Malware Analysis Report

2025-01-18 22:28

Sample ID 240504-lss1wsad5z
Target TLauncher-Installer-1.3.7.exe
SHA256 9d95e947dbd2a170fa8900a06982f361deeb55012ed8b4087ccc9bc188c25cab
Tags
adware discovery persistence stealer upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

9d95e947dbd2a170fa8900a06982f361deeb55012ed8b4087ccc9bc188c25cab

Threat Level: Likely malicious

The file TLauncher-Installer-1.3.7.exe was found to be: Likely malicious.

Malicious Activity Summary

adware discovery persistence stealer upx

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

UPX packed file

Loads dropped DLL

Registers COM server for autorun

Enumerates connected drives

Adds Run key to start application

Checks installed software on the system

Installs/modifies Browser Helper Object

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Uses Volume Shadow Copy service COM API

Modifies Internet Explorer settings

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Modifies Internet Explorer Phishing Filter

Suspicious use of SetWindowsHookEx

Uses Volume Shadow Copy WMI provider

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-04 09:48

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-04 09:48

Reported

2024-05-04 09:54

Platform

win7-20240221-en

Max time kernel

354s

Max time network

316s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe"

Signatures

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe N/A
N/A N/A C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe N/A
N/A N/A C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0033-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0042-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0040-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0067-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0071-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0030-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0040-ABCDEFFEDCBC}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0038-ABCDEFFEDCBB}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0074-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0031-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0066-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0089-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0031-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBC}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0055-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0014-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0027-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0034-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0041-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0037-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0034-ABCDEFFEDCBC}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0054-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0053-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBC}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBC}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\"" C:\Windows\system32\msiexec.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\WindowsAccessBridge-64.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File opened for modification C:\Windows\system32\WindowsAccessBridge-64.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre1.8.0_51\bin\awt.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\kinit.exe C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\WindowsAccessBridge-64.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\cmm\sRGB.pf C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\jfr\profile.jfc C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\klist.exe C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\msvcr100.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\policytool.exe C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\javafx.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\splashscreen.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\fonts\LucidaBrightItalic.ttf C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\security\java.policy C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\server\Xusage.txt C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\t2k.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_sv.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\plugin.pack C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\THIRDPARTYLICENSEREADME-JAVAFX.txt C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\ssvagent.exe C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_pt_BR.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\javaws.jar C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\jfxwebkit.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\management\jmxremote.password.template C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\security\java.security C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\jsse.jar C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\ext\meta-index C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\Welcome.html C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\jawt.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\mlib_image.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\sunec.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\psfont.properties.ja C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\dcpr.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_ko.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\management\management.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\tzmappings C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\dt_socket.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\gstreamer-lite.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\ext\cldrdata.jar C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\ext\zipfs.jar C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\rt.pack C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\hijrah-config-umalqura.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\security\US_export_policy.jar C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\server\classes.jsa C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\npt.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\cmm\PYCC.pf C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\ext\nashorn.jar C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\jfxswt.jar C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\jsse.pack C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\java.exe C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_zh_HK.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\[email protected] C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\release C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\THIRDPARTYLICENSEREADME.txt C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\jabswitch.exe C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\prism_es2.dll C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\flavormap.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_zh_TW.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\deploy\messages_ja.properties C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\images\cursors\win32_MoveNoDrop32x32.gif C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\bin\javacpl.cpl C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
File created C:\Program Files\Java\jre1.8.0_51\lib\images\cursors\win32_MoveDrop32x32.gif C:\Program Files\Java\jre1.8.0_51\installer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\f773db5.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f773db1.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f773db2.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f773daf.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f773daf.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA201.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f773dac.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI451D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI7EA6.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f773db2.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA0E7.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f773db5.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f773db7.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f773dac.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA281.tmp C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\msiexec.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\msiexec.exe N/A

Modifies Internet Explorer Phishing Filter

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PhishingFilter C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 88011755089eda01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_51\\bin" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_51\\bin" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files\\Java\\jre1.8.0_51\\bin" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420978019" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4B5F-9EE6-34795C46E7E7} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8EEF7DE1-09FB-11EF-BAF4-4AADDC6219DF} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_62" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0048-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0049-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0004-ABCDEFFEDCBC} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBA} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0056-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_56" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0083-ABCDEFFEDCBC}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBC}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0043-ABCDEFFEDCBC}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0082-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0082-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0066-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0075-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBA} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_11" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0050-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0036-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBC}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0082-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0071-ABCDEFFEDCBC} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0075-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_75" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0017-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0086-ABCDEFFEDCBA} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0055-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0001-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0007-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBA} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0024-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0046-ABCDEFFEDCBB} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0057-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_51\\bin\\jp2iexp.dll" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0021-ABCDEFFEDCBC} C:\Program Files\Java\jre1.8.0_51\installer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files\Java\jre1.8.0_51\installer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 3940 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3940 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3940 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3940 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3964 wrote to memory of 4028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3964 wrote to memory of 4028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3964 wrote to memory of 4028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3964 wrote to memory of 4028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3964 wrote to memory of 4028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3964 wrote to memory of 4028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3964 wrote to memory of 4028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3964 wrote to memory of 2912 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe
PID 3964 wrote to memory of 2912 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe
PID 3964 wrote to memory of 2912 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe
PID 1552 wrote to memory of 2552 N/A C:\Windows\system32\msiexec.exe C:\Program Files\Java\jre1.8.0_51\installer.exe
PID 1552 wrote to memory of 2552 N/A C:\Windows\system32\msiexec.exe C:\Program Files\Java\jre1.8.0_51\installer.exe
PID 1552 wrote to memory of 2552 N/A C:\Windows\system32\msiexec.exe C:\Program Files\Java\jre1.8.0_51\installer.exe
PID 2552 wrote to memory of 3136 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
PID 2552 wrote to memory of 3136 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
PID 2552 wrote to memory of 3136 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
PID 2552 wrote to memory of 3136 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
PID 2552 wrote to memory of 3136 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
PID 2552 wrote to memory of 3136 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
PID 2552 wrote to memory of 3136 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
PID 2552 wrote to memory of 3940 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 3940 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 3940 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 2240 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 2240 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 2240 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 1908 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 1908 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 1908 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 448 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 448 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 448 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 1496 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 1496 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 1496 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 2320 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 2320 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 2320 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 576 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 576 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 576 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 1224 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 1224 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 1224 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
PID 2552 wrote to memory of 2540 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
PID 2552 wrote to memory of 2540 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
PID 2552 wrote to memory of 2540 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
PID 2552 wrote to memory of 1792 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe
PID 2552 wrote to memory of 1792 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe
PID 2552 wrote to memory of 1792 N/A C:\Program Files\Java\jre1.8.0_51\installer.exe C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe
PID 1792 wrote to memory of 1652 N/A C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
PID 1792 wrote to memory of 1652 N/A C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
PID 1792 wrote to memory of 1652 N/A C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe" "__IRCT:3" "__IRTSS:24078146" "__IRSID:S-1-5-21-1298544033-3225604241-2703760938-1000"

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3964 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe

"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files\Java\jre1.8.0_51\installer.exe

"C:\Program Files\Java\jre1.8.0_51\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_51\\" REPAIRMODE=0

C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe

"bspatch.exe" baseimagefam8 newimage diff

C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe

"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\deploy.pack" "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar"

C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe

"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\javaws.pack" "C:\Program Files\Java\jre1.8.0_51\lib\javaws.jar"

C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe

"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\plugin.pack" "C:\Program Files\Java\jre1.8.0_51\lib\plugin.jar"

C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe

"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\rt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\rt.jar"

C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe

"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\charsets.pack" "C:\Program Files\Java\jre1.8.0_51\lib\charsets.jar"

C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe

"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\jsse.pack" "C:\Program Files\Java\jre1.8.0_51\lib\jsse.jar"

C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe

"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.jar"

C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe

"C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.jar"

C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -Xshare:dump

C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe

"C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe" -wait -fix -permissions -silent

C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -classpath "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar" com.sun.deploy.panel.JreLocator

C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe

"C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_51" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXIALURqYXZhLnNlY3VyaXR5LnBvbGljeT1maWxlOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcc2VjdXJpdHlcamF2YXdzLnBvbGljeQAtRHRydXN0UHJveHk9dHJ1ZQAtWHZlcmlmeTpyZW1vdGUALURqbmxweC5ob21lPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcamF2YXdzLmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcYmluXGphdmF3LmV4ZQ== -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==

C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe

"C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe" -wait -fix -shortcut -silent

C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe

"C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_51" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXIALURqYXZhLnNlY3VyaXR5LnBvbGljeT1maWxlOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcc2VjdXJpdHlcamF2YXdzLnBvbGljeQAtRHRydXN0UHJveHk9dHJ1ZQAtWHZlcmlmeTpyZW1vdGUALURqbmxweC5ob21lPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcamF2YXdzLmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcYmluXGphdmF3LmV4ZQ== -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding F35E1CDFC1520591D031F449A5C03456

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\SysWOW64\cmd.exe" /c del "C:\Program Files\Java\jre1.8.0_51\installer.exe"

C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe

-cp "C:\Program Files\Java\jre1.8.0_51\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus

C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe

-cp "C:\Program Files\Java\jre1.8.0_51\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30

C:\Windows\system32\msiexec.exe

"C:\Windows\system32\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\AU\au.msi" ALLUSERS=1 /qn

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 8951C0A4AD857112DC47761BFCA346CE

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.8.0_51-b16

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"

C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl2.tlauncher.org udp
US 104.20.37.13:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 java-for-minecraft.com udp
US 172.67.143.19:80 java-for-minecraft.com tcp
US 172.67.143.19:80 java-for-minecraft.com tcp
US 172.67.143.19:443 java-for-minecraft.com tcp
US 172.67.143.19:443 java-for-minecraft.com tcp
US 172.67.143.19:443 java-for-minecraft.com tcp
US 172.67.143.19:443 java-for-minecraft.com tcp
US 172.67.143.19:443 java-for-minecraft.com tcp
US 172.67.143.19:443 java-for-minecraft.com tcp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 172.67.143.19:443 java-for-minecraft.com tcp
US 172.67.143.19:443 java-for-minecraft.com tcp
US 8.8.8.8:53 javadl.sun.com udp
NO 104.110.22.225:443 javadl.sun.com tcp
NO 104.110.22.225:443 javadl.sun.com tcp
US 8.8.8.8:53 javadl.oracle.com udp
NO 104.110.22.225:443 javadl.oracle.com tcp
NO 104.110.22.225:443 javadl.oracle.com tcp
US 8.8.8.8:53 sdlc-esd.oracle.com udp
US 184.30.156.124:443 sdlc-esd.oracle.com tcp
US 184.30.156.124:443 sdlc-esd.oracle.com tcp
US 8.8.8.8:53 javadl-esd-secure.oracle.com udp
NL 92.123.165.224:443 javadl-esd-secure.oracle.com tcp
US 8.8.8.8:53 rps-svcs.sun.com udp
US 2.18.190.79:80 rps-svcs.sun.com tcp
NO 104.110.22.225:80 javadl.oracle.com tcp
NO 104.110.22.225:443 javadl.oracle.com tcp
US 8.8.8.8:53 www.java.com udp
NL 23.62.61.163:443 www.java.com tcp
US 184.30.156.124:443 sdlc-esd.oracle.com tcp
US 8.8.8.8:53 sjremetrics.java.com udp
IE 66.235.152.225:443 sjremetrics.java.com tcp
US 8.8.8.8:53 repo.tlauncher.org udp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 8.8.8.8:53 repo.fastrepo.org udp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp
US 104.20.37.13:443 repo.tlauncher.org tcp
FI 135.181.139.36:443 repo.fastrepo.org tcp

Files

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 a14411ca54ffb3b223c21c63a784409b
SHA1 33050df5397e5a44169cf0cd702d776269233f36
SHA256 1c830be41a2d969da6e8e889a1ae23fc41594d5323520e5a39de7f2c32c5dc5b
SHA512 0bc34e8d826e3e026068c52c41eb4617e9bff553c675ff45c525ac4210b6cf878267fdfb4b6796d4de4dad2e8145eb3dd98220ee01957bd3e839e9f8a8d4bba7

memory/2868-6-0x0000000003790000-0x0000000003B79000-memory.dmp

memory/2868-15-0x0000000003790000-0x0000000003B79000-memory.dmp

memory/2988-17-0x00000000009F0000-0x0000000000DD9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 c333af59fa9f0b12d1cd9f6bba111e3a
SHA1 66ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0
SHA256 fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34
SHA512 2f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

memory/2988-597-0x0000000000290000-0x0000000000293000-memory.dmp

memory/2988-596-0x0000000010000000-0x0000000010051000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 dabd469bae99f6f2ada08cd2dd3139c3
SHA1 6714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b
SHA256 89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606
SHA512 9c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar4FAE.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

MD5 83a8f0546164c9ba1a248acedefd6e5d
SHA1 7652f353ed74015e7e78bc9f9e305a48d336b6d1
SHA256 e7c5072ec60d32022b3c818c527ad86f4985837a4f0e9fc6477f54ae86d9f1c9
SHA512 111d11acdaef0036ff5cabeb16ed55bf4c681fa6eb3c006af450a0ebadae3e213a8f3abb0f4a9aecc8e893af7a79b4eb7f74a5fc3743e338c3e3136b5d7f9f2d

memory/2988-677-0x0000000010000000-0x0000000010051000-memory.dmp

memory/2988-676-0x00000000009F0000-0x0000000000DD9000-memory.dmp

memory/2988-679-0x0000000010000000-0x0000000010051000-memory.dmp

memory/2868-680-0x0000000003790000-0x0000000003B79000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP

MD5 f35117734829b05cfceaa7e39b2b61fb
SHA1 342ae5f530dce669fedaca053bd15b47e755adc2
SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
SHA512 1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP

MD5 f5d6a81635291e408332cc01c565068f
SHA1 72fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
SHA512 33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP

MD5 3adf5e8387c828f62f12d2dd59349d63
SHA1 bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
SHA512 e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be

memory/2988-731-0x00000000009F0000-0x0000000000DD9000-memory.dmp

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 2dae3de14a845ea813402de06b365026
SHA1 b05af4568ce7b2fcc44cff52f8bbde93b98c71b7
SHA256 3fc25f066ba624cb976d0212725ed6f8c5f036d859e30944f8235a73bc2cf3e2
SHA512 7bf62dfc2ec5dcb5c5506333aafd700a4c3522982eaa1474c069c0c43fa643c2ae0d2e31c33067f1ff54ebb0ae2137cb53b794957005b3672c3da1895f91d9ed

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNG

MD5 959f2ffb5f3bf8e7aa4daac8fb95bf28
SHA1 518a200b0d360ae76aa7caff799a5db2344a32ba
SHA256 3e951323e17e502de5b3d342924a576d51a05024a73657fdb8a8a9f07c0b59c8
SHA512 9b67adb6aebd97ba552933b74b3acc0210822cc64ab9876fba7e648a826b53c93d9b9e30d616c33454233d2db09c3c1a202bfb15c99932399e08f09786a2b276

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNG

MD5 423967f5de5e38e936f1fe20f7e65e8d
SHA1 959069f5c157c5cdee86a55c9f7c4726e350a417
SHA256 8dd76cdfd0239b409208a873c5b7e533149a6154b31c04194b36920c4dcff37b
SHA512 d6590a8e7f5c6e30563b5433eebda5d5d26868562edc2c927360cd3a13e68f30b78f9041da4d20f40ad577fb7e4c1c107c206dfcb25702833c5466c7795087fc

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

MD5 e90db569b60630c31581fb0ce2df9c55
SHA1 7f1bc71940f580c79a43e94be3d379a46039f7a2
SHA256 89214216b91f315878142066f3febe8573affdc661bac3660c10377e861fdfe9
SHA512 5a0fce78f0f9d304fdfbc41bf40d9405c45436ba67aba93cbe32b840e769e809c3dbbb73f61b434c9faa69aee8dd82d4e7c2464aa2c7baab26862fd824e3968c

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNG

MD5 f48058f1c26ac266bf01960e271d1dc7
SHA1 d06afaeb6e73c7f0b88b45b60fda28200e62d39b
SHA256 fc9e01e0b4d11cee2696d6d51729284d775bbce53bdb0a0f3bd376f10b145a23
SHA512 82904ba2c918506b94d4ca66a99ffabee3120005afc6be5e37a651444a66710bc5b922ccf1dd214c958f7a59da50084d14ad9d011de39c5257c0463c7540b3e0

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 054aecf886611935c82cb961eb3ac31c
SHA1 7c79d08bd6cbaa60db2a645ebe542f670dd18fd9
SHA256 d92b458492dc534ee4d0ba3c24166164b14955c45329401885f64a2fb8e6ecb3
SHA512 0b82aceaec2a2a6528b22639d924cf1b21b5cb43f3a78026c020bed4e170398a5382951c1d043a2b976915aeca6f6f9ddfdc2a1d2ba143c7203b8eaa9f29b656

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG13.PNG

MD5 852f2a89033362ca1418da6298630760
SHA1 24c45b20e2284842928b54c04e7826b1d8a1dafe
SHA256 0cfe4a342e9abf08cb0577239fa859194082ca4ce17f0d15b6087cc875f987bd
SHA512 ede225ebcd7fafcb25c34abf4a4e7a90be1df1730b987d0dc4ae571c4e7f08bfe81e3880e484c248670a2d5f0c547f6c4df80f59d8e8d9a250d9831d9e74556d

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 f32af479807202170280f128b411a936
SHA1 daf0a3c6b7ae9749f17dd9588d6b57fefba83b9b
SHA256 8704d49a3ae2363ff0bddf17480cba0b2980b37f2cde0f554aa29137eaaf9549
SHA512 601ee42354b6b52a268182fff6c6742398ee812223e8c8b6694ff4f67816269313e05a41b8b765c539d55196c9ffdb74c30531ea1c41837de8b3cfc04ae76b1a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG

MD5 c1fddde8d0f33b9aae08f34d2a3f5202
SHA1 3ce3d305b1ec3ee2f2d8346a67be410c59aa38c6
SHA256 9d588ed0ca63dc9475e602ce8a5a51ea527b1f4dd8c5f4376cd0fc7038cf3174
SHA512 2d33e9133ac1c857aca5dc43af45af14fdd6b46b2103fdb45865e72ccc07a198a33a87a72ef97db9ff40563b446cc22a8828403c852b3709a1a9cfbafd2edb7e

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG

MD5 ad0f62646ec79e11f88d672609f4f796
SHA1 53bbd348d7aea9a1fbf736167dbd1df3e1f92946
SHA256 72add1e28bf7b31746d84fbb7d36119e4a7af7d0da7c682fe767d6fdc51e6a44
SHA512 39e7f06053c6e7c44042c7fded82e10212d77b0a15e8d5488be94412acf2c56825775f5d634e29b229af4171ec9e2ad2c6160d7b6ca39d0ffa4784a343470dfd

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG

MD5 d403eb7fbc203d21fc399f4cef18508a
SHA1 5db578f74e412038a446ef23e067514919d25f54
SHA256 46eb5c27cca4d0fb3fcb59c71cdc8dfc8e90a5932f79118fa9bbf585f5ff0fa3
SHA512 0e0e228313d81f855781de544d867801ca2a8adc1d6c8a6819b6717db672ee181c665da01b88003b130cb36412f321b13a1fd8e50384d939a0f1439a95a92874

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG17.PNG

MD5 daf480f723b23d6cfdc9141c80c788ff
SHA1 437e589c8eb2b32e33a2b80f5d3db9607dec48d0
SHA256 03a60271f823e4cb91e8a61d72b317e0ed0c569102bf928bdb8ced75a9b4d89a
SHA512 b41642ea30721a37b5ce78f8ad920be7ea374d220f2308918b88f8555272cb37bd0696b07103bbf79e8736d5dbd24fbe0b8ba2c13f19328c3b610022ac7aa24d

memory/2988-1828-0x00000000009F0000-0x0000000000DD9000-memory.dmp

memory/3940-1831-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f398d73e680e1b3cf5562b46b64b5cce
SHA1 12ce4059450890a020494a16b5cb3be75fef56bd
SHA256 abec624e798764534d910eefa1f4876c5d4f4292bb9383ab492894953449eefa
SHA512 243260e54dfb4f73d427dfacd58c5b3e39c1605a863a42af08ab8444d89bd8ef54765d8d182fa729e746b1757fb0348587ce5381d9115cbb4896c89a11a00418

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\jre-8u51-windows-x64.exe.gl7c2mw.partial

MD5 b9919195f61824f980f4a088d7447a11
SHA1 447fd1f59219282ec5d2f7a179ac12cc072171c3
SHA256 3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01
SHA512 d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0c3fdb5fc524c0afa9d828c95c19457e
SHA1 13022e298ab0470b8fa1a108d0a98592b2c0c253
SHA256 0e05455494157d457d1f18dbd6d6a1ff7fa1e9fd207e9cc6e05d3a1114d3e5cb
SHA512 88a026f76e63ccbdc512643af304e70712db365eb9ad810d0239c0c706307571906345761f9184b825cbb7bec7ad997abcb1bcd06243d7bdb43ceb97e5640d8b

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 cd47539d917c5654963c9c13a80936e8
SHA1 e06cdf3111651306e8cd0da420cb84d0370343d5
SHA256 5a4c1ce335e0929e6a087e143148109fc8b680a5522754a5fc3048195343f394
SHA512 8638dcfc69cee9556ca175438a3cceea3ee7fd0626a01aac82b518aeb73915092c03a3970937b2f0fc70c174e5e737b75a9725476fb606bf03e46828a28469b4

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\17VFMSD0.txt

MD5 8950a2075b67748ebd224de4398e355e
SHA1 c47a7e10a8b2fe7c8344c4395a7d4ec92d20d178
SHA256 5702a5466ce523f2cc55438c467f7f4a95324b376804e3bdaf2ca9c121ba45d7
SHA512 3e225aeb7258dae359e9a11f2a0e7040e42c2fc4c1d92035348c83d4129833df6b8588386e15b2f04e32248efbe6d2d5ea9c2728da56e5a62a950251d4f1f1c6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71c9416b602012f4289712e7cdd20bda
SHA1 9dcb34924f9cb810127b13102534a1763f5caffb
SHA256 fb90b2e1733b085d0f159d08cde2185d9e8f47a8b0af90a8b3ae5de664e118b3
SHA512 4100bb65934ff57fd082d2e48b7a85beb18ef22e8d2fb84b44b6dc5fd733fdfc50c36ad3a5f16676644fe8411e43f5dcf2e71101f7971435bb4feabe2821cd3f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 5a1b7dc69422517f419c1d346f0e8ca7
SHA1 176b927a09c0a65a73eef2250773ea6fe87ca092
SHA256 54a22bcde4bb6d75f00df67ae39634046a30e9787a1c28b2c0d6363b85b27028
SHA512 7e28633267fa355bb62660f354ca2cd9f5ab9bd56f952cf4d230121182f62dd5c3939dd92902b06609f1058f7ed7b050bff07355840df9433b3efff14814719c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 a4560bb7109b605b57e8de293445ae52
SHA1 106750029cedd32a180dafc295ca6ac9f28b9d1a
SHA256 0b6d98928b81c7c867299f9dceeb3c6c2dc7b1bb3ecccdad1dc3aada0c737b79
SHA512 ab21f49ec26228cd75af896519e8d73a5277d2c3b75c18b671ca446225093d14ab69c8ef65c46ba7ca643a4755c97599124d62651055c6475965dff186763f98

C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.8.0_51_x64\jre1.8.0_51.msi

MD5 1ef598379ff589e452e9fc7f93563740
SHA1 82ad65425fa627176592ed5e55c0093e685bfeef
SHA256 d4bdc230eaebefe5a9aa3d9127d12ac09d050bf51771f0c78a6a9d79a1f9dbf2
SHA512 673f4b08fc25e09e582f5f7e01b2369e361f6a5b480f0aa2f1d5991f10076ba8a9d6b1f2227979b514acc458b4fdc254fc3c14173db7e38b50793174d4697f23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB

MD5 cbed24fd2b55aea95367efca5ee889de
SHA1 946f48b5c344fd57113845cd483fed5fb9fa3e54
SHA256 1dc8a0fcbe260b77adfe5ad9aaac543239b2a0d9f4e1f3c2657beee4376ffee4
SHA512 c504a11ea576f8ce14de26a0617e22e71e14db0f1dadefc187ce94e4a35a83743c743824e3629899c262aae4772bb86a0ee5bb643db20645483f0c376215ec6b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCE

MD5 ccde5242b05410fc389ef55055aef628
SHA1 1cf2823683e06612009f39bf6579c1d9f781cd22
SHA256 bf5c6c21f7360904039a89d7d0f45f19229df0409ec8d73f5f510016bbab53ca
SHA512 fa17b282526a19fd27da18ed479fcea82149e85b5eb220e75d80612b75cc3bd4543e61451443f46c77c306d7ab4f05acb15ec6700c4875fde9addcc142a72998

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_1E65FD33F74047223AF4D58CBFD34BCE

MD5 5c66da6658aaec53fde5f7ec2fc34227
SHA1 e2ef0f7c799e842dd1938b542a8cc27df4163a02
SHA256 dbbe59476b4d8d48b8471a3cad4a6fa453aa62bb953f1c3800e4b2768518619e
SHA512 196b8f090210d817f478b1e5d116a42dfde789146a844bc32cc8150f761a2ff089b601682a676e57a00309f9bc803ceab17ee8a46453a65a39303a4d42742b20

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB

MD5 8858b77d034c143ba94ee69e25cba8b8
SHA1 89e6a52717e2a349a6f5e914d22e738a39eaa887
SHA256 1acde7eb73469a14a78322c6716c3aad0a57935550ae42f5339c43552dae9377
SHA512 41045796943d2ab5ecbc25766c5f0040a4f9b236fa0fdf8f0eafca012b63741b1065e271abe922d32b4c466ed3592224e98b03d95fbedb6435f8bbc30b3eaf39

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E

MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E

MD5 f5b580ffa6dfc6f40ee32f07971ec0ef
SHA1 bda7d6b7398bc03185a3bc75ee3043efec6b4ecf
SHA256 6899cafe38f736a9c3d688a47e48cfd11e2f484044271a8d07cccee3873484ba
SHA512 86ebac884e27cc7b3cb390fd6ba469453a0d507b53243b15bd7baf51504f0c7ea13dbef57cb4c4f8b350607c223c9776ae55c35f7d548114f8ce2ad65c80ae46

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

MD5 4842e206e4cfff2954901467ad54169e
SHA1 80c9820ff2efe8aa3d361df7011ae6eee35ec4f0
SHA256 2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e
SHA512 ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

MD5 a2f35216d4d140b53af244f08281e14d
SHA1 3e391bc869f8a038c2bb264223d188d067d1b0e6
SHA256 31da569e659e5756e051cee40e39df68b23a4460b817b421a9ecf8770cb829fb
SHA512 e261a76b396efe79a0974747142beaf068e9903d08a3f93f52587e0442cbfdd5956ca2579f9bfb02f0ba7c860af0879c4ab49701e2c88a06df5f93b57bd35256

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 2e95de250482f1c85206e76a86c147f8
SHA1 9bad1aa3ac272420eb563445fd214833a0c6073c
SHA256 a46971c56753b1de6e9a9703bb6eccad5ba7de86550d1ed967c7494d34ff1557
SHA512 c66dbaac939c0d30f51e7c25b5a45d980bc7d272f666bc258c013f14814c241306ffe9a9d60c83f825fb350b137a033d35c26bc733c2fea4fcabce8981238967

memory/3136-2112-0x0000000000400000-0x0000000000417000-memory.dmp

C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe

MD5 2e7543a4deec9620c101771ca9b45d85
SHA1 fa33f3098c511a1192111f0b29a09064a7568029
SHA256 32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1
SHA512 8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

memory/3136-2119-0x0000000000230000-0x0000000000247000-memory.dmp

memory/3136-2118-0x0000000000230000-0x0000000000247000-memory.dmp

memory/3136-2117-0x0000000000230000-0x0000000000247000-memory.dmp

C:\ProgramData\Oracle\Java\installcache_x64\diff

MD5 d417682702b140d7131851bae877f046
SHA1 aa78da727e8a62c839a9bb6f7a93b48d3a04be70
SHA256 3b3657c83e4f588f0e759cd46e99309cece2ebb54af2c377f9dc087ec764fda8
SHA512 9e107b7f61e42410807aa1e6761ac7adce412846f69ae8e2e21b147e39d1a95d41367e21624381750eb11c77322206c4d869a477e5442e8323405c85854c03cd

memory/3136-2124-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe

MD5 5b071854133d3eb6848a301a2a75c9b2
SHA1 ffa1045c55b039760aa2632a227012bb359d764f
SHA256 cc8d67216b1e04d7a41bf62f9c1088cd65a3d21796c5a562851e841b3afa28cf
SHA512 f9858ec0a1bfb7540512ede3756653d094ff9fe258d13a8431599280db945e8d9ea94c57595c6a21aa4fbfcd733eea9b887bfcf87e84279a7e632db55380920c

C:\Program Files\Java\jre1.8.0_51\bin\MSVCR100.dll

MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

C:\Program Files\Java\jre1.8.0_51\lib\plugin.pack

MD5 538777ddaa33641aa2c17b8f71eed307
SHA1 ac7b5fdba952ce65b5a85578f2a81b37daed0948
SHA256 9948b1c18d71a790e7b5a82d773fea95d25ab67109843a3f3888f3f0ac9d1135
SHA512 7a5877e0eaef6424ea473a203184fedb902cd9d47df5d95d6f617ca4efa1162f0ffd418e9bc6b7492f938cb33fc6384907237487d6ad4f6d0d2d962402529d8b

C:\Program Files\Java\jre1.8.0_51\lib\rt.pack

MD5 f0177701b36068c9a2bb4924dd409fa5
SHA1 71e4b32c95e20dd565a6603d3de3819eb4f19d33
SHA256 93c1e08034b68e12d78005c2950145595327477c17c1f716248d3e16313b4eec
SHA512 8e198bf60dbb95f38bf5eca67c9b7cd4fe9920890ba3d569e08de59b38c1b00830a0a37168fd74c874df86b7ff0915c8b69adb1591432b42b5ff35e5885e6641

C:\Program Files\Java\jre1.8.0_51\lib\javaws.pack

MD5 5a83bc9b3e4a7e960fd757f3ad7cd263
SHA1 f5f308aec7e93accb5d6714c178b8bf0840fb38d
SHA256 0a95ab97c85e534b72a369b3ee75200f8075cb14e6f226196b18fd43e6ba42f5
SHA512 b8e554bbf036d0500686e878597ffdefa8bcd091ab6533eae76fa04eda310cec7cac89b71911f1f81012f499c7bec890ac9032685945f7e5e6b68f7ad3f7430c

C:\Program Files\Java\jre1.8.0_51\lib\deploy.pack

MD5 5cfc3a1b269312f7a2d2f1d7c0497819
SHA1 d048284db9ce7103156f8bbce988b4d9978786b7
SHA256 80ba80d2a6c20deef6e2f3973337e15e22eec30508899ae998bf191ba725db26
SHA512 8735af7c8bc5b48aac42120326a5dee21f98512ba31c57c77b6fc3906b7b1b98e5f22f57a31f26dc3e16abe63a6f15ef2e115c7fc17bbab35e846dc373da9c6b

C:\Program Files\Java\jre1.8.0_51\lib\charsets.pack

MD5 45288142b863dc4761b634f9de75e5e5
SHA1 9d07fca553e08c47e38dd48a9c7824e376e4ce80
SHA256 91517ff5c74438654956aae554f2951bf508f561b288661433894e517960c2ac
SHA512 f331cd93f82d2751734eb1a51cb4401969fb6e479b2e19be609e13829454ec27cec864c57bdc116bf029317c98d551e9feafc44386b899a94c242bc0464556d8

C:\Program Files\Java\jre1.8.0_51\lib\jsse.pack

MD5 168f72fd2f288a96ee9c4e845339db02
SHA1 e25b521b0ed663e2b050af2b454d571c5145904f
SHA256 5552e52e39c0e7ac423d6939eec367a0c15b4ca699a3a1954f2b191d48a034e6
SHA512 01cdf3d8d3be0b2458d9c86976cef3f5a21131d13eb2a1c6f816aeb2c384779b67d1b419fa9233aedd3bbd16970ec7c81689bf2e25a8bebadec5de8e9b5a19f1

memory/2540-2386-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Program Files\Java\jre1.8.0_51\bin\javacpl.exe

MD5 f49218872d803801934638f44274000d
SHA1 871d70960ff7db8c6d11fad68d0a325d7fc540f1
SHA256 bb80d933bf5c60ee911dc22fcc7d715e4461bc72fd2061da1c74d270c1f73528
SHA512 94432d6bc93aad68ea99c52a9bcb8350f769f3ac8b823ba298c20ff39e8fa3b533ef31e55afeb12e839fd20cf33c9d74642ce922e2805ca7323c88a4f06d986d

C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe

MD5 5ed6faed0b5fe8a02bb78c93c422f948
SHA1 823ed6c635bd7851ccef43cbe23518267327ae9a
SHA256 60f2898c91ef0f253b61d8325d2d22b2baba1a4a4e1b67d47a40ffac511e95a5
SHA512 5a8470567f234d46e88740e4f0b417e616a54b58c95d13c700013988f30044a822acfef216770181314fa83183a12044e9e13e6257df99e7646df9a047244c92

C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npdeployJava1.dll

MD5 cb63e262f0850bd8c3e282d6cd5493db
SHA1 aca74def7a2cd033f18fc938ceb2feef2de8cb8c
SHA256 b3c10bf5498457a76bba3b413d0c54b03a4915e5df72576f976e1ad6d2450012
SHA512 8e3ad8c193a5b4ab22292893931dc6c8acd1f255825366fdd7390f3d8b71c5a51793103aeacecfb4c92565b559f37aec25f8b09abb8289b2012a79b0c5e8cb3b

memory/1652-2466-0x0000000000340000-0x0000000000341000-memory.dmp

memory/564-2471-0x0000000002070000-0x000000000207A000-memory.dmp

memory/564-2470-0x0000000002070000-0x000000000207A000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

MD5 5eefb82a3492a51996123e182277ef92
SHA1 f7a6704268d12086c9764149275956733644b8cd
SHA256 2fa2927bf5f252110750606981fe58ee291981bf06fa7aab4395ba32ae49fe7a
SHA512 81ace8757741a7b65e44842151e7c8180c3e6cc7437da130f94d513c7f77871fc14dc877d8901b9c243646b565416890418bc3140fbdfe5ae0b735b5f190b930

memory/564-2508-0x0000000002040000-0x0000000002041000-memory.dmp

memory/564-2514-0x0000000002040000-0x0000000002041000-memory.dmp

memory/564-2515-0x0000000002070000-0x000000000207A000-memory.dmp

memory/1236-2519-0x0000000000180000-0x000000000018A000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

MD5 f973702d22aa6e07926a2b5b65e46e9b
SHA1 2086727d09cab59913058ca5283514dcf00a4448
SHA256 0684398801a843a8e426ee4bd59908713fad05913a41f1cbc9777beaa1149176
SHA512 e92e3997e34a134c114b7a5a2cc08f23c0b34d7ae9712697b55df1affe8df12c01b05069dc9844f9c6711eb57d7ce1c1e6bc466dd1773749a01fc669e36c321c

memory/1236-2556-0x0000000000130000-0x0000000000131000-memory.dmp

memory/1236-2563-0x0000000000130000-0x0000000000131000-memory.dmp

C:\Config.Msi\f773db0.rbs

MD5 30380d7bc2340eedf82b05823f123589
SHA1 92eaae0516297e43800865b686f7a3dfa56ef647
SHA256 4caf827b27f039db014d277023f3676f4cdfbd58e3de9ebd7cbc08661c0a28ff
SHA512 92c13a6dbad588df1b2bcb9b5e186e855116f2acbd5b5a15565b858b96553e993046e0ad8888ef8729ecc0d037ed237c1ed1448247c8aa33d9329c03b24019ab

memory/3520-2612-0x0000000000440000-0x0000000000441000-memory.dmp

memory/3688-2627-0x0000000000230000-0x0000000000231000-memory.dmp

memory/3688-2629-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Windows\Installer\f773db7.msi

MD5 4afca17a0a4d54c04b8c3af40fb2a775
SHA1 96934a0657f09b25640b6ad18f26af6bd928d62f
SHA256 b15d3a450b7b3e5ce3194ab9e518796cc5f164c3e28762ffe36966990dcd2fe8
SHA512 ee76f5fcfdd9c1202fd5abdc2bbde8fb2543cee83265f6d2fb5458d1a086152ff6bdd4bf62a88150d325ea282bd2ecd66dd5f127bdd847cfa69cdb88985a8305

C:\Config.Msi\f773db6.rbs

MD5 a5245712cb9b4b4efb0c6ef569f9080e
SHA1 96cc980ba741fad2cdd1d45e691bb009f722e26d
SHA256 85040070c739b45ac071eec997907ad8f1893ec560e01b10b231cd30b0929c2d
SHA512 38e95384b5582960482862a5abc8dea587f0c4dd6bcae501707ebde305f76544d6eb9b79f0361be28e3cb7c4dd3e1aec79a9f7ecc45235b5fd43622e482c0752

memory/2252-2700-0x0000000000400000-0x0000000000417000-memory.dmp

memory/872-2710-0x0000000000230000-0x0000000000231000-memory.dmp

memory/872-2723-0x0000000001CA0000-0x0000000001CAA000-memory.dmp

memory/872-2722-0x0000000001CA0000-0x0000000001CAA000-memory.dmp

memory/872-2725-0x0000000000230000-0x0000000000231000-memory.dmp

memory/872-2743-0x0000000000230000-0x0000000000231000-memory.dmp

memory/872-2784-0x0000000000230000-0x0000000000231000-memory.dmp

memory/872-2792-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\appConfig.json

MD5 a9bd1871a6a69e12bb017e1375b0a659
SHA1 0cc4c515fea150c982d02fa73acf73cfa68810e7
SHA256 f725e50dc4377a28b06589b028cd3cff58845d5ed882b22b17129c4413f8b9b3
SHA512 0595d54b19805f57a1b09a492c90c4c9f655d6a501179966b1a282b0aec90b27eeba634ee4a54fb9982f80ae046e6feb2b3e2097f14a0a3e051e80c162a83bd6

memory/872-2814-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\2.923\dependencies.json

MD5 24817047786540dd5d8cbfb94132c84d
SHA1 ff45f1ae7748fab985e0580c5746b0327a4b59ac
SHA256 a5584b00241e6aa455dce9c0d584d61f8350a7bc07a4137e9289e23f46878721
SHA512 6e048803859517d052d88d8c96c382d481620c1d930e219051264cb2c4d096b5b68d8e8e66ba2244ef7343df99f120600f8763f67bcf060c3132743eca7934ef

C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\2.923\resources.json

MD5 8ab0113596cd48af76657e53d5d93e70
SHA1 3ab4244668932e0396022372d8f311c62ce1b89b
SHA256 b0a6157bb0f4da765f93d13ca167017144c5eb15955015b0b42f7d7c0b70599d
SHA512 55fb4d7ed644ae5e47ee376b00323199788baf596b493b4959ec4c88bdb37295ee59e34d3a7d4310fc9e35d776e1ae19fcead53c09d3a440dcfec8dc6736b170

C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\javaConfig.json

MD5 e2cbea0a8a22b79e63558273dded5e6c
SHA1 bfbbbba0679adcbcf9e079ed3c7c7a60cb0b2d61
SHA256 10d0f3646be0a7d73942d7bdd1e55c4b8df0c34cad7ad15a9dc23b2932155007
SHA512 a6aa26ff49c911fb4705df1e8e434c72e206b20fdaae0abc529e2734f5db49c75da35c3d75769e0ac1b6795de540de4c7e1089b387217fc58f8b19b023064e5a

memory/872-2848-0x0000000000230000-0x0000000000231000-memory.dmp

memory/872-2855-0x0000000000230000-0x0000000000231000-memory.dmp

memory/872-2862-0x0000000000230000-0x0000000000231000-memory.dmp

memory/872-2885-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 add2c0b66f52d3af1c2fcd8f0c6f203a
SHA1 f65599f480e2a6e1fe78c386de5906a85c9c64ca
SHA256 6faffc63210d43fd26270b7ab7bad528c6e962b0b78a6dff645415306e81b197
SHA512 530381c1f0c328441f402db75b3c5cafc19b636a34fc5aa85e9364324cc18ee6ffec01de44140b41be6ce94c819278c189d366923df7134dd0e880273d24b515

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 57a379591cd5ab071457aefd3725a165
SHA1 76c2a2452f3374ba15da68ac24e3cdfe1751b52e
SHA256 574de93b22b73b2f888565254a963b395eac2627f09d9300ca2db19873206b7f
SHA512 f897ee2b28ce2ac4a3d7ff7ad45b4f974c13b9e4988e4b29cf89944656fff7abe9b3f6752ccb687bc28f0bbb7c59347814ef7fdb45be161599acefd528abab00

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d11307d5e542903320d815e9000a0268
SHA1 634017d68e45c202e50c35c80b56744dc58a2559
SHA256 da112f889163aa0350ac4c6dba82c39666a91e8a22d039308af640685e4955b7
SHA512 e9e83d11935becdf84367e41e48ae0fb825d547a3e5c845a916780fb47faabf67dd98c661d225131c5d90d9289c8774292575fed53b4af740ba142c8c3ed9f1f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ccd29326313197fee4fbd18d9c2e523
SHA1 4468cc99235005cb5cd54d600761e3aaea5f34f3
SHA256 d1588cadd8d600193514f2d42844823eb46a897cfc1e18b4d953add4517cdbe1
SHA512 f799d1a59b3d35bb60b3803cfd88d9864eb0f96cb8828b0745154f71a229f0031819f5158e1867ce931d5cd185aa1f9ed1d74ce88726443fb337a318c2fe8f00

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c447b806fd485ab314f5c3ce97be0401
SHA1 0fb48b5c8caf4d6235d2d5ead2b43cda12ec5163
SHA256 cb059178e74cfe7262ded48ccdea975d9b2029e02a2ce7b0e22551e5481fa11a
SHA512 43e56cac890facc8b91f1faaed6f5efe22e17465d0f15c63b9540e53b97fbccb98721a428b6a96c255257314a831cd310d6abe3e26d727271fd13487466114af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f309766daf1043039b3fb7737ed18aa0
SHA1 72ff17682840d35b12e67442610df9062bf6123c
SHA256 4f6a6e035176e6e3447a88792024ec98129b19e7592079552f7db6196ffad1b1
SHA512 d19a67978345edc3a102145dc1f1600c05ff2b8a73f42536157a7a8e284690d441529f1480048b45c44fc426c8422668b70f1994f7c14192126eae440bc97907

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 8c6737b3fa231fef75a9830cafdd5938
SHA1 a2ed75d29132ac0d398ef8c6beb5d3eaa13b3588
SHA256 2e9e1cce399a6a5413d55488beb8209f6c50e6117ffc141834fc75bcd9878eae
SHA512 2b2fdc93ed3125ef91c93c5774a35c1f7faa3e1f7fbf0d136dc6490cb177a6e037ddb78a573557621676671ce6932106f80361dc0bbf47d7c2e09be9672c0727

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d7e2daecd44d69a67b49d06e3347224d
SHA1 0789f900414cb36dc683cc27c906e622a9f9660a
SHA256 38233fdcb663259ef7cb04116855be53fc664da67693114133e5392deaa17d08
SHA512 05876808bf156bbbadc1774775a0ec7f6f58fef15d72f4ca7d34ea7dca3325dce139909be0e84dcb61e822673bbc81e56dd6efe1078be5f0a69f4c438ac8d4bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6cb16f6b72ed42ffc4644a5c46ae863
SHA1 ff4c187aed42f86db3fcfa613f2470dc144dc2ea
SHA256 d94347cbe17b3e0e4c7ab7c03813b2c12e39f76e3090794f391db3906ae96e5f
SHA512 9d1ebf3bfced10c3a64a948a7f061a9d7222aab86de03aa13e8c9a94d42655d4b6e25485b3dcf39f20f537dc5737c5d27d7e5bb2a13a17a635931c4ceff9d93e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6b83021ce6fb7930c0170e9439a3cfc
SHA1 7b9212c653f10dad70d92525489f39bdc23598bf
SHA256 65d9c2e33b74239a80afb0aa643d6b28a82f3bb78ff628f71a08627d7ce163ed
SHA512 27f554dafa372d255f4427c736c2b487d6bf24f0557ec39973958d1bcaff83b2276954d5e3b46f9fe642c2695d778e98641aefcdfe2671a239725399491486fd

memory/872-3617-0x0000000001CA0000-0x0000000001CAA000-memory.dmp

memory/872-3618-0x0000000001CA0000-0x0000000001CAA000-memory.dmp

C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\COPYRIGHT

MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3

C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\LICENSE

MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608

C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO

MD5 494903d6add168a732e73d7b0ba059a0
SHA1 f85c0fd9f8b04c4de25d85de56d4db11881e08ca
SHA256 0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
SHA512 b6e0968c9fd9464623bfa595bf47faf8f6bc1c55b09a415724c709ef8a3bcf8a954079cce1e0e6c91d34c607da2cecc2a6454d08c370a618fb9a4d7d9a078b24

C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION

MD5 c62a00c3520dc7970a526025a5977c34
SHA1 f81a2bcb42ccbf898d92f59a4dc4b63fef6c2848
SHA256 a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
SHA512 60907d1910b6999b8210b450c6695b7cc35a0c50c25d6569cf8bb975a5967ca4e53f0985bee474b20379df88bb0891068347ecf3e9c42900ed19a1dcbc2d56ec

C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\LICENSE

MD5 f815ea85f3b4676874e42320d4b8cfd7
SHA1 3a2ddf103552fefe391f67263b393509eee3e807
SHA256 01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
SHA512 ddf09f482536966ac17313179552a5efc1b230fa5f270ebde5df6adebf07ee911b9ef433dfbfcb4e5236922da390f44e355709ecaf390c741648dd2a17084950

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-04 09:48

Reported

2024-05-04 10:18

Platform

win10v2004-20240419-en

Max time kernel

1791s

Max time network

1171s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.3.7.exe" "__IRCT:3" "__IRTSS:24078146" "__IRSID:S-1-5-21-17203666-93769886-2545153620-1000"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 dl2.tlauncher.org udp
US 104.20.37.13:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 13.37.20.104.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 139.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 175.117.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 a14411ca54ffb3b223c21c63a784409b
SHA1 33050df5397e5a44169cf0cd702d776269233f36
SHA256 1c830be41a2d969da6e8e889a1ae23fc41594d5323520e5a39de7f2c32c5dc5b
SHA512 0bc34e8d826e3e026068c52c41eb4617e9bff553c675ff45c525ac4210b6cf878267fdfb4b6796d4de4dad2e8145eb3dd98220ee01957bd3e839e9f8a8d4bba7

memory/4356-14-0x0000000000A40000-0x0000000000E29000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 c333af59fa9f0b12d1cd9f6bba111e3a
SHA1 66ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0
SHA256 fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34
SHA512 2f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

memory/4356-592-0x0000000010000000-0x0000000010051000-memory.dmp

memory/4356-593-0x0000000005910000-0x0000000005913000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 dabd469bae99f6f2ada08cd2dd3139c3
SHA1 6714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b
SHA256 89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606
SHA512 9c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

MD5 83a8f0546164c9ba1a248acedefd6e5d
SHA1 7652f353ed74015e7e78bc9f9e305a48d336b6d1
SHA256 e7c5072ec60d32022b3c818c527ad86f4985837a4f0e9fc6477f54ae86d9f1c9
SHA512 111d11acdaef0036ff5cabeb16ed55bf4c681fa6eb3c006af450a0ebadae3e213a8f3abb0f4a9aecc8e893af7a79b4eb7f74a5fc3743e338c3e3136b5d7f9f2d

memory/4356-614-0x0000000010000000-0x0000000010051000-memory.dmp

memory/4356-613-0x0000000000A40000-0x0000000000E29000-memory.dmp

memory/4356-638-0x0000000010000000-0x0000000010051000-memory.dmp

memory/4356-640-0x0000000010000000-0x0000000010051000-memory.dmp

memory/4356-654-0x0000000010000000-0x0000000010051000-memory.dmp