ef11b32d5822d734f77af2cdea419fb6af845e894acb60bffbcebb4533068d86b55a22a8b0f74be20b204c2343bdb165d9c787f9 |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar
| MD5 | 540f330717bca9d29c8762cf6daca443 |
| SHA1 | eed8a2cbf56cc60d07a189a429ead3067564193c |
| SHA256 | 52de1ff2a7556ac2cc4284abd7123bc3d6274210fc4e3b1d9ba90efad5f6a153 |
| SHA512 | a4bcb8bbb43906f42faf1802c504ccc9c616e49afd5dd7db77676d13aaed79a300979ffc2195b680a9c6d5f03466b611b6f1338d824099816aa224b234760f4b |
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar
| MD5 | 8f7e4f1a95a870ebee87ddacc425362c |
| SHA1 | 300bf1846737e34b9ea10faae257ca8fdcd0616f |
| SHA256 | f883b6b027d5e05c53e48e4fe3548715c52dbd590ffa3f52d039574f1a4d0728 |
| SHA512 | 98e30ed27d6ac078450efe5e236117445c93e05eb280399e056816c52643a3a33adce5e3a885ce8488186f38d05e0fb6c65dfcbaa509be8c6047ef2f0870d9b0 |
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
| MD5 | 6e535abf3649d8d9f4f2017565f6ca04 |
| SHA1 | 83e022f6e7e9085f9471a51d2653e10f30b62c53 |
| SHA256 | 311c24a80ce069d6e42926f50dc0cb7efa927f2cb4058ae0e85f9c5251215c92 |
| SHA512 | 302a91e77e7ab6fab1237366355c3249e649baf2bec02bc7df6bd75a63721657377b4e306df76009f877b758d6ff2e610821d0959c09a7be8323ff93f5b7b9dd |
memory/1368-1924-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
memory/1368-1930-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
memory/4796-1933-0x0000000002250000-0x0000000002251000-memory.dmp
memory/4796-1943-0x0000000002250000-0x0000000002251000-memory.dmp
memory/6080-1944-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/1368-1948-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
memory/6080-1949-0x00000000026E0000-0x00000000026E1000-memory.dmp
C:\Users\Admin\AppData\Roaming\.tlauncher\doubleRunningProtection.txt
| MD5 | b3f31d903fb41a1299a6dc103e1631f7 |
| SHA1 | 15bea947fb7a231ebf870197525e8b6f22ed7090 |
| SHA256 | 37f477fd5b6674f2fe6758b21d01ad981a470f54e11d264868ed64fb226b8519 |
| SHA512 | 9657fdfc85c9c886ccc19b52bc6e97d908578c90eaed88279a9177ae13fd78e12403fdaa313bfffea71940605a72b580f83dbf8af04432e08cdccfc4ba985c72 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\83aa4cc77f591dfc2374580bbd95f6ba_6d187d53-139c-415c-b71c-a4b59992e636
| MD5 | c8366ae350e7019aefc9d1e6e6a498c6 |
| SHA1 | 5731d8a3e6568a5f2dfbbc87e3db9637df280b61 |
| SHA256 | 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238 |
| SHA512 | 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd |