Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
523s -
max time network
533s -
platform
windows7_x64 -
resource
win7-20240704-es -
resource tags
arch:x64arch:x86image:win7-20240704-eslocale:es-esos:windows7-x64systemwindows -
submitted
27/09/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-Installer-1.5.2.exe
Resource
win7-20240704-es
General
-
Target
TLauncher-Installer-1.5.2.exe
-
Size
24.1MB
-
MD5
bf7c6b903ee4acb62a91c2c46d773f88
-
SHA1
68a5e851745b2c0620cc3a54797f5a440f849df1
-
SHA256
31109bf139e93350f2adf5aceb87184ad8dacebf3ad31190451f44768a9f6725
-
SHA512
7d3f82ec46c26fab2270181e7fcb6dc683ce66053dee1bff150960bb8416d0db28c37a324fbfa1bb0a7f424047dfac2f3d32deafc00f99c335e312bc38452e64
-
SSDEEP
786432:TKQdii3bJZM9irrKJBH5lFRqkd4zUcjc+orlG:TKULMQPKJBZlCkOQcrorl
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\International\Geo\Nation java.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 18 IoCs
pid Process 2672 irsetup.exe 3068 BrowserInstaller.exe 3004 irsetup.exe 1728 jre-windows.exe 2668 jre-windows.exe 2304 installer.exe 2364 javaw.exe 2912 ssvagent.exe 2900 javaws.exe 1828 jp2launcher.exe 1552 javaws.exe 2020 jp2launcher.exe 3060 MSIA453.tmp 2352 javaw.exe 2128 javaw.exe 2392 TLauncher.exe 2280 javaw.exe 2672 java.exe -
Loads dropped DLL 64 IoCs
pid Process 2688 TLauncher-Installer-1.5.2.exe 2688 TLauncher-Installer-1.5.2.exe 2688 TLauncher-Installer-1.5.2.exe 2688 TLauncher-Installer-1.5.2.exe 2672 irsetup.exe 2672 irsetup.exe 2672 irsetup.exe 2672 irsetup.exe 2672 irsetup.exe 2672 irsetup.exe 2672 irsetup.exe 2672 irsetup.exe 3068 BrowserInstaller.exe 3068 BrowserInstaller.exe 3068 BrowserInstaller.exe 3068 BrowserInstaller.exe 3004 irsetup.exe 3004 irsetup.exe 3004 irsetup.exe 2672 irsetup.exe 1728 jre-windows.exe 1220 Process not Found 1220 Process not Found 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe 1168 msiexec.exe 2304 installer.exe 2304 installer.exe 2304 installer.exe 872 Process not Found 872 Process not Found 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe 2364 javaw.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2660 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\"" msiexec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 27 1168 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 12 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} installer.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\javaws.exe rundll32.exe File created C:\Windows\system32\javaw.exe rundll32.exe File created C:\Windows\system32\WindowsAccessBridge-64.dll rundll32.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\machine.PNF dxdiag.exe File opened for modification C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_neutral_8693053514b10ee9\input.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_neutral_0383c5de75359695\netrtl64.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_neutral_0684fdc43059f486\keyboard.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_neutral_4b99fffee061ff26\hdaudbus.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\mshdc.PNF dxdiag.exe File created C:\Windows\system32\WindowsAccessBridge-64.dll installer.exe File created C:\Windows\system32\java.exe rundll32.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\usbport.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\msmouse.PNF dxdiag.exe -
resource yara_rule behavioral1/files/0x0009000000015ce6-3.dat upx behavioral1/memory/2688-5-0x0000000003020000-0x0000000003409000-memory.dmp upx behavioral1/memory/2672-19-0x00000000001F0000-0x00000000005D9000-memory.dmp upx behavioral1/memory/2672-765-0x00000000001F0000-0x00000000005D9000-memory.dmp upx behavioral1/memory/2672-811-0x00000000001F0000-0x00000000005D9000-memory.dmp upx behavioral1/files/0x000400000001df2d-859.dat upx behavioral1/memory/3004-864-0x0000000001000000-0x00000000013E9000-memory.dmp upx behavioral1/memory/3004-927-0x0000000001000000-0x00000000013E9000-memory.dmp upx behavioral1/memory/2672-1662-0x00000000001F0000-0x00000000005D9000-memory.dmp upx behavioral1/memory/2672-1683-0x00000000001F0000-0x00000000005D9000-memory.dmp upx behavioral1/memory/2672-2622-0x00000000001F0000-0x00000000005D9000-memory.dmp upx behavioral1/memory/2672-2830-0x00000000001F0000-0x00000000005D9000-memory.dmp upx behavioral1/memory/2672-3040-0x00000000001F0000-0x00000000005D9000-memory.dmp upx behavioral1/memory/2672-3776-0x00000000001F0000-0x00000000005D9000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Paramaribo msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf msiexec.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guatemala msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Manaus msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae msiexec.exe File opened for modification C:\Program Files\Java\jre7\bin\hprof.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Madrid msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dubai msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Thule msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7 msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mahe msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll msiexec.exe File opened for modification C:\Program Files\Java\jre7\bin\eula.dll msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\PST8PDT msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\deploy.jar msiexec.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santiago msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Chita msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Barbados msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4 msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Rome msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\HST10 msiexec.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\jawt.dll msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo msiexec.exe File opened for modification C:\Program Files\Java\jre7\bin\wsdetect.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.bfc msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Adak msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll msiexec.exe File created C:\Program Files\Java\jre-1.8\bin\glass.dll msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Edmonton msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Palau msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.properties.src msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\management-agent.jar msiexec.exe -
Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI30AF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3311.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI33FC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA452.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDA08.tmp msiexec.exe File created C:\Windows\Installer\f772710.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2FC4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6E60.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DCD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2E3C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA453.tmp msiexec.exe File created C:\Windows\Installer\f77295d.msi msiexec.exe File opened for modification C:\Windows\Installer\f772960.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.app.log dxdiag.exe File opened for modification C:\Windows\Installer\f772710.msi msiexec.exe File created C:\Windows\Installer\f772715.msi msiexec.exe File opened for modification C:\Windows\Installer\f772713.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8CAB.tmp msiexec.exe File created C:\Windows\Installer\f772962.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2AAF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2EF8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3499.tmp msiexec.exe File created C:\Windows\Installer\f772718.ipi msiexec.exe File created C:\Windows\Installer\f772960.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2C07.tmp msiexec.exe File created C:\Windows\Installer\f772713.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8CBC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA4B2.tmp msiexec.exe File opened for modification C:\Windows\Installer\f772718.ipi msiexec.exe File opened for modification C:\Windows\Installer\f77295d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDAA6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2CD3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI315B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID95B.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language irsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLauncher-Installer-1.5.2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language irsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BrowserInstaller.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2672 java.exe -
System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2672 java.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 java.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision java.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4B5F-9EE6-34795C46E7E7} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files\\Java\\jre-1.8\\bin" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main jre-windows.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files\\Java\\jre-1.8\\bin" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4B5F-9EE6-34795C46E7E7} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files\\Java\\jre-1.8\\bin" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "19" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files\\Java\\jre-1.8\\bin" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files\\Java\\jre-1.8\\bin" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0380-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0025-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0290-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0169-ABCDEFFEDCBA} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0220-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0165-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0127-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0114-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_114" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0132-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0311-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0369-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0114-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0087-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0063-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0299-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0317-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0304-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0207-ABCDEFFEDCBC} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0346-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0038-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0087-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0309-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0021-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0356-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0199-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0056-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_56" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0058-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_83" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0251-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0097-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0246-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_246" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0355-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0273-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0067-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_67" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0224-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_224" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0130-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_130" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0214-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0047-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0082-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0087-ABCDEFFEDCBC} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0195-ABCDEFFEDCBB} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0270-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_13" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0013-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0114-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0072-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0029-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0138-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0285-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0393-ABCDEFFEDCBA} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0330-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_73" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0075-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0098-ABCDEFFEDCBB}\InprocServer32 installer.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0208-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" ssvagent.exe Key deleted \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0206-ABCDEFFEDCBC}\INPROCSERVER32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0035-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_25" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBB} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0103-ABCDEFFEDCBB}\INPROCSERVER32 rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBB}\INPROCSERVER32 rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0273-ABCDEFFEDCBB}\INPROCSERVER32 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0130-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0383-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_383" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0139-ABCDEFFEDCBC}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0062-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0272-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0244-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0314-ABCDEFFEDCBA} rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0378-ABCDEFFEDCBA}\InprocServer32 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0339-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_339" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0188-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0196-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0354-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0385-ABCDEFFEDCBB}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_18" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0158-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_158" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0152-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0059-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0063-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_63" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0129-ABCDEFFEDCBC} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0344-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0221-ABCDEFFEDCBA}\INPROCSERVER32 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0194-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_194" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0084-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files\\Java\\jre-1.8\\bin\\jp2iexp.dll" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0239-ABCDEFFEDCBC} rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0267-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0254-ABCDEFFEDCBB}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0037-ABCDEFFEDCBB}\ = "Java Plug-in 1.3.1_37" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0065-ABCDEFFEDCBA} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0110-ABCDEFFEDCBB}\INPROCSERVER32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0285-ABCDEFFEDCBC}\InprocServer32 rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBA} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0188-ABCDEFFEDCBB} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0018-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0081-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0233-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0088-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_04" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0175-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_175" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0002-ABCDEFFEDCBB}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0232-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_232" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0064-ABCDEFFEDCBA}\ = "Java Plug-in 1.4.2_64" rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0151-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_151" installer.exe Key deleted \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0068-ABCDEFFEDCBB}\INPROCSERVER32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBA} ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0118-ABCDEFFEDCBB} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0336-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0038-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\INPROCSERVER32 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 irsetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde irsetup.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3004 irsetup.exe 3004 irsetup.exe 1168 msiexec.exe 1168 msiexec.exe 2900 javaws.exe 1828 jp2launcher.exe 1552 javaws.exe 2020 jp2launcher.exe 3060 MSIA453.tmp 1168 msiexec.exe 1168 msiexec.exe 2496 dxdiag.exe 2496 dxdiag.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2668 jre-windows.exe Token: SeIncreaseQuotaPrivilege 2668 jre-windows.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeSecurityPrivilege 1168 msiexec.exe Token: SeCreateTokenPrivilege 2668 jre-windows.exe Token: SeAssignPrimaryTokenPrivilege 2668 jre-windows.exe Token: SeLockMemoryPrivilege 2668 jre-windows.exe Token: SeIncreaseQuotaPrivilege 2668 jre-windows.exe Token: SeMachineAccountPrivilege 2668 jre-windows.exe Token: SeTcbPrivilege 2668 jre-windows.exe Token: SeSecurityPrivilege 2668 jre-windows.exe Token: SeTakeOwnershipPrivilege 2668 jre-windows.exe Token: SeLoadDriverPrivilege 2668 jre-windows.exe Token: SeSystemProfilePrivilege 2668 jre-windows.exe Token: SeSystemtimePrivilege 2668 jre-windows.exe Token: SeProfSingleProcessPrivilege 2668 jre-windows.exe Token: SeIncBasePriorityPrivilege 2668 jre-windows.exe Token: SeCreatePagefilePrivilege 2668 jre-windows.exe Token: SeCreatePermanentPrivilege 2668 jre-windows.exe Token: SeBackupPrivilege 2668 jre-windows.exe Token: SeRestorePrivilege 2668 jre-windows.exe Token: SeShutdownPrivilege 2668 jre-windows.exe Token: SeDebugPrivilege 2668 jre-windows.exe Token: SeAuditPrivilege 2668 jre-windows.exe Token: SeSystemEnvironmentPrivilege 2668 jre-windows.exe Token: SeChangeNotifyPrivilege 2668 jre-windows.exe Token: SeRemoteShutdownPrivilege 2668 jre-windows.exe Token: SeUndockPrivilege 2668 jre-windows.exe Token: SeSyncAgentPrivilege 2668 jre-windows.exe Token: SeEnableDelegationPrivilege 2668 jre-windows.exe Token: SeManageVolumePrivilege 2668 jre-windows.exe Token: SeImpersonatePrivilege 2668 jre-windows.exe Token: SeCreateGlobalPrivilege 2668 jre-windows.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe Token: SeRestorePrivilege 1168 msiexec.exe Token: SeTakeOwnershipPrivilege 1168 msiexec.exe -
Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 2672 irsetup.exe 2672 irsetup.exe 2672 irsetup.exe 2672 irsetup.exe 3004 irsetup.exe 3004 irsetup.exe 2668 jre-windows.exe 2668 jre-windows.exe 2668 jre-windows.exe 2668 jre-windows.exe 1828 jp2launcher.exe 2020 jp2launcher.exe 2280 javaw.exe 2280 javaw.exe 2672 java.exe 2672 java.exe 2496 dxdiag.exe 2672 java.exe 2672 java.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2672 2688 TLauncher-Installer-1.5.2.exe 30 PID 2688 wrote to memory of 2672 2688 TLauncher-Installer-1.5.2.exe 30 PID 2688 wrote to memory of 2672 2688 TLauncher-Installer-1.5.2.exe 30 PID 2688 wrote to memory of 2672 2688 TLauncher-Installer-1.5.2.exe 30 PID 2688 wrote to memory of 2672 2688 TLauncher-Installer-1.5.2.exe 30 PID 2688 wrote to memory of 2672 2688 TLauncher-Installer-1.5.2.exe 30 PID 2688 wrote to memory of 2672 2688 TLauncher-Installer-1.5.2.exe 30 PID 2672 wrote to memory of 3068 2672 irsetup.exe 32 PID 2672 wrote to memory of 3068 2672 irsetup.exe 32 PID 2672 wrote to memory of 3068 2672 irsetup.exe 32 PID 2672 wrote to memory of 3068 2672 irsetup.exe 32 PID 2672 wrote to memory of 3068 2672 irsetup.exe 32 PID 2672 wrote to memory of 3068 2672 irsetup.exe 32 PID 2672 wrote to memory of 3068 2672 irsetup.exe 32 PID 3068 wrote to memory of 3004 3068 BrowserInstaller.exe 33 PID 3068 wrote to memory of 3004 3068 BrowserInstaller.exe 33 PID 3068 wrote to memory of 3004 3068 BrowserInstaller.exe 33 PID 3068 wrote to memory of 3004 3068 BrowserInstaller.exe 33 PID 3068 wrote to memory of 3004 3068 BrowserInstaller.exe 33 PID 3068 wrote to memory of 3004 3068 BrowserInstaller.exe 33 PID 3068 wrote to memory of 3004 3068 BrowserInstaller.exe 33 PID 2672 wrote to memory of 1728 2672 irsetup.exe 36 PID 2672 wrote to memory of 1728 2672 irsetup.exe 36 PID 2672 wrote to memory of 1728 2672 irsetup.exe 36 PID 2672 wrote to memory of 1728 2672 irsetup.exe 36 PID 1728 wrote to memory of 2668 1728 jre-windows.exe 37 PID 1728 wrote to memory of 2668 1728 jre-windows.exe 37 PID 1728 wrote to memory of 2668 1728 jre-windows.exe 37 PID 1168 wrote to memory of 2396 1168 msiexec.exe 40 PID 1168 wrote to memory of 2396 1168 msiexec.exe 40 PID 1168 wrote to memory of 2396 1168 msiexec.exe 40 PID 1168 wrote to memory of 2396 1168 msiexec.exe 40 PID 1168 wrote to memory of 2396 1168 msiexec.exe 40 PID 1168 wrote to memory of 2304 1168 msiexec.exe 41 PID 1168 wrote to memory of 2304 1168 msiexec.exe 41 PID 1168 wrote to memory of 2304 1168 msiexec.exe 41 PID 2304 wrote to memory of 2364 2304 installer.exe 42 PID 2304 wrote to memory of 2364 2304 installer.exe 42 PID 2304 wrote to memory of 2364 2304 installer.exe 42 PID 2304 wrote to memory of 2900 2304 installer.exe 44 PID 2304 wrote to memory of 2900 2304 installer.exe 44 PID 2304 wrote to memory of 2900 2304 installer.exe 44 PID 2900 wrote to memory of 1828 2900 javaws.exe 45 PID 2900 wrote to memory of 1828 2900 javaws.exe 45 PID 2900 wrote to memory of 1828 2900 javaws.exe 45 PID 2304 wrote to memory of 1552 2304 installer.exe 46 PID 2304 wrote to memory of 1552 2304 installer.exe 46 PID 2304 wrote to memory of 1552 2304 installer.exe 46 PID 1552 wrote to memory of 2020 1552 javaws.exe 47 PID 1552 wrote to memory of 2020 1552 javaws.exe 47 PID 1552 wrote to memory of 2020 1552 javaws.exe 47 PID 1168 wrote to memory of 932 1168 msiexec.exe 48 PID 1168 wrote to memory of 932 1168 msiexec.exe 48 PID 1168 wrote to memory of 932 1168 msiexec.exe 48 PID 1168 wrote to memory of 932 1168 msiexec.exe 48 PID 1168 wrote to memory of 932 1168 msiexec.exe 48 PID 1168 wrote to memory of 2324 1168 msiexec.exe 49 PID 1168 wrote to memory of 2324 1168 msiexec.exe 49 PID 1168 wrote to memory of 2324 1168 msiexec.exe 49 PID 1168 wrote to memory of 2324 1168 msiexec.exe 49 PID 1168 wrote to memory of 2324 1168 msiexec.exe 49 PID 1168 wrote to memory of 3060 1168 msiexec.exe 50 PID 1168 wrote to memory of 3060 1168 msiexec.exe 50 PID 1168 wrote to memory of 3060 1168 msiexec.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.5.2.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.5.2.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.5.2.exe" "__IRCT:3" "__IRTSS:25260951" "__IRSID:S-1-5-21-3434294380-2554721341-1919518612-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1679762 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1709878" "__IRSID:S-1-5-21-3434294380-2554721341-1919518612-1000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3004
-
-
-
C:\Users\Admin\AppData\Local\Temp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\jds259461861.tmp\jre-windows.exe"C:\Users\Admin\AppData\Local\Temp\jds259461861.tmp\jre-windows.exe" "STATIC=1"4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2668 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus5⤵
- Executes dropped EXE
PID:2352
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 305⤵
- Executes dropped EXE
PID:2128
-
-
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2280 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M5⤵
- Modifies file permissions
PID:2660
-
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exeC:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exe -Xmx1024m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\fluent-hc-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.8.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\hamcrest-core-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore-4.4.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junit-4.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.2721.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.72.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-server-API-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\url-cache-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.9289.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.92895⤵
- Checks computer location settings
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- System Time Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2672 -
C:\Windows\system32\cmd.execmd.exe /C chcp 437 & wmic CPU get NAME6⤵PID:2692
-
C:\Windows\system32\chcp.comchcp 4377⤵PID:1056
-
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME7⤵PID:2644
-
-
-
C:\Windows\system32\cmd.execmd.exe /C chcp 437 & set processor6⤵PID:1156
-
C:\Windows\system32\chcp.comchcp 4377⤵PID:3048
-
-
-
C:\Windows\system32\cmd.execmd.exe /C chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt6⤵PID:3036
-
C:\Windows\system32\chcp.comchcp 4377⤵PID:1252
-
-
C:\Windows\system32\dxdiag.exedxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt7⤵PID:2208
-
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\SysWOW64\dxdiag.exe" /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt8⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2496
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /C chcp 437 & wmic qfe get HotFixID6⤵PID:2752
-
C:\Windows\system32\chcp.comchcp 4377⤵PID:1296
-
-
C:\Windows\System32\Wbem\WMIC.exewmic qfe get HotFixID7⤵PID:2468
-
-
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Adds Run key to start application
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding B1D0A551C9CEDFBADC8A272289B7CFDC2⤵
- Loads dropped DLL
PID:2396
-
-
C:\Program Files\Java\jre-1.8\installer.exe"C:\Program Files\Java\jre-1.8\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre-1.8\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={71024AE4-039E-4CA4-87B4-2F64180401F0}2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364
-
-
C:\Program Files\Java\jre-1.8\bin\ssvagent.exe"C:\Program Files\Java\jre-1.8\bin\ssvagent.exe" -doHKCUSSVSetup3⤵
- Executes dropped EXE
- Modifies registry class
PID:2912
-
-
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
-
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding DBD9467D5E278EF15243335C81F1A13C M Global\MSI00002⤵PID:932
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 1C719F2485C00E42B24F63D55F3129382⤵PID:2324
-
-
C:\Windows\Installer\MSIA453.tmp"C:\Windows\Installer\MSIA453.tmp" C:\Program Files\Java\jre7\;C;22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3060
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Program Files\Java\jre7\bin\\installer.dll",UninstallJREEntryPoint2⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:2764
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD7615109686DDC9D2C0DB53F10A09C42⤵
- System Location Discovery: System Language Discovery
PID:2272
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D77581D5F9AD493076D7DC257AB6C373 M Global\MSI00002⤵
- System Location Discovery: System Language Discovery
PID:848
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc81⤵PID:2404
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
963KB
MD53df3a0e9a73f9e554bc5ff950c0154fb
SHA1101b55e2191cc1ede11383a26166b1709d8e030b
SHA256984a1ff9eb749817b3eed666d1e054d15f6b91cf7e63bd75c01997fcebfe924a
SHA51273cea95887a5014e2cf41f03163f3f4d675f3c77b9923eb47f236be20d0e048617d833c57235dd802f8c20cb310c2efa5c908578c0bbd467d4aa34ac0c7a0394
-
Filesize
113KB
MD541556efdc8fda4e56dc2d75f4d761cb1
SHA14426f65c33c808f850aa01bb55877601e89e7061
SHA2569bec582cd01a8a5f0fe4e91175957719a26d348341b480c32686ef457ebfcd60
SHA5121bfc72dca05dd4738c3f72ac0f164560aad9f7dd5897cded43ac890c9c70c2dede9427a4e8350d9b98cdbf7b0d3da374722e633ff7a4f44b2dabce348e0513dd
-
Filesize
7KB
MD52fa281f9a2abd364885d58337dbfb5d9
SHA16390240d831a1e24e202ad470fb02445a9622c13
SHA256619c7367bb8e0a53b18c9c744807cd94bf8269b8aac222eda95f7312498ba6c0
SHA5127ee50d2e32601142d1dff7568bd07cb44efdd8e3892dcd235f0762de7e5e5255ac22ecf97bacd639939ce018f97d35ed56615295baf3639409cc2c735e0ef6a1
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Documentación de Referencia.lnk
Filesize197B
MD5b5e1de7d05841796c6d96dfe5b8b338c
SHA1c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547
SHA256062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d
SHA512963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d
-
Filesize
177B
MD56684bd30905590fb5053b97bfce355bc
SHA141f6b2b3d719bc36743037ae2896c3d5674e8af7
SHA256aa4868d35b6b3390752a5e34ab8e5cba90217e920b8fb8a0f8e46edc1cc95a20
SHA5121748ab352ba2af943a9cd60724c4c34b46f3c1e6112df0c373fa9ba8cb956eb548049a0ac0f4dccff6b5f243ff2d6d210661f0c77b9e1e3d241a404b86d54644
-
Filesize
173B
MD5625bd85c8b8661c2d42626fc892ee663
SHA186c29abb8b229f2d982df62119a23976a15996d9
SHA25663c2e3467e162e24664b3de62d8eeb6a290a8ffcdf315d90e6ca14248bc0a13a
SHA51207708de888204e698f72d8a8778ed504e0fe4d159191efb48b815852e3997b50a27ba0bc8d9586c6fb4844166f38f5f9026a89bbbc3627e78121373982656f12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize471B
MD548ae95acaa8c8c1563df6ab6ea8d5027
SHA185f4aa8e6961c4ef21e4f7a1888effb64354d626
SHA256d327747c1d79878124c82eb4c8f6e35ed30d752b99f4b18d15beccf6f1e695cf
SHA5126318314b145667c6ab468571e986259b4577754d40c6400d8400cea54584e0ae6ba30b361e5174a2a2f6c2a844f7985d463c7d94db29ffe85077a68a43f5dea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afa60ceabed78f6e0e6fe1f52c8b7b48
SHA105b411061629f5735130cb28f5aea4de23428303
SHA2569b5a938717588b1b804db62ebefb3cb20f07ae822861c57fd107387058807d48
SHA512c9266690b01c394025410568121abb0471f4bb17a0988a28aaf7a98a53c9fd675357c9a4fbf4da04974a112131d46c8fe1b8c9be03acb6ecf63607685f09cc2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5f57a3c061348e2366c1113d201549e
SHA1a10bbeb2b9166010837b20affc38e5b4f99b375b
SHA2566a00416edda4abcecb24d2e137d374769f9860f41c64865d9ad7c9b945251b9b
SHA512a40be7c346eb6bae72bb6aaa74ecf8719fb20ba9326bf26f7dfbde6a43c5093a9b932df47907957989f5b4994a5a2dc04fa4f42dfe5d6afbb0efa721f7adc798
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507548f97843a66c2e234e71c31b3fcee
SHA1a17b89d452778b4843259505260333c2be733d4a
SHA2561987df6bb1585df5ed288a9a1515bab4c4b55dbc4bfeaa0a31059db77998d31f
SHA5126fe0ce32319eb3a51da26f9fac45ae10eb73b503ea019c1e59de74688cf385eb9378fc73b27cb0c6c5316b89aff54d9ab1e1a5d28008c2336e733e86eace04c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize400B
MD52281a3f033bc61065b83faabb2814664
SHA1fa1bea3a8158f7f9e295171782c83a5a55ce4626
SHA25659333d67907321e120d96fabcd9584aed609997cc31af1765ca8a4005f2428c8
SHA5125c7c3aec842c758df2f2c231b60569a21fc4008050ed6311376edaaa479aacb4572b25f09c58600a45a4739a6b3318439c70071de2f462b9431cc98bb8135dd3
-
Filesize
11KB
MD5b3c9f084b052e95aa3014e492d16bfa6
SHA10e33962b2191e7b1a5d85102cdf3c74fcd1254e4
SHA256a68ddd67f6fcb0bbf1defa0778ee543e92c1074c442197ab623f733cc6285948
SHA51206f51ac2962a0ec5f05ad6c90a2ba85b851d1fa2f0c079dc264fe930316cead959f68f6e34ff591b131867b482c266ac42400b06385dae712637ff0a90f902d4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH\common[1]
Filesize1KB
MD5f5bb484d82e7842a602337e34d11a8f6
SHA109ea1dee4b7c969771e97991c8f5826de637716f
SHA256219108bfef63f97562c4532681b03675c9e698c5ae495205853dbcbfd93faf1a
SHA512a23cc05b94842e1f3a53c2ea8a0b78061649e0a97fcd51c8673b2bcb6de80162c841e9fdde212d3dfd453933df2362dcb237fe629f802bafaa144e33ca78b978
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH\runtime[1]
Filesize42KB
MD55d4657b90d2e41960ebe061c1fd494b8
SHA171eca85088ccbd042cb861c98bccb4c7dec9d09d
SHA25693a647b1f2cadcbdb0fe9c46b82b2b4baf7685167de05933811549145c584ee0
SHA512237738c0a6cb25efe29effc9c3637245e3e2397207ed51e67bae5a1b54749f88e090de524f7868d964debbb29a920a68205ccbd2dfceed4a1f3cd72d08b16fa3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\l10n[1]
Filesize4KB
MD51fd5111b757493a27e697d57b351bb56
SHA19ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711
SHA25685bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f
SHA51280f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\masthead_fill[1]
Filesize1KB
MD591a7b390315635f033459904671c196d
SHA1b996e96492a01e1b26eb62c17212e19f22b865f3
SHA256155d2a08198237a22ed23dbb6babbd87a0d4f96ffdc73e0119ab14e5dd3b7e00
SHA512b3c8b6f86ecf45408ac6b6387ee2c1545115ba79771714c4dd4bbe98f41f7034eae0257ec43c880c2ee88c44e8fc48c775c5bb4fd48666a9a27a8f8ac6bcfdcb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\host[1]
Filesize1KB
MD5a752a4469ac0d91dd2cb1b766ba157de
SHA1724ae6b6d6063306cc53b6ad07be6f88eaffbab3
SHA2561e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3
SHA512abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\layout[1]
Filesize2KB
MD5cc86b13a186fa96dfc6480a8024d2275
SHA1d892a7f06dc12a0f2996cc094e0730fe14caf51a
SHA256fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058
SHA5120e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\masthead_left[1]
Filesize4KB
MD5b663555027df2f807752987f002e52e7
SHA1aef83d89f9c712a1cbf6f1cd98869822b73d08a6
SHA2560ce32c034dfb7a635a7f6e8152666def16d860b6c631369013a0f34af9d17879
SHA512b104ed3327fed172501c5aa990357b44e3b31bb75373fb8a4ea6470ee6a72e345c9dc4bcf46a1983c81adb567979e6e8e6517d943eb204c3f7fac559cd17c451
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\rtutils[1]
Filesize244B
MD5c0a4cebb2c15be8262bf11de37606e07
SHA1cafc2ccb797df31eecd3ae7abd396567de8e736d
SHA2567da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1
SHA512cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74
-
Filesize
477KB
MD5ec5d243a9958b3858b5a71fb9a690da7
SHA1d80b02c91addef2ef58136d1a7df0189f453388c
SHA256a4ece920f221b78d43b550d615c5934db162b64a331ffa663a85199e74ef2e6b
SHA512479512c6076249a63a822d307b3d8c65d44d19abfadc597f0293fedf2c4fbac2ba6f60ca98d2c1dbb638ad09f3eb1419b6ef391fb098c7d1b62237bce9d79931
-
Filesize
141KB
MD554a91b0619ccf9373d525109268219dc
SHA11d1d41fcadc571decb6444211b7993b99ce926e2
SHA256b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f
SHA5127f79ff3b42a672371814f42814aa5646328b1a314691d30ce09ffdc7a322adcb1af66625274f7fac024ca2f22a42b625001735711c430faef6e077e1f1d24887
-
Filesize
132KB
MD5afa7a91dadd77b23634a0fdf18c148f3
SHA16cbb57ba2355cf442e06899898ff5af55867103e
SHA2569287925cae90ac480804094ff0876832065e2db116470da1f524d79ed9c18b70
SHA51284d123b67505522c256f4ff79c3822eabe2d63036023896e9854298ff39e050bef7894f6320ccf950592015760354683c4dbd19aa203d433a04a5d6bb28e8115
-
Filesize
424KB
MD54c41e856744eb797e9936359a6509287
SHA10959e6f4dd535eb6fae388b6b9ac179dcf3afd76
SHA25683ff53f599acefc11f5cf63fd0516d4db72aacf7f0125a5f79c9ff222cbf9dd7
SHA51207ae284caa316315da74246c960198a7d549acf86f96cec550f41109fcd870a69ccac9818361657fb859e89d2bdc8398c7731c80d274d99a768102022a5f6e8b
-
Filesize
156KB
MD5607fc518b9f6506e5ef66c2839c69149
SHA155be7d31240add9837da746369bf0bb5c52e0f6f
SHA2567149f8f1d8b0386ab74427c78d660e211c572ffd901897f86475319d28248083
SHA51205785828204fab7789aac12c10fa4d77673ac89741e6749424f863d69f13ac6731ff215eb80eee84820ad0461f754e863c9cb8045beb25efde5179a2c5ccb1ae
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
27KB
MD52e5daeb42147bc8f5def108338d2f72d
SHA1d31ec28053797b214a262113fad7ee90bb04e14e
SHA256edc2a94734389ad13c53a495d6eda47adf3a09487f73b54ca60e5f2ffac4e88c
SHA512569eefea1dc63cb89f386eff80ce0a14e1b173704be35f1a39dfc493898230e47ea56b35055f9b00c78c552f1d8f39873056ee05fdea284c0441ba2ca9c69d17
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
116KB
MD5e043a9cb014d641a56f50f9d9ac9a1b9
SHA161dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA2569dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA5124ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
-
Filesize
1.6MB
MD5199e6e6533c509fb9c02a6971bd8abda
SHA1b95e5ef6c4c5a15781e1046c9a86d7035f1df26d
SHA2564257d06e14dd5851e8ac75cd4cbafe85db8baec17eaebd8f8a983b576cd889f8
SHA51234d90fa78bd5c26782d16421e634caec852ca74b85154b2a3499bc85879fc183402a7743dd64f2532b27c791df6e9dd8113cc652dcb0cdf3beae656efe79c579
-
Filesize
12KB
MD53adf5e8387c828f62f12d2dd59349d63
SHA1bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA2561d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
SHA512e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
-
Filesize
206B
MD5e05876a818319a4c70cc2c866caea6c3
SHA1e27c39f87fb04e68c50313919367f1479d418ee1
SHA25625a2007f1cdefb6461bc35cdee517498572a5c18614b2d60b9222d64c402ab02
SHA51258bd266dc7f5face87cb59b0f6ffb2a56dda1846e74bfe6abff994f986a0bd6032c6e08b5650aff32c92fcf7f8ab2fdf3874bcf3692ee5b76a297111197265aa
-
Filesize
43KB
MD5caa1679cdd9d12b5b556dcbd052a66a2
SHA11b3429513a5d6f63fa372fa76136edd59d01ad65
SHA256dbe2426ac4dd762853be5269ab5d15fc67ef00626929b836dee0d4f56639179b
SHA512ac58a68070806d3e5f736eb4fb2ff2d33eaa9264a3bce203a1b3e43b6a0cf899d5f76b5f87fd693496f99802a1483a3ae7314589ae1cfc52d87133404e34be3b
-
Filesize
644B
MD57c30c405d19c2fe417687a3c9407d1fc
SHA162849d28e4b524dbdebc4ad2ea4646bdc6a0bed8
SHA2562ae465c65379fbb48a7129eb14d5039383e2506b07eeeb4616670a8db71b8eba
SHA51260b3efcc81290bfbe7147bf2447b66bc20cabc45982916aec180c17a5e5ed08cceb740dc8ffe47fcb51f06217635b4abc922422a691693f81de73db6b62782da
-
Filesize
40KB
MD555a998b77aa4894e34a1bd8594316b7f
SHA1f7f710a7723d9b3d339dd744c7eca83d1a0e1b78
SHA256619772c984fa29dbead3a0441086c748de6c2a577f389fdc92b22764855b98db
SHA5127052932a369873219795693ecf0797cfae944e10074d26e6f1e3e59cee5b9dc13bc6102dfab8b89a177d264e9a0169c3c63d4babfff3e480d3e88474fc5aacc7
-
Filesize
40KB
MD5ba34708a165478c7dd3622052cf20382
SHA11b5043ad8a229ad6a2ac62252c3b24e6249a7e60
SHA256d393417f3aa0bdb4a627c37c32f38536760d5709f5dce2145fd08c41a66ffbe8
SHA512d4b715f56ecc6ac2f89082f51b7477706dc39648bc35c35df72d150a32da8dfad042a056c4a871be3befeb1f2ac5c93665ffd5f225475354ca809eecb46cafa5
-
Filesize
12KB
MD5f35117734829b05cfceaa7e39b2b61fb
SHA1342ae5f530dce669fedaca053bd15b47e755adc2
SHA2569c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
SHA5121805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
-
Filesize
12KB
MD5f5d6a81635291e408332cc01c565068f
SHA172fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA2564c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
SHA51233333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
-
Filesize
1.8MB
MD55c9fb63e5ba2c15c3755ebbef52cabd2
SHA179ce7b10a602140b89eafdec4f944accd92e3660
SHA25654ee86cd55a42cfe3b00866cd08defee9a288da18baf824e3728f0d4a6f580e7
SHA512262c50e018fd2053afb101b153511f89a77fbcfd280541d088bbfad19a9f3e54471508da8b56c90fe4c1f489b40f9a8f4de66eac7f6181b954102c6b50bdc584
-
Filesize
438B
MD58a28c899eb9a0e38337aec03dc0bd343
SHA18e38d9c3ceeca47e3b4247712f1f1ede72e03efd
SHA256a7f18df02aa59a98cabb04a85fee8e62b0a806a3c340b3811a8c3b5a94d2208e
SHA5120524dfb937827dc4fe78dddf8b8b4f08715bd690f926a3e9361887d5860e6b550c54fd71580d876bedca189c8bb09295c11e27b49da958bb0713ad274e9a4fcd
-
Filesize
325KB
MD5c333af59fa9f0b12d1cd9f6bba111e3a
SHA166ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0
SHA256fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34
SHA5122f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4
-
Filesize
151KB
MD5c2be5f72a6cb93af45f70fcd786149a6
SHA191a3250d829e7019c7b96dc2886f1d961169a87f
SHA256f616ad0cc12e4c8c01b1af5dd208aae46a5fdb1b02e8a192dfe84283e1161ca6
SHA512522b82e48fc4d6c94236f6598352ef198500ef83f2b8d890dd14901173b35d179c567e9540908a9bf145f2492043fa6848182634ee4c58956418884449f223bb
-
Filesize
1.2MB
MD507552732fa64db456300880d52e81b2f
SHA19a653ea405f5f26ec0c2d9a0bc9bcb11ba010efc
SHA25694bc1aa272183daf13f24594493eea40e02cb9861c76f9de3711c139f5315226
SHA51247e97e300330ec1523f4af6e87b9866fae2e90cd9b59fc4d02e53e29b223691f980daf1f221f5286dbc1a9a9ddf6e01e7a597c5cf763710c51d84c8d5bac60b0
-
Filesize
5KB
MD5515c45d9da4c615f7aa931fe67941121
SHA171582470022487dc37cbcae8395bf9614ee8b365
SHA256251c6dcbaff7129aba535ab84bba4e4828f2eacee8172d6b07acb4db2714c6c9
SHA512587c416a401848ee7306a26c8a3100f778e71ccf1cbccdb04be9b405f85201120c2a1aac7551d6d119153d52b464eace7bf78fd4b0a81b8952700d30cb44f06f
-
Filesize
3KB
MD52128c8cb3379b7916372d3c7716cd78f
SHA19a673ad25ab42473a4130a28c3adf7bafd853cfe
SHA256b736346524f6418b7e1230d975d353246c9f00247b3b08682b89493899ba36b6
SHA5120edffa9f7931b9bbf4f803f77bf10047514bf0ae8e64787839a5166b47a8d9573e8af277471e50ddcc6892eac0f6b346629ca6ea5be8167544b9def94e3299f1
-
Filesize
4KB
MD5cee5b85cc7de4ef1d3aa9e2eba91dcce
SHA12fd2c3538746f0d8f42b8933e8a5bc2b271a1b62
SHA256fff7f4983bc3b7bbd3de7f823374d255e4551b2daefa5430a01a129d02251e0f
SHA5126564a94cb1727f68dc1b65da2612b0a471e18ed31cea886810a695b8bd968898c38b9ca6045cb0c5e7a961c97e715f61cf200f32557b9fbd983e346d74d6ecc5
-
Filesize
25KB
MD57cf9ac5c128128608e1658fe13268fd5
SHA1046d1c01b3a78b0ef184675e64ff00534d7b6075
SHA256ca97ce8e3f40b6132539fbba3d81b559c01e09cea33f915f5d3050cf3773c91c
SHA512e7644b227a3dec4b33696eea9a7e390b8f9011bf8ef03d9dfa3a8f9affaaa9c1c6b66675e38e4e0948d480ee2a2bfc65fa5dc992783ac4499157c595a820ff98
-
Filesize
750B
MD54f9059a32345e505f9e95fe0aee35ed7
SHA16a8ec7dff2149880d659dc0ad4d18effbf483b69
SHA2560c815e7ee0d0f4a699712df56276949791633d7dafe3de8f7850618d169e8940
SHA512c8ffa77179ac3f8b0a10dd1cad7c06e970418f507af0e8406d5c1e83c87ab27fb9c7d7603685a5359326d57578daacf3ef7816e04f2c34874fdf90da5a75d0ad
-
Filesize
9.1MB
MD53fd8ea8955585f1867dfe40bcebe4f6a
SHA1e79885c300af3111f15e56544d4dab7f5187dab0
SHA2564a57d4e4de95e922353d327b318ef70de5431d57254f23487af9a87a2bd5d346
SHA51242d8f094eb5b534303e90534d0bad4e4de9f72d002fffb75b7d905d7f921fc12a15451671b71017de9ffb00c5d21e34909b34e4b3e13ca6897d6971ba969c029
-
Filesize
439B
MD5465f50c84944408a6a28a9165451297f
SHA199bd0afb8bc03233f7039d302f90f3597efb4d07
SHA256a675683c36ff7dd960f80a3ec52072eea3e677b290cb637332b1701c1b6ebd61
SHA5129362566244e13397a3fb45d7585921a50f5c391d1164db1ed100459e6200d25163e1996c8b770aa43f6ddf2d12a7610f0094a78bfce126d99cf9676b5bc233a2
-
C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\66\666999116c467f10622db1527a06ddc0a6efad2a.tlauncherdownload
Filesize1.4MB
MD5d635e313e3178146dd6833844c52c16b
SHA1666999116c467f10622db1527a06ddc0a6efad2a
SHA2568f6a12f09a805b3e6c2e412050a14912c74f6ff31b157dc08f38eb10144c4643
SHA512937d6635137db6ec5d4dabea7fed54264ac2e1368f77f4dbbbbca8a8d2a6e0669ac51477775d33db3a458f8f97141e10f636acafdefda5a49c99392033758e7f
-
C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\ec\ec92a55cb324afd2b78cb6f7b1426fd80bf4d754.tlauncherdownload
Filesize438KB
MD5078b15d73729b693dc31fb5dbd2e8686
SHA1ec92a55cb324afd2b78cb6f7b1426fd80bf4d754
SHA256cc29fb5e5ebf4ca7f983b012af208371db40388c94385de59d7d758ebf9e69a5
SHA512debbc0a4463c8ddb56b16ef9aaeed2a64f6b05dc9b11928c27a0ac34c83d1caeaa8f53816093db5a6630970d46516e019d18f1bd799a67c922644cae578e9751
-
C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.1\failureaccess-1.0.1.jar
Filesize4KB
MD5091883993ef5bfa91da01dcc8fc52236
SHA11dcf1de382a0bf95a3d8b0849546c88bac1292c9
SHA256a171ee4c734dd2da837e4b16be9df4661afab72a41adaf31eb84dfdaf936ca26
SHA512f8d59b808d6ba617252305b66d5590937da9b2b843d492d06b8d0b1b1f397e39f360d5817707797b979a5bf20bf21987b35333e7a15c44ed7401fea2d2119cae
-
C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-logging\commons-logging\1.2\commons-logging-1.2.jar
Filesize60KB
MD5040b4b4d8eac886f6b4a2a3bd2f31b00
SHA14bfc12adfe4842bf07b657f0369c4cb522955686
SHA256daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636
SHA512ed00dbfabd9ae00efa26dd400983601d076fe36408b7d6520084b447e5d1fa527ce65bd6afdcb58506c3a808323d28e88f26cb99c6f5db9ff64f6525ecdfa557
-
C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\github\classgraph\classgraph\4.8.110\classgraph-4.8.110.jar.tlauncherdownload
Filesize522KB
MD58a9143146fb4e5089159a8eba84c34ee
SHA1892977fc6be6d049afd057b673bd42cdd4d74d5e
SHA256a070b599da15fd66f892a09b7d7d47785e276943b570e382aaf8aac0f0f211b2
SHA512c5ee236127ee564c81526cc039aa20e8e8718a861e8f0967b0df4d1226a8a6abbdcd4ba47b2243ef87fb8e63e8644cee16b63df2206e22c509c88fbf0fa5027c
-
C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar
Filesize76KB
MD5eb0d9dffe9b0eddead68fe678be76c49
SHA14fdac2fbe92dfad86aa6e9301736f6b4342a3f5c
SHA256df26cc58f235f477db07f753ba5a3ab243ebe5789d9f89ecf68dd62ea9a66c28
SHA512cbc27e0b6da6ae4b6245353d6626d2e3c171c3026a555fa21e8ef61b30714e286db85086d1a57c167016e8a7f07be2a243e34b3ab504b1877806f3bcec5df986
-
C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\tlauncher\tl_skin_cape_1.21_1.21.1\1.35d\tl_skin_cape_1.21_1.21.1-1.35d.jar.tlauncherdownload
Filesize955KB
MD52b3d9ee28ec4834d4b844ac390db95b1
SHA190431b7b07a5bdeb7a14b2d154f01647ca9f04f3
SHA2564572401d8fcfaafde784c6eb5ff6c70d739e3ad8f29be9613fc9754e916fcc14
SHA512f360a3755fd13076a62042bf4f90846741e1171f07a20ee02605f9c48beba837fd31a4c553e4e1f23677c14bf5e1af293348d3389b6cb03c47ac895e5cb0c58b
-
C:\Users\Admin\AppData\Roaming\.minecraft\libraries\v1\objects\30c73b1c5da787909b2f73340419fdf13b9def88\client.jar
Filesize25.6MB
MD50b90a83eb9910468c60152f6594b9271
SHA130c73b1c5da787909b2f73340419fdf13b9def88
SHA256499f6897d1837516680f3114072d8106e11c9adcd933fe5cf051b551089b0c99
SHA512a63c09e9b8cfe80bd5815c88818291d54cbe7c9ffcd806be6365376e865c44d5aa85e8348467e6ded8f4d9722047d3c5b075f755047a982c2e75223d2b9f68ac
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\logging.properties
Filesize2KB
MD50f00ec3e7a7767a4efeae1875fb5f3d4
SHA1167808418571e9209b952188ddab2f4e62920e68
SHA256b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
SHA512e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\net.properties
Filesize6KB
MD5385443b7e4a37bc277c018cd1d336d49
SHA1b2c0dfb00bf699e817bdd49b14bc24b8d3282c65
SHA2565bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08
SHA512260afc7671a1dc0c443564f1d10386f0b241bb53c76df68d8d03f1d0b1ceaf3f68847ab3477732c876c2b01c812ef7521744befe88e312f3aa63164b608b67a1
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\README.txt
Filesize2KB
MD53d47d94bc4f19d18bcc8b23f51d013af
SHA1a97cd312d6a2a9c8c780c15e5af51a2f4f97c2cb
SHA2566da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5
SHA51268a031264cf9442526307364ca74b336af55564c233c2f514cac48e910022767562f8ff6a64bb9cfcbf0fb5e755289273382c9246418a4b9207fc7761d03c64e
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\default_US_export.policy.tlauncherdownload
Filesize146B
MD51a08ffdf0bc871296c8d698fb22f542a
SHA1f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA256758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
SHA5124cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\default_local.policy
Filesize647B
MD56d7b4616a5dba477b6b6d3f9a12e568f
SHA17fb67e217c53a685cb9314001592b5bd50b5fbb9
SHA2562b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441
SHA512a0b98cbbb49184df973bb2c4a506e9bc6e025a696bc0c8054a6352cc3f9b4a38e3baf117c6834ddaddc38498556607ed4eda8f1bc683f662d61da50e0db0c8c2
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\exempt_local.policy
Filesize566B
MD54cbb03f484c86cbea1a217baae07d3c9
SHA1ee67275bc119c98191a09ff72f043872b05ab7fd
SHA2568c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9
SHA5122bd70518aed6b0e01c520c446830c5f567fa72974548818cac3e1e5c2be6f03db78ce6012f5463b1e19c36243d04cbaad38ec79524635eaae2e427eb1875ccdb
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\unlimited\default_local.policy
Filesize193B
MD52a0f330c51aff13a96af8bd5082c84a8
SHA1ad2509631ed743c882999ac1200fd5fb8a593639
SHA2568d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
SHA5122b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\sound.properties.tlauncherdownload
Filesize1KB
MD54f95242740bfb7b133b879597947a41e
SHA19afceb218059d981d0fa9f07aad3c5097cf41b0c
SHA256299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
SHA51299fdd75b8ce71622f85f957ae52b85e6646763f7864b670e993df0c2c77363ef9cfce2727badee03503cda41abe6eb8a278142766bf66f00b4eb39d0d4fc4a87
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\ADDITIONAL_LICENSE_INFO
Filesize2KB
MD571bb3ad0017bf36d14bb96a8d4b32c45
SHA11a5c553e71bdb7d94995b206bc9eaa49abd1e888
SHA256a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916
SHA5129f658dfea71bdc3cc1549edfb5ad3171dbfa0082b2d91e820c09abe0b376b6bcd8b5170442a5e25e72274e98f130176bbdecfa7997c59705782b214f02136a20
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\LICENSE
Filesize18KB
MD53e0b59f8fac05c3c03d4a26bbda13f8f
SHA1a4fb972c240d89131ee9e16b845cd302e0ecb05f
SHA2564b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
SHA5126732288c682a39ed9edf11a151f6f48e742696f4a762c0c7d8872b99b9f6d5ab6c305064d4910b1a254862a873129f11fd0fa56ff11bc577d29303f4fb492673
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\aes.md
Filesize1KB
MD52e33468a535a4eb09ef57fc12a2652d0
SHA1e64516f3fa1e72f88caa50f14b8046dd74d012b6
SHA25645c6d4da48325edfbff3dcf71c704e504c057904435ed23c6d57046d551eb69d
SHA5124d14b5ddbb4d09797264ed29ba71fab6986b4a9e75efb9402c1476e0a9e2884813d6a922dea125643b4f74e1f3e458f4e48d6c840e0f4d16ed72ffbc4611dbb2
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\c-libutl.md
Filesize1KB
MD52e89a282a50f8702e52703464e6937ca
SHA1cfc22a6f5b17cd539234d5b3160a5224abefadb9
SHA256bef40679922d6fdfb7e4ddb223ad6722300f6054ba737bbf6188d60fcec517f9
SHA512ae459d8ce5581ea57e203088373c1ce86d122d0e27eb871ee1383e0e64cd8a184fa207eee0e835347316e70afa24a1c95aec30def3e09d15ee19a0b2c3ad2095
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\public_suffix.md
Filesize17KB
MD51411e0a639389f2dbb2b21490a5c0713
SHA11706fdcd0dbf23d793f81f4130c81a8d16b4f765
SHA256e662969300048d914f80265eb516021ad2b0015c7e7eedd45c93655f11f256d7
SHA512cbd16c4c29a51669f51ff9817ed33e29b871df215fb252a946c3b4e80fc83d4f0e4e1b32d46c2998924092e4b14585666f748b598708773dc6d2432701d6f627
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\wepoll.md
Filesize1KB
MD5cef1d92ff8ace278bd32ac5e18735b86
SHA16c7d15e2b8f3e99527458c8ea33420ee1d34af7b
SHA2563ac2992770080453b98c42afa807ba4b2c1738ef756b92a55c645f55e7df48f0
SHA51212aa61ae93fc626a230f39f44ca11c75086fd9bb50f2794fb9fec29b9bef924545fc19d9cb38fda631560ca78ae8e587144cf3cf3c83a6b336bb4711611393bf
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\zlib.md.tlauncherdownload
Filesize1011B
MD5440321d71d082c9f04a9995b613bdff2
SHA19af688d499b3026ec8e5a2e266dc4b9b4884a87b
SHA25681518ebc49d23a7c77b2e08eff48664ea0c7dd90957a0caf22fd9654985d3285
SHA512c516403a109630b79998f3bea6b698247a0b5367cc9873defa75014e8c98c690d34d0810d32792d80fde1333980ac6c5f19324743795cb6455ef0ee4979496bb
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.compiler\LICENSE.tlauncherdownload
Filesize32B
MD5663f71c746cc2002aa53b066b06c88ab
SHA112976a6c2b227cbac58969c1455444596c894656
SHA256d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
SHA512507b7d09d3bcd9a24f0b4eeda67167595ac6ad37cd19fb31cd8f5ce8466826840c582cb5dc012a4bd51b55e01bb551e207e9da9e0d51948e89f962ba09606aab
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\ADDITIONAL_LICENSE_INFO.tlauncherdownload
Filesize48B
MD5512f151af02b6bd258428b784b457531
SHA184d2102ad171863db04e7ee22a259d1f6c5de4a5
SHA256d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
SHA5121a305bc333c7c2055a334dc67734db587fd6fda457b46c8df8f17ded0a8982e3830970bee75cc17274aa0a4082f32792b5dbff88410fa43cc61b55c1dce4c129
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\ASSEMBLY_EXCEPTION.tlauncherdownload
Filesize43B
MD5bd468da51b15a9f09778545b00265f34
SHA1c80e4bab46e34d02826eab226a4441d0970f2aba
SHA2567901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
SHA5122c1d43c3e17bb2fca24a77bea3d2b3954a47da92e0cdd0738509bffcdbe2935c11764cd5af50439061638bba8b8d59da29e97ea7404ea605f7575fc13395ca93
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\colorimaging.md
Filesize167B
MD50889fd01a6802a5a934572d9bd47f430
SHA17a7e547452ee1c72e8b0d96dccbe315f62d5b564
SHA25604d61e3e8e71dd452ebe52008af5378d9f6640d14578aeb515dc5375973b0189
SHA512f5872960470810cdbdc2db1dfb216cab88203b23400b16e157c8654c2eecff8d9b26ce066ec18718c8e6d54ee1c54533fdade395c454210fed5159fd4a7a0adb
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\giflib.md
Filesize1KB
MD5867001e2a577f88cfc856f45959502aa
SHA1109c11cec13349212ba94b9f3eb7d0943229938e
SHA256c8b99f33890887d27ad56fba9edd8ebbc668cfe0689168505a95613d1d4b32f8
SHA512dafac31d75a7ab4ddd7666799a24abf22c1583ca22554a738cc26a77bf927b20dde52f12194670a5196bce3a43bd58de46944291727c8877fee1fe4a38a1f1ca
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\lcms.md.tlauncherdownload
Filesize2KB
MD504a8a77cafdd6185a3506eccf7a83346
SHA11acbec21e9eab8bd2bee9826353c1e768d5457b5
SHA2568acf00b5efd25c1c055927222fd3c26b0c9fd02ed02e478c225b64e7a24d9782
SHA512a91faa243a09bdfe62714859b9b4420e8434dd09693a6a280e1c8ef6694fb7858d0171fae4ca36721b685e3ab8bc8000c5635bf3789250a5b9081130eb4ff57c
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\mesa3d.md.tlauncherdownload
Filesize5KB
MD5c7e0d19c8f4eff11e97f0eb9afd3f7f4
SHA16a98ee2703132e181f37d162452f073fb64ced83
SHA25663f4e6f75caebbccb95d903fb43e46ac7111b3624d0a34f146b276d7d9e7b152
SHA5129c4111728ab9472f0b160cb11ce1e4ebd75a83cfddca0b3cb87243d15afc5a7fa34dc6006e6b92084648cbad1426f70b405259f589cdef758442643e1618dff4
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.xml\bcel.md
Filesize10KB
MD5daae908a4dd474afec9c010d416acb2d
SHA1a59717166af2e8fa9ecd6d622fd6b82b835acce9
SHA256853a1e7ce397bb10de0e2b3bde0844bcc651f17d983decd07d2d003c0304c311
SHA51225f2189643a113616f53cd87fc96df01b55602bfc3f6653e48c310de03f6d79ccbbec58936d54b88052e32d68c646017bf75b8a179f59fb9d2c5f6938e351a4d
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.xml\dom.md
Filesize3KB
MD513952c46b3867103ad7d1e9c6c9e906c
SHA14bf3f9908314b05f3b0f6e27be2c1fb7e25fffbb
SHA2566686e8877667584a3a7c07344baadca1a03e29f677162d87c3c0811e990d1148
SHA5128c71f226f0f07b471aea6b8e715434b5eaa6b4a59a653ec22c2489e743e9288a0c4537f479719f9d58737d0257470c9cceff9ce647a96e79fd757a4cdcfed499
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.xml\jcup.md
Filesize1KB
MD5d19594fbf6eab2242dc29257905d8ded
SHA1fbdcbe5a7e7d91d440c200f5fb00e0cf6a81976c
SHA2568d5dcfdf50455a3c34c753a98f21e953248af200415a9084e3f102cb6c43b8bf
SHA5127ed3e58f189f2922f7543d4617308d0c35f8adc2e7cbbb6fbba49d33cdd5da64c6edc022ae9842c28e58d97b056a245245c816003978f1e0152236636ca72ba5
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md
Filesize3KB
MD5fa24b7e2a61a7045cb0c6c385000681b
SHA1869fc0b687986ea26b8ff63c137e03c92234a5c8
SHA256262802e081760b38b3748c8b194353d340e39bc936ac22e17abbb7158d895811
SHA5122676cfdfd61762c7b6171985e8cfe1068c36683ca43753a1ffb10241ac61a74c9be1c00be22903df85ba6954fd908d77de60903c316506fd88b9679672ada968
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.crypto.cryptoki\pkcs11wrapper.md
Filesize2KB
MD5b77d1951df7a8488eb84ce1d25486a14
SHA1e35415235ec3bbcb92beeceb03a9a8e7c13a6fce
SHA256371974b1fca3744a3892c7ee1fcc593b8b4281fc218f4cafd2f709e9df5fd81d
SHA512759c75f87309b67c56a5b7088045e04be7c023ecdbaea80842e22b81b0bfb36026191070471f8b08fef47ec73664611ce0453b4a9818f7708c95663733ee5ce9
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.internal.opt\jopt-simple.md
Filesize1KB
MD54f3f190fd212329afc39442174ca4b3a
SHA1d7e25adf223e68d06276ae7666bbc96590dda442
SHA25699bc67f93cf57d6d20e6047731c93fbb267d70fbdd4115d119e0f85c6efe5c05
SHA512fdd3d2fcfd865f62dad0ba2617ea816c78a3dc9d99d8991ffb5eb479fda37317dc3f70b0dcdb1847ffe4432947690436ad4046bfb056c37e2991e6fefa8b70c0
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.javadoc\jquery.md
Filesize2KB
MD58ef4ab67241efd69eaa3df9871fa0dbd
SHA1a20a019c3b06d4263b00f5e89ed394a52b8c1981
SHA2560716943682c624fd2f49b3a718a2ed4d6386e872fe741f1c759573ae24509d3e
SHA5121f85e70e166146d81457f05be906f18b9b16ed82bed5f544f090d894b8d0cb1ff4fe5fffd90022f06f2024b2dbf74a30f2940a21941871358469b1f9a1a19998
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.javadoc\jqueryUI.md
Filesize1KB
MD586bfe7b4e5cbedc085060a2c3f13febe
SHA1a98cfdc7d73e016ce8b23c1d00daa3d2d3c03a3d
SHA256bb0a0e89ebd824df714516bf64b9101c62081e4b376f00f929a58c09555bf111
SHA5122656ab0100db997c9306be156af613861c9071a3be1b26f2882a68424e37d1b17674183729c1ba1024302011d42658058f024ce98db5bbb4d528c498ddd21d6e
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.localedata\thaidict.md
Filesize1KB
MD52ea6eb55ca40902554aaf2fd20a76ba8
SHA1e5b9e88e174c797c313d6739e7e34772b723bc4b
SHA256c326144a2351c9608fa708b5d7d3c5a3da03e82b66479b128e9db4969539824a
SHA5125221112cd8ef83b636dc4364f53b72c5484a5885acb55c2c071c88d23058093caee38578f7e424ecafdb483ccc0bc8e78d7ac13add536ec824a8eac171a576cb
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\lib\jvm.cfg
Filesize29B
MD57ce21bdcfa333c231d74a77394206302
SHA1c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA256aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
SHA5128b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\lib\security\blocked.certs.tlauncherdownload
Filesize2KB
MD58273f70416f494f7fa5b6c70a101e00e
SHA1aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA256583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
SHA512e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\lib\tzdb.dat.tlauncherdownload
Filesize101KB
MD52fd920c56de68f65493ba6962fd079e1
SHA11e79bff02711d3dab3c75e90d4bb08f8086c9626
SHA256b7dba25abdfee317daa042c89b01e5711f5781d020dd733ba411760b72addb93
SHA512958f835407e4a10a268bf76bc2ef0196ecd5fa92e139de4c3760544dbdf76f95e67865bac22406aef8ac5ae7508fe63cd1a688c8328e46b73a5867efa4f18d47
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\lib\tzmappings
Filesize21KB
MD54c30d7867505379a18a27d0e8f03198c
SHA10cc871d5bd91e061d676a861749af68bbc0ca9c6
SHA256b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
SHA512873d329682ce67267f438b88eee0fc25cecbbcc1f7d694118417ad12756ec2b6ae7502ec4eea0cc9b4ae8b9e68f5f8877762fa13dea89c4a6dcd54fd8bf82c56
-
Filesize
45KB
MD58d3ab0397e7ba9efa2846eeef91fadb9
SHA1b4cf2276b49eea398f235eb31ee2a4cf0164ddcc
SHA2565c27f4cc28f3b669cb5451a8409cd4e29e33602e88069c3cd1d8c665817a6d86
SHA51231823f9228b0a2fd92f53ac9bfee6d7bd7875728a5fd460185a94be61d1b2561191a8045da0c0ced531584db6adb2ef3cb9e012ea45eba0ef12418a04036829e
-
Filesize
22KB
MD56e040558ab4d86db9d6b58aa116f65c6
SHA1fce17cede4b509099f1a52c3ac4e047253377619
SHA256388b06a9890ad0d80aa3620e5d5853cb467d3d5a7ea7b200897efa6b6153b49d
SHA512a5e77e570b0759424142e2badb76951201af795f38f753820a7474929618cb851559f041d46e3a71494bd10c35a99e9169a17768c4948d1aa037fa94e6edd06e
-
Filesize
451KB
MD52d8d4b541d3df569c36b6e98a4be59d0
SHA18c875bbc8e0a397fc7e06fa37623cfcdbed88761
SHA256e04c2dfbcc8701b8a5c64f0657a97e0251436c17b2fa29c58d554e8c5219b9a7
SHA5126d83b7fc796e58f68aac35f54e3912c54e306b7587ed926b4193553be0d86b929ad8ac4dd513a3a3452f6a849b6fc730e5fd417427190392c94c22b42935e33c
-
Filesize
40KB
MD5ba6defc25ef1ccdcc057928b48c22e1d
SHA172bbb71e57cb3968eaa900384b81922df7609091
SHA256ea2720f1479ee4f30b247d62dd1c651490f7bb7b0b70a9e1fc842caa1be0ff36
SHA512319e4fe82803cc90fbdedacbc557767d068a446ff1fd849c0df2691553c3bbc75916458a92f17a29de21d869cd29d82324fd8f75e9b4fdd41e5dc4d0f00019eb
-
Filesize
41KB
MD5d3131c8c7da096272bcc268678e15220
SHA1a9b29220df37778dba60c01106dfd273fe39747c
SHA256f0302843a75c970983da062efda4ab15b543d7eab9144397e0f5ab79b2afe7e5
SHA512b97032c7dd764d0aa7821cc71e75119dcf8caf546f573cd34b4e9f014bba4e4a875b3d92810cdb8eeacf1329b0bc869ab82f12fb8a5f8dbae2c96eff780449c5
-
Filesize
475B
MD5acb28002101f619758b078ea59ae43af
SHA1bb4ba45f34d4322373024314b5f907ad3c4df951
SHA256883cdd488bcf9430a0a528ab243749a0d8bcc1b76ea07baacad156c58ada374c
SHA5126d7493216dc1ac3b576ad7c294756d68678394de15f60039e81cc53ab6804fb616620aa37218b16afb2a5ec3175e1cd914fa2c0ce9ca8ac2f0539d641b23d2ef
-
Filesize
368B
MD52caa7c010df8b7f1dae4000801f13e10
SHA1c550373cdf64262baea708ec3c975ff5067db357
SHA2561625e6fe0ae1521dae012445b1c7f83f5c453e343371b4336f4437da03a00b61
SHA512b5defb1bac181070a9e93e6fddce5efebd391e91d7f180dafe1d2ed8e8761463ab18e4d601c30ba2dc1116e97ac4576a93c0c085a22a433df2a18fc43ea15eb0
-
Filesize
4KB
MD5697c1feea0e855bcb5c314d82957d94e
SHA1ceb2cf8f56e487e9167b9ddb8986650393c31eb4
SHA2566fc1a5bd5060ec18de017982b583264a6ac1c6086e4e63b85f673e07549b0559
SHA51200b27882cdf71b9eb860ec94277939abf661d902dfb4a3d904a5b2836e2b7e428f623df1a42045a84ca1f1acf5c6fddbd8b5be709484e138b3602c13f77b4037
-
Filesize
4KB
MD5be86357bb4b48e3b2687409808619ec3
SHA16bedffe72b163aa0871684c5c8280baae1e72798
SHA256a87d4857b5199ad2ecb626d366f0b678e73d31acf8d89f9ec4cae4edca430da7
SHA512873eb6ddea3fd5c53990bd08d95f9f91d3d29bc0890698f72d372839a260b20b91d8465751f584971d2dd07d24f16107a09ab87791768624f9aaa65d4c5251d3
-
Filesize
6KB
MD510f09c6af8f21d07c848db96817955ce
SHA1b7eb780acd9c4465ac80576f0a4d9e1a2f9ee8ad
SHA256a8b36cb775031e9f657f7dea5b035781ffa5b4c57dfe1817e1e56a64ead34f0f
SHA512a618ed152434dd5cba32ab68c49da6edac3012708bceb62856a983d62b111991d6c333282519ebf3ce861e0150410bb7a6be139e39a333dc2bc2ee2b18d5b8c8
-
Filesize
23KB
MD545e5c8fae86a286bd723186b45441ad8
SHA111cb8f461e23cb26edd435a45cf70f4757ebd181
SHA2565da46895ab27df3741c1c7c2d3af074bddfae7c16bfacc6a68df39416b70cea9
SHA51230fbf69f90689a418abec3c8446621854aedb96a886f78bd32d013d0a65dd33cff3a62b3cc4e1d64a565e0b005032333cd1c4b4fbff4eaef690cf23a97ce69da
-
Filesize
2KB
MD54a3382a1e888b8b0b32c5db6090c624d
SHA171f7ab8820c43a9787f8e630b48621512506b312
SHA256a231adf5fb8de9fcc5c3577247952faf54037ab1492e029e380a0faae7fffc72
SHA512e7bd012ddffc2c998489241f2a0a74256f4ada154336b5aeac4d5ed2c605888603d32bd34d94279d48a20fab4a73d5dcec40d02c2c4e416e37af416148ede9a0
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9289\dependencies.json
Filesize17KB
MD56d566646f2f374692a6a8b76ff23f59e
SHA143025f5b97daa38aeec3407cc20bf60740a319db
SHA256b700139641a3d5493cb28c9ce00408f70e4e48083c80ed5693c6ae840ee93dd9
SHA5120e949c4f50656bdbe4bd2ff47661ac62c942b5744d316242e68306bb751bcfe778037ebbcbcd31188125cc88cc243a497fbea6ccf96701668555df5a35586e34
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9289\resources.json
Filesize18KB
MD5f24f4282f4dbdc650884bd55033d7df3
SHA15c1aeb01a17701d7b35dd3454b4088dcd82f396d
SHA2565690815ca9ad02021f49c1df8fd360a1ac29ef3781c15cb074a064b8669d12a2
SHA5129d02cad4043de8c09498ed629c5d0c7763f8f4c35166919879acfb3670961e2b943234d0e721cd6b28485af477905437ec4743b41b2dbf8622d7831b0a62801e
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
Filesize3KB
MD5aba7fce4661d0d6ea8c40eb63f4718b0
SHA10fefed36b06f8a784736dbd504450b1574ada129
SHA256551d3edbcbea195bc37a1ad887a21452131c132123d1a643be43411932403fee
SHA5126fee54c2a174743342165846811e39c32eca318b424d1f8a138951cd1c5b0a9c033e5490921b943b84bf47197ede9bbf9c052292295032413abc54c8d63e806d
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig.json
Filesize3KB
MD5e2cbea0a8a22b79e63558273dded5e6c
SHA1bfbbbba0679adcbcf9e079ed3c7c7a60cb0b2d61
SHA25610d0f3646be0a7d73942d7bdd1e55c4b8df0c34cad7ad15a9dc23b2932155007
SHA512a6aa26ff49c911fb4705df1e8e434c72e206b20fdaae0abc529e2734f5db49c75da35c3d75769e0ac1b6795de540de4c7e1089b387217fc58f8b19b023064e5a
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\COPYRIGHT
Filesize35B
MD54586c3797f538d41b7b2e30e8afebbc9
SHA13419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA2567afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
SHA512f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\LICENSE
Filesize33B
MD516989bab922811e28b64ac30449a5d05
SHA151ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA25686e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
SHA51286571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO
Filesize51B
MD5494903d6add168a732e73d7b0ba059a0
SHA1f85c0fd9f8b04c4de25d85de56d4db11881e08ca
SHA2560a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
SHA512b6e0968c9fd9464623bfa595bf47faf8f6bc1c55b09a415724c709ef8a3bcf8a954079cce1e0e6c91d34c607da2cecc2a6454d08c370a618fb9a4d7d9a078b24
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION
Filesize46B
MD5c62a00c3520dc7970a526025a5977c34
SHA1f81a2bcb42ccbf898d92f59a4dc4b63fef6c2848
SHA256a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
SHA51260907d1910b6999b8210b450c6695b7cc35a0c50c25d6569cf8bb975a5967ca4e53f0985bee474b20379df88bb0891068347ecf3e9c42900ed19a1dcbc2d56ec
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\LICENSE
Filesize35B
MD5f815ea85f3b4676874e42320d4b8cfd7
SHA13a2ddf103552fefe391f67263b393509eee3e807
SHA25601a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
SHA512ddf09f482536966ac17313179552a5efc1b230fa5f270ebde5df6adebf07ee911b9ef433dfbfcb4e5236922da390f44e355709ecaf390c741648dd2a17084950
-
Filesize
1KB
MD5311c065bb27c314cbbf5e7ac58783e0b
SHA1acf13541498d35415d0edd3bac0369288bb05868
SHA256b8696d74815795ceed46b4bfbb83d29ef4bf0c1cb153137b1df9ee69b7a3169e
SHA512b3a5c61ab1fe63665d600b08528d4c1b7d4226ffda8ccbb5710e292edf5a66b24c14ffde5aab1bf4f6da91c0b2d4b0aca03a9671098cea53e73d2ac474017be1
-
Filesize
953KB
MD564a261a6056e5d2396e3eb6651134bee
SHA132a34baf051b514f12b3e3733f70e608083500f9
SHA25615c1007015be7356e422050ed6fa39ba836d0dd7fbf1aa7d2b823e6754c442a0
SHA512d3f95e0c8b5d76b10b61b0ef1453f8d90af90f97848cad3cb22f73878a3c48ea0132ecc300bfb79d2801500d5390e5962fb86a853695d4f661b9ea9aae6b8be8
-
Filesize
235KB
MD516cae7c3dce97c9ab1c1519383109141
SHA110e29384e2df609caea7a3ce9f63724b1c248479
SHA2568acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2
SHA5125b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69
-
Filesize
1.0MB
MD5d7390d55b7462787b910a8db0744c1e0
SHA1b0c70c3ec91d92d51d52d4f205b5a261027ba80c
SHA2564a2f7d9d33e4ad643bf72722587f2b268d92dab3bb1d9bc56af316672e34728a
SHA51264f3837dd6099561ce9be97d6fae0b11f3f6cc08281f1a3266d5a6f3ca8baf13bbd780735ef62b449b577d62d086f942b48519671226c60f0e1480f9dbdde434
-
Filesize
1.7MB
MD5dabd469bae99f6f2ada08cd2dd3139c3
SHA16714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b
SHA25689acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606
SHA5129c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915
-
Filesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
Filesize
1.2MB
MD59f2cbab656781156f02719d178f03397
SHA176314dae18fe0a180741092dd6d92e2e482d7189
SHA256d598a49b789c47ca2187a42b24ac9b00d16021865110649bc5b5022742f6856f
SHA51230480de042c8ef4c09da126a3bfd00aee794bbc0ecedf153542dd9395a74378e1a65d3df51ee877be1e875ff8f86bcb4988fa067aac4f7b35098bb9c896e8d47