tmppe9y2v46
This report is generated from a file or URL submitted to this webservice
on June 17th 2022 21:11:57 (UTC) and action script
Heavy Anti-Evasion
Guest System:
Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by Falcon Sandbox © Hybrid Analysis
Incident Response
Risk Assessment
- Remote Access
- Contains ability to listen for incoming connections
- Persistence
-
Grants permissions using icacls (DACL modification)
Spawns a lot of processes - Fingerprint
-
Has the ability to get the host address
Queries the display settings of system associated file extensions
Reads system information using Windows Management Instrumentation Commandline (WMIC) - Evasive
- Possibly tries to implement anti-virtualization techniques
- Network Behavior
- Contacts 3 domains and 3 hosts. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 4
-
Installation/Persistence
-
Writes data to a remote process
- details
-
"javaw.exe" wrote 32 bytes to a remote process "%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\javaw.exe" (Handle: 1232)
"javaw.exe" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Roaming\.tlauncher\jvms\jre1.8.0_111\bin\javaw.exe" (Handle: 1232)
"javaw.exe" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Roaming\.tlauncher\jvms\jre1.8.0_111\bin\javaw.exe" (Handle: 1232)
"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 132)
"cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 132)
"cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 132)
"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 128)
"cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 128)
"cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 128)
"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 84)
"cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 84)
"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 80)
"cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 80)
"cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 80)
"cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 84)
"javaw.exe" wrote 32 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 464)
"javaw.exe" wrote 52 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 464)
"javaw.exe" wrote 4 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 464) - source
- API Call
- relevance
- 6/10
- ATT&CK ID
- T1055 (Show technique in the MITRE ATT&CK™ matrix)
-
Writes data to a remote process
-
System Security
-
Modifies the access control lists of files
- details
- Process "icacls.exe" with commandline "%ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage\fbadb5649d7bf34f.timestamp /grant "everyone":(OI)(CI)M" (Show Process)
- source
- Monitored Target
- relevance
- 5/10
- ATT&CK ID
- T1222.001 (Show technique in the MITRE ATT&CK™ matrix)
-
Modifies the access control lists of files
-
Unusual Characteristics
-
Contains native function calls
- details
- ntlmHash@NTLMEngineImpl at eade98d11737193c24648276433a0829-10c85
- source
- Hybrid Analysis Technology
- relevance
- 5/10
- ATT&CK ID
- T1106 (Show technique in the MITRE ATT&CK™ matrix)
-
Spawns a lot of processes
- details
-
Spawned process "javaw.exe" with commandline "-jar "C:\tmppe9y2v46.jar"" (Show Process)
Spawned process "cmd.exe" with commandline "/C chcp 437 & wmic os get osarchitecture" (Show Process)
Spawned process "chcp.com" with commandline "chcp 437" (Show Process)
Spawned process "WMIC.exe" with commandline "wmic os get osarchitecture" (Show Process)
Spawned process "cmd.exe" with commandline "/C chcp 437 & wmic os get osarchitecture" (Show Process)
Spawned process "chcp.com" with commandline "chcp 437" (Show Process)
Spawned process "WMIC.exe" with commandline "wmic os get osarchitecture" (Show Process)
Spawned process "javaw.exe" with commandline "%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\javaw.exe -Xmx1024m -Dfile.encoding=UTF8 -cp C:\tmppe9y2v46.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\log4j\log4j\1.2.17\log4j-1.2.17.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.5\picture-bundle-3.5.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar; org.tlauncher.tlauncher.rmo.TLauncher" (Show Process)
Spawned process "icacls.exe" with commandline "%ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage\fbadb5649d7bf34f.timestamp /grant "everyone":(OI)(CI)M" (Show Process) - source
- Monitored Target
- relevance
- 8/10
-
Contains native function calls
-
Suspicious Indicators 24
-
Cryptographic Related
-
Found a cryptographic related string
- details
-
"RC4" (Indicator: "rc4"; File: "dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin")
"DES" (Indicator: "des"; File: "dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin") - source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1486 (Show technique in the MITRE ATT&CK™ matrix)
-
Found a cryptographic related string
-
Environment Awareness
-
Possibly tries to implement anti-virtualization techniques
- details
- "/Library/Java/JavaVirtualMachines" (Indicator: "virtualmachine")
- source
- File/Memory
- relevance
- 4/10
- ATT&CK ID
- T1497 (Show technique in the MITRE ATT&CK™ matrix)
-
Reads the cryptographic machine GUID
- details
-
"javaw.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
"WMIC.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID") - source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1082 (Show technique in the MITRE ATT&CK™ matrix)
-
Possibly tries to implement anti-virtualization techniques
-
General
-
Reads configuration files
- details
-
"javaw.exe" read file "%APPDATA%\Microsoft\Windows\Recent\desktop.ini"
"javaw.exe" read file "%USERPROFILE%\Desktop\desktop.ini"
"javaw.exe" read file "C:\Users\%USERNAME%\Documents\desktop.ini"
"javaw.exe" read file "C:\Users\%USERNAME%\Desktop\desktop.ini" - source
- API Call
- relevance
- 4/10
-
The analysis extracted a file that was identified as malicious
- details
- 1/72 Antivirus vendors marked dropped file "JavaAccessBridge-32.dll" as malicious (classified as "Unsafe.AI_Score_99%" with 1% detection rate)
- source
- Binary File
- relevance
- 10/10
-
Reads configuration files
-
Installation/Persistence
-
Drops executable files
- details
-
"fontmanager.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\fontmanager.dll]- [targetUID: 00000000-00002800]
"java.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\java.exe]- [targetUID: 00000000-00003840]
"javaw.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\javaw.exe]- [targetUID: 00000000-00002800]
"jsound.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jsound.dll]- [targetUID: 00000000-00003840]
"jfxwebkit.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jfxwebkit.dll]- [targetUID: 00000000-00003840]
"decora_sse.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\decora_sse.dll]- [targetUID: 00000000-00003840]
"j2pcsc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\j2pcsc.dll]- [targetUID: 00000000-00003840]
"orbd.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\orbd.exe]- [targetUID: 00000000-00003840]
"javafx_font.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javafx_font.dll]- [targetUID: 00000000-00003840]
"jfxmedia.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jfxmedia.dll]- [targetUID: 00000000-00003840]
"ssvagent.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\ssvagent.exe]- [targetUID: 00000000-00003840]
"jp2launcher.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jp2launcher.exe]- [targetUID: 00000000-00003840]
"javacpl.cpl" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javacpl.cpl]- [targetUID: 00000000-00003840]
"jawt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jawt.dll]- [targetUID: 00000000-00003840]
"instrument.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\instrument.dll]- [targetUID: 00000000-00003840]
"jvm.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\client\jvm.dll]- [targetUID: 00000000-00002800]
"tnameserv.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\tnameserv.exe]- [targetUID: 00000000-00003840]
"JavaAccessBridge.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\JavaAccessBridge.dll]- [targetUID: 00000000-00003840]
"t2k.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\t2k.dll]- [targetUID: 00000000-00002800]
"glib-lite.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\glib-lite.dll]- [targetUID: 00000000-00003840] - source
- Binary File
- relevance
- 10/10
-
Drops executable files
-
Network Related
-
Found potential IP address in binary/memory
- details
-
"127.0.0.1"
Potential IP "127.0.0.255" found in string "127.0.0.255"
0
"no-host" - source
- File/Memory
- relevance
- 3/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
-
TCP traffic to 78.46.66.120 on port 80 is sent without HTTP header
TCP traffic to 104.20.234.70 on port 443 is sent without HTTP header
TCP traffic to 104.20.235.70 on port 443 is sent without HTTP header - source
- Network Traffic
- relevance
- 5/10
-
Found potential IP address in binary/memory
-
Remote Access Related
-
Contains indicators of bot communication commands
- details
-
"ServerList(newServers=" + this.getNewServers() + ", removedServers=" + this.getRemovedServers() + ", clientChangedAddress=" + this.getClientChangedAddress() + ")" (Indicator: "servers=")
"PopupMenuModel(servers=" + this.getServers() + ", info=" + this.getInfo() + ", mainPage=" + this.isMainPage() + ", selected=" + this.getSelected() + ")" (Indicator: "servers=") - source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1095 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains indicators of bot communication commands
-
System Destruction
-
Marks file for deletion
- details
-
"%PROGRAMFILES%\Java\jre1.8.0_151\bin\javaw.exe" marked "%APPDATA%\.tlauncher\jvms\jre-8u111-windows-i586.zip" for deletion
"%PROGRAMFILES%\Java\jre1.8.0_151\bin\javaw.exe" marked "%APPDATA%\.tlauncher\doubleRunningProtection.txt" for deletion
"%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\javaw.exe" marked "%TEMP%\imageio5732438353603621495.tmp" for deletion - source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1070.004 (Show technique in the MITRE ATT&CK™ matrix)
-
Opens file with deletion access rights
- details
-
"javaw.exe" opened "C:\Users\%USERNAME%\AppData\Roaming\.tlauncher\jvms\jre-8u111-windows-i586.zip.tlauncherdownload" with delete access
"javaw.exe" opened "C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar.tlauncherdownload" with delete access
"javaw.exe" opened "C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar.tlauncherdownload" with delete access
"javaw.exe" opened "C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.5\picture-bundle-3.5.jar.tlauncherdownload" with delete access
"javaw.exe" opened "C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar.tlauncherdownload" with delete access
"javaw.exe" opened "C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar.tlauncherdownload" with delete access
"javaw.exe" opened "C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar.tlauncherdownload" with delete access
"javaw.exe" opened "C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar.tlauncherdownload" with delete access
"javaw.exe" opened "C:\Users\%USERNAME%\AppData\Roaming\.tlauncher\doubleRunningProtection.txt" with delete access
"javaw.exe" opened "%TEMP%\imageio5732438353603621495.tmp" with delete access - source
- API Call
- relevance
- 7/10
- ATT&CK ID
- T1070.004 (Show technique in the MITRE ATT&CK™ matrix)
-
Marks file for deletion
-
System Security
-
Grants permissions using icacls (DACL modification)
- details
- Process "icacls.exe" with commandline "%ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage\fbadb5649d7bf34f.timestamp /grant "everyone":(OI)(CI)M" (Show Process)
- source
- Monitored Target
- relevance
- 3/10
- ATT&CK ID
- T1222.001 (Show technique in the MITRE ATT&CK™ matrix)
-
Has the ability to execute native tools
- details
-
Runtime.getRuntime().exec( at eade98d11737193c24648276433a0829-9ece, Process p = Runtime.getRuntime().exec(command); at eade98d11737193c24648276433a0829-1896e
Process p = Runtime.getRuntime().exec( at eade98d11737193c24648276433a0829-189d0 - source
- Hybrid Analysis Technology
- relevance
- 10/10
-
Queries the display settings of system associated file extensions
- details
-
"javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.LNK"; Key: "ALWAYSSHOWEXT")
"javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "ALWAYSSHOWEXT")
"javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "NEVERSHOWEXT") - source
- Registry Access
- relevance
- 7/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Grants permissions using icacls (DACL modification)
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"javaw.exe" wrote bytes "c04e217720542277e0652277b53823770000000000d05f7600000000c5ea5f760000000088ea5f7600000000e968307582282377ee29237700000000d2693075000000007dbb5f760000000009be307500000000ba185f7600000000" to virtual address "0x77331000" (part of module "NSI.DLL")
"javaw.exe" wrote bytes "fae61e77e1a623772e712377ee29237785e21e776da0237726e41e77d16d2377003d2177804b217700000000ad3700778b2d0077b641007700000000" to virtual address "0x74551000" (part of module "WSHTCPIP.DLL")
"javaw.exe" wrote bytes "e7391f77e1a623772e712377ee29237785e21e776da02377906422773ad5297726e41e77d16d2377003d2177804b217700000000ad3700778b2d0077b641007700000000" to virtual address "0x74AA1000" (part of module "WSHIP6.DLL")
"cmd.exe" wrote bytes "c04e217720542277e0652277b53823770000000000d05f7600000000c5ea5f760000000088ea5f7600000000e968307582282377ee29237700000000d2693075000000007dbb5f760000000009be307500000000ba185f7600000000" to virtual address "0x77331000" (part of module "NSI.DLL")
"WMIC.exe" wrote bytes "c04e217720542277e0652277b53823770000000000d05f7600000000c5ea5f760000000088ea5f7600000000e968307582282377ee29237700000000d2693075000000007dbb5f760000000009be307500000000ba185f7600000000" to virtual address "0x77331000" (part of module "NSI.DLL")
"javaw.exe" wrote bytes "10b4a342" to virtual address "0x6FA7B8E0" (part of module "GROOVEEX.DLL")
"icacls.exe" wrote bytes "c04e217720542277e0652277b53823770000000000d05f7600000000c5ea5f760000000088ea5f7600000000e968307582282377ee29237700000000d2693075000000007dbb5f760000000009be307500000000ba185f7600000000" to virtual address "0x77331000" (part of module "NSI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1056.004 (Show technique in the MITRE ATT&CK™ matrix)
-
Reads information about supported languages
- details
-
"javaw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")
"javaw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")
"cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
"cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")
"cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")
"chcp.com" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
"chcp.com" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")
"chcp.com" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")
"WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")
"WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")
"WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN")
"WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")
"WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") - source
- Registry Access
- relevance
- 3/10
- ATT&CK ID
- T1012 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
-
Hiding 8 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Informative 21
-
Anti-Reverse Engineering
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
- details
- "javaw.exe" is protecting 16384 bytes with PAGE_GUARD access rights
- source
- API Call
- relevance
- 10/10
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
-
Environment Awareness
-
Contains ability to query the machine version
- details
-
getVersions@List at eade98d11737193c24648276433a0829-5fe
getVersions@List at eade98d11737193c24648276433a0829-6c0
JAVA_8_LEGACY : launcher.getVersion@JavaVersionName at eade98d11737193c24648276433a0829-f41
getVersion@ConfigurationDefaults at eade98d11737193c24648276433a0829-10af
getVersion@List at eade98d11737193c24648276433a0829-2c6e
this.launcher.getVersion@TLauncher at eade98d11737193c24648276433a0829-3fa3
versions.getVersion@Form at eade98d11737193c24648276433a0829-5948
versions.getVersion@Form at eade98d11737193c24648276433a0829-5a3e
versions.getVersion@Form at eade98d11737193c24648276433a0829-5d63
this.entity
GameLeftElement.this.entity.getVersion@Element at eade98d11737193c24648276433a0829-723e
getVersion@Container at eade98d11737193c24648276433a0829-8e07
getVersion@TLauncher at eade98d11737193c24648276433a0829-935b
getVersion@TLauncher at eade98d11737193c24648276433a0829-9580
getVersion@TLauncher at eade98d11737193c24648276433a0829-a12e
getVersion@HttpProtocolParams at eade98d11737193c24648276433a0829-ef18
getVersion@HttpProtocolParams at eade98d11737193c24648276433a0829-11c3f
getVersion@HttpProtocolParams at eade98d11737193c24648276433a0829-12543 - source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1082 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
-
External Systems
-
Sample was identified as clean by Antivirus engines
- details
- 0/59 Antivirus vendors marked sample as malicious (0% detection rate)
- source
- External System
- relevance
- 10/10
-
Sample was identified as clean by Antivirus engines
-
General
-
Contacts domains
- details
-
"res.tlauncher.org"
"cl1-res.tlauncher.org"
"cl2-res.tlauncher.org" - source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
-
"78.46.66.120:80"
"104.20.234.70:443"
"104.20.235.70:443" - source
- Network Traffic
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\__DDrawExclMode__"
"\Sessions\1\BaseNamedObjects\Local\__DDrawCheckExclMode__"
"Local\__DDrawCheckExclMode__"
"Local\__DDrawExclMode__" - source
- Created Mutant
- relevance
- 3/10
-
Drops files marked as clean
- details
- Antivirus vendors marked dropped file "CHCP.COM.62ACF3C0.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.62ACF6CC.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "jaccess.jar" as clean (type is "Java archive data (JAR)"), Antivirus vendors marked dropped file "sunec.jar" as clean (type is "Zip archive data at least v2.0 to extract"), Antivirus vendors marked dropped file "fontmanager.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "java.exe" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "javaw.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "jsound.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "jfr.jar" as clean (type is "Java archive data (JAR)"), Antivirus vendors marked dropped file "decora_sse.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "j2pcsc.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "orbd.exe" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "javafx_font.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "jfxmedia.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ssvagent.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "plugin.jar" as clean (type is "Java archive data (JAR)"), Antivirus vendors marked dropped file "jp2launcher.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "sunjce_provider.jar" as clean (type is "Zip archive data at least v2.0 to extract"), Antivirus vendors marked dropped file "javacpl.cpl" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "jawt.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")
- source
- Binary File
- relevance
- 10/10
-
Found API related strings
- details
-
"org/tlauncher/util/salf/connection/" (Indicator: "connect") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/tlauncher/util/salf/connection/ArchiveFilesDescription.class" (Indicator: "connect") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/tlauncher/util/salf/connection/ConfigSeacher.class" (Indicator: "connect") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/tlauncher/util/salf/connection/ServerEntity.class" (Indicator: "connect") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/tlauncher/util/StringUtil$EscapeGroup.class" (Indicator: "Escape") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/apache/http/conn/socket/" (Indicator: "socket") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/apache/http/conn/socket/PlainConnectionSocketFactory.class" (Indicator: "socket") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/apache/http/conn/socket/ConnectionSocketFactory.class" (Indicator: "socket") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/apache/http/conn/socket/LayeredConnectionSocketFactory.class}" (Indicator: "socket") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"by/gdev/util/excepiton/NotAllowWriteFileOperation.class" (Indicator: "WriteFile") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/apache/commons/io/filefilter/CanReadFileFilter.class" (Indicator: "ReadFile") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"org/apache/commons/io/filefilter/CanWriteFileFilter.class" (Indicator: "WriteFile") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"com/google/gson/internal/bind/" (Indicator: "bind") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"com/google/gson/internal/bind/TreeTypeAdapter.class" (Indicator: "bind") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"com/google/gson/internal/bind/TypeAdapters$8.class" (Indicator: "bind") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"com/google/gson/internal/bind/ObjectTypeAdapter.class" (Indicator: "bind") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"com/google/gson/internal/bind/JsonAdapterAnnotationTypeAdapterFactory.class" (Indicator: "bind") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"com/google/gson/internal/bind/TypeAdapters$13.class" (Indicator: "bind") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"com/google/gson/internal/bind/TypeAdapters$35$1.class" (Indicator: "bind") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin
"com/google/gson/internal/bind/TypeAdapters$11.class" (Indicator: "bind") in Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin - source
- File/Memory
- relevance
- 1/10
-
Overview of unique CLSIDs touched in registry
- details
-
"WMIC.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}")
"WMIC.exe" touched "Free Threaded XML DOM Document" (Path: "HKCU\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}")
"WMIC.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS")
"WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS")
"WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32")
"WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")
"WMIC.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\INPROCSERVER32")
"WMIC.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS")
"WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")
"WMIC.exe" touched "WbemStatusCode" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS")
"WMIC.exe" touched "XSL Template" (Path: "HKCU\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\PROGID")
"WMIC.exe" touched "VB Script Language" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS")
"WMIC.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS")
"javaw.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER")
"javaw.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\INPROCSERVER32")
"javaw.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER")
"javaw.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER")
"javaw.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE")
"javaw.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32")
"javaw.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") - source
- Registry Access
- relevance
- 3/10
-
Runs shell commands
- details
-
"/C chcp 437 & wmic os get osarchitecture" on 2022-6-17.21:36:00.062
"/C chcp 437 & wmic os get osarchitecture" on 2022-6-17.21:49:00.312 - source
- Monitored Target
- relevance
- 5/10
- ATT&CK ID
- T1059.003 (Show technique in the MITRE ATT&CK™ matrix)
-
Spawns new processes
- details
-
Spawned process "cmd.exe" with commandline "/C chcp 437 & wmic os get osarchitecture" (Show Process)
Spawned process "chcp.com" with commandline "chcp 437" (Show Process)
Spawned process "WMIC.exe" with commandline "wmic os get osarchitecture" (Show Process)
Spawned process "cmd.exe" with commandline "/C chcp 437 & wmic os get osarchitecture" (Show Process)
Spawned process "chcp.com" with commandline "chcp 437" (Show Process)
Spawned process "WMIC.exe" with commandline "wmic os get osarchitecture" (Show Process)
Spawned process "javaw.exe" with commandline "%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bi ..." (Show Process)
Spawned process "icacls.exe" with commandline "%ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage\fbadb5649d7bf34f ..." (Show Process) - source
- Monitored Target
- relevance
- 3/10
-
Spawns new processes that are not known child processes
- details
-
Spawned process "cmd.exe" with commandline "/C chcp 437 & wmic os get osarchitecture" (Show Process)
Spawned process "chcp.com" with commandline "chcp 437" (Show Process)
Spawned process "WMIC.exe" with commandline "wmic os get osarchitecture" (Show Process)
Spawned process "cmd.exe" with commandline "/C chcp 437 & wmic os get osarchitecture" (Show Process)
Spawned process "chcp.com" with commandline "chcp 437" (Show Process)
Spawned process "WMIC.exe" with commandline "wmic os get osarchitecture" (Show Process)
Spawned process "javaw.exe" with commandline "%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bi ..." (Show Process)
Spawned process "icacls.exe" with commandline "%ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage\fbadb5649d7bf34f ..." (Show Process) - source
- Monitored Target
- relevance
- 3/10
-
Contacts domains
-
Installation/Persistence
-
Contains ability to lookup the windows account name
- details
- FREE && this.mp.defaultScene.loginForm.accountPanel.username.getUsername@Type at eade98d11737193c24648276433a0829-8a40
- source
- Hybrid Analysis Technology
- relevance
- 5/10
- ATT&CK ID
- T1033 (Show technique in the MITRE ATT&CK™ matrix)
-
Dropped files
- details
-
"jaccess.jar" has type "Java archive data (JAR)"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\jaccess.jar]- [targetUID: 00000000-00002800]
"sunec.jar" has type "Zip archive data at least v2.0 to extract"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\sunec.jar]- [targetUID: 00000000-00002800]
"fontmanager.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\fontmanager.dll]- [targetUID: 00000000-00002800]
"java.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\java.exe]- [targetUID: 00000000-00003840]
"javaw.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\javaw.exe]- [targetUID: 00000000-00002800]
"jsound.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jsound.dll]- [targetUID: 00000000-00003840]
"jfr.jar" has type "Java archive data (JAR)"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\jfr.jar]- [targetUID: 00000000-00002800]
"jfxwebkit.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jfxwebkit.dll]- [targetUID: 00000000-00003840]
"decora_sse.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\decora_sse.dll]- [targetUID: 00000000-00003840]
"j2pcsc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\j2pcsc.dll]- [targetUID: 00000000-00003840]
"orbd.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\orbd.exe]- [targetUID: 00000000-00003840]
"javafx_font.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javafx_font.dll]- [targetUID: 00000000-00003840]
"jfxmedia.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jfxmedia.dll]- [targetUID: 00000000-00003840]
"ssvagent.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\ssvagent.exe]- [targetUID: 00000000-00003840]
"plugin.jar" has type "Java archive data (JAR)"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\lib\plugin.jar]- [targetUID: 00000000-00003840]
"jp2launcher.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jp2launcher.exe]- [targetUID: 00000000-00003840]
"sunjce_provider.jar" has type "Zip archive data at least v2.0 to extract"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\sunjce_provider.jar]- [targetUID: 00000000-00002800]
"javacpl.cpl" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javacpl.cpl]- [targetUID: 00000000-00003840]
"jawt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jawt.dll]- [targetUID: 00000000-00003840]
"instrument.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\instrument.dll]- [targetUID: 00000000-00003840] - source
- Binary File
- relevance
- 3/10
-
Touches files in the Windows directory
- details
-
"javaw.exe" touched file "%WINDIR%\AppPatch\sysmain.sdb"
"cmd.exe" touched file "%WINDIR%\AppPatch\sysmain.sdb"
"javaw.exe" touched file "%APPDATA%\Microsoft\Windows\Network Shortcuts\desktop.ini"
"javaw.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"
"javaw.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
-
Pattern match: "by.gdev/desktop-common-util/"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/desktop-common-util/pom.xml"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/desktop-common-util/pom.properties"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "com.google.code.gson/gson/"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "com.google.code.gson/gson/pom.xml"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "com.google.code.gson/gson/pom.propertiesSvO"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/http-download/"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/http-download/pom.xml"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/http-download/pom.propertiesSvO"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/PK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/desktop-common-util/PK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/desktop-common-util/pom.xmlPK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/desktop-common-util/pom.propertiesPK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "com.google.code.gson/PK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "com.google.code.gson/gson/PK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "com.google.code.gson/gson/pom.xmlPK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "com.google.code.gson/gson/pom.propertiesPK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/http-download/PK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/http-download/pom.xmlPK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Pattern match: "by.gdev/http-download/pom.propertiesPK"- [Source: dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1.bin]
Heuristic match: "res.tlauncher.org"- [Source: PCAP]
Heuristic match: "cl1-res.tlauncher.org"- [Source: PCAP]
Heuristic match: "cl2-res.tlauncher.org"- [Source: PCAP]
Pattern match: "http://support.xbox.com/xbox-live/country-not-authorized"- [Source: 229a]
Heuristic match: ", Localizable.get(account.not.proper.warn), null, Localizable.get(ui.go.no.matter), Localizable.get(ui.no"- [Source: 3383]
Pattern match: "https://api.minecraftservices.com/entitlements/mcstore"- [Source: 37ab]
Pattern match: "https://api.minecraftservices.com/authentication/login_with_xbox"- [Source: 38a2]
Pattern match: "https://api.minecraftservices.com/minecraft/profile"- [Source: 3a96]
Pattern match: "https://user.auth.xboxlive.com/user/authenticate"- [Source: 3b15]
Pattern match: "https://xsts.auth.xboxlive.com/xsts/authorize"- [Source: 3b6d]
Pattern match: "http://repo.tlauncher.org/update/downloads/configs/inner_servers.json"- [Source: 3c64]
Pattern match: "https://tlauncher.org/ru/error-kb4515384.html"- [Source: 3cf8]
Pattern match: "https://tlauncher.org/en/error-kb4515384.html"- [Source: 3cf8]
Pattern match: "https://tlauncher.org/ru/crash-afterburner.html"- [Source: 3cf8]
Pattern match: "https://tlauncher.org/en/crash-afterburner.html"- [Source: 3cf8]
Pattern match: "https://tlauncher.org/ru/font-error.html"- [Source: 3cf8]
Pattern match: "https://tlauncher.org/en/font-error.html"- [Source: 3cf8]
Pattern match: "http://www.inetkomp.ru/uroki/488-osvobodit-mesto-na-diske-c.html"- [Source: 3cf8]
Pattern match: "https://tlauncher.org/ru/closed-minecraft-1073740791.html"- [Source: 3e3c]
Pattern match: "https://tlauncher.org/en/closed-minecraft-1073740791.html"- [Source: 3e3c]
Heuristic match: "process.info"- [Source: 3ef4]
Pattern match: "https://tlauncher.org/"- [Source: 3ef4]
Pattern match: "https://page.tlauncher.org"- [Source: 3fbd]
Pattern match: "https://page.tlauncher.org/update/downloads/configs/client/"- [Source: 3fbd]
Pattern match: "https://repo.tlauncher.org"- [Source: 3fbd]
Pattern match: "https://repo.tlauncher.org/update/downloads/configs/client/"- [Source: 3fbd]
Pattern match: "https://advancedrepository.com"- [Source: 3fbd]
Pattern match: "https://advancedrepository.com/update/downloads/configs/client/"- [Source: 3fbd]
Heuristic match: "ui.yes, ui.no"- [Source: 4339]
Pattern match: "https://tlauncher.org/ru/unsatisfiedlinkerror-java-bin-glass.html"- [Source: 48b9]
Pattern match: "https://tlauncher.org/en/unsatisfiedlinkerror-java-bin-glass.html"- [Source: 48b9]
Heuristic match: "gpu.info"- [Source: 51dc]
Pattern match: "https://www.google.com/search"- [Source: 51dc]
Heuristic match: "<br>%s)%s <a href='%s'>%s</a>, i++, Localizable.get(crash.opengl.install.gpu), gpuLink, Localizable.get(click.me"- [Source: 51dc]
Heuristic match: "<br>%s)%s <a href='%s'>%s</a>, i++, Localizable.get(crash.opengl.install.cpu), cpuLink, Localizable.get(click.me"- [Source: 51dc]
Heuristic match: "reset.net"- [Source: 51dc]
Pattern match: "http://repo.tlauncher.org/update/downloads/libraries/org/tlauncher/updater/TLauncherUpdater.exe"- [Source: 51dc]
Pattern match: "https://www.dmosk.ru/polezno.php?review=memory-notfull"- [Source: 51dc]
Heuristic match: "check.email.name"- [Source: 57cd]
Heuristic match: "log.form.send.no"- [Source: 57cd]
Pattern match: "http://masken.ru/rum.html"- [Source: 5a2a]
Pattern match: "http://masken.ru/enmine.html"- [Source: 5a2a]
Heuristic match: "settings.java.name"- [Source: 605b]
Heuristic match: "modpack.table.pack.element.name"- [Source: 605b]
Heuristic match: ", Localizable.get(review.message.fill) + + Localizable.get(modpack.table.pack.element.name"- [Source: 60dd]
Heuristic match: "modpack.install.handle. + this.type.toString().toLowerCase()).replace(modpack.name"- [Source: 6280]
Heuristic match: "modpack.backup.button.do"- [Source: 639b]
Heuristic match: "modpack.backup.files.do"- [Source: 639b]
Heuristic match: "modpack.creation.name"- [Source: 6443]
Heuristic match: "modpack.creation.input.name"- [Source: 652c]
Heuristic match: "curseforge.com"- [Source: 6621]
Pattern match: "https://vk.com"- [Source: 68c3]
Heuristic match: "gui.statistics.checkbox, new EditorCheckBox(statistics.settings.checkbox.name"- [Source: 7732]
Heuristic match: "settings.popup.info"- [Source: 7732]
Heuristic match: "statistics.settings.checkbox.name"- [Source: 7891]
Pattern match: "https://tlauncher.org/%s/guard.html"- [Source: 791c]
Heuristic match: "OptionPane.noButtonText, this.lang.nget(ui.no"- [Source: 89d1]
Heuristic match: "FileChooser.other.newFolder, this.lang.nget(explorer.button.newfolder.name"- [Source: 89d1]
Heuristic match: "FileChooser.other.newFolder.subsequent, this.lang.nget(explorer.button.newfolder.name"- [Source: 89d1]
Heuristic match: "FileChooser.win32.newFolder, this.lang.nget(explorer.button.newfolder.name"- [Source: 89d1]
Heuristic match: "FileChooser.win32.newFolder.subsequent, this.lang.nget(explorer.button.newfolder.name"- [Source: 89d1]
Heuristic match: "FileChooser.filesListAccessibleName, this.lang.nget(explorer.view.list.name"- [Source: 89d1]
Heuristic match: "FileChooser.filesDetailsAccessibleName, this.lang.nget(explorer.view.details.name"- [Source: 89d1]
Heuristic match: "updater.frame.name"- [Source: 930c]
Pattern match: "https://pastebin.com/api/api_post.php"- [Source: 9f97]
Pattern match: "https://tlauncher.org/repo/update/lch/additional_hot_servers.json"- [Source: a3ea]
Pattern match: "https://dl2.fastrepo.org/not_remove_test_file.txt"- [Source: a3ea]
Pattern match: "http://page.tlauncher.org"- [Source: a3ea]
Pattern match: "https://vk.me/tlauncher"- [Source: a3ea]
Pattern match: "http://www.w3.org/TR/html4/loose.dtd\"- [Source: ac1b]
Pattern match: "http://logging.apache.org/log4j/1.2/faq.html#noconfig"- [Source: acb6]
Pattern match: "http://logging.apache.org/log4j/1.2/faq.html#unload"- [Source: b038]
Heuristic match: "[a-z]\\.tile\\.openstreetmap\\.org"- [Source: ea80]
Heuristic match: "x.tile.openstreetmap.org"- [Source: ea80]
Heuristic match: ".COM) || ucDomain.endsWith(.EDU) || ucDomain.endsWith(.NET) || ucDomain.endsWith(.GOV) || ucDomain.endsWith(.MIL) || ucDomain.endsWith(.ORG) || ucDomain.endsWith(.INT"- [Source: 1153a]
Pattern match: "http://commons.apache.org/logging/troubleshooting.html"- [Source: 18152]
Pattern match: "http://www.slf4j.org/codes.html#log4j_version"- [Source: 18340]
Pattern match: "http://www.slf4j.org/codes.html"- [Source: 1864d]
Pattern match: "http://www.slf4j.org/codes.html#StaticLoggerBinder"- [Source: 1864d]
Pattern match: "http://www.slf4j.org/codes.html#multiple_bindings"- [Source: 1864d]
Pattern match: "http://www.slf4j.org/codes.html#null_LF"- [Source: 1864d]
Pattern match: "http://www.slf4j.org/codes.html#version_mismatch"- [Source: 1864d]
Pattern match: "http://www.slf4j.org/codes.html#substituteLogger"- [Source: 1864d]
Pattern match: "http://www.slf4j.org/codes.html#unsuccessfulInit"- [Source: 1864d]
Pattern match: "http://www.slf4j.org/codes.html#null_MDCA"- [Source: 18710]
Pattern match: "http://www.slf4j.org/codes.html#no_static_mdc_binder"- [Source: 18710]
Pattern match: "http://logback.qos.ch/codes.html#block"- [Source: 1dbfe]
Pattern match: "http://logback.qos.ch/codes.html#receiver_no_port"- [Source: 1e6da]
Pattern match: "http://logback.qos.ch/codes.html#receiver_no_host"- [Source: 1e6da]
Pattern match: "http://logback.qos.ch/codes.html"- [Source: 1f62b]
Pattern match: "http://logback.qos.ch/manual/"- [Source: 1f62b]
Pattern match: "http://logback.qos.ch/codes.html#tbr_fnp_not_set"- [Source: 1f62b]
Pattern match: "http://logback.qos.ch/codes.html#sat_missing_integer_token"- [Source: 1f62b]
Pattern match: "http://logback.qos.ch/codes.html#earlier_fa_collision"- [Source: 1f728]
Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"- [Source: 1f8f3]
Pattern match: "http://logback.qos.ch/codes.html#appender_order"- [Source: 1fa0e]
Pattern match: "http://xml.org/sax/features/external-general-entities"- [Source: 1fdb5]
Pattern match: "http://xml.org/sax/features/external-parameter-entities"- [Source: 1fdb5]
Pattern match: "http://logback.qos.ch/codes.html#socket_no_port"- [Source: 20517]
Pattern match: "http://logback.qos.ch/codes.html#socket_no_host"- [Source: 20517]
Pattern match: "http://logback.qos.ch/codes.html#smtp_no_layout"- [Source: 20856]
Pattern match: "http://logback.qos.ch/codes.html#syslog_layout"- [Source: 20ba2]
Pattern match: "http://logback.qos.ch/codes.html#layoutInsteadOfEncoder"- [Source: 20cb9]
Pattern match: "http://logback.qos.ch/codes.html#missingRightParenthesis"- [Source: 2100f]
Pattern match: "http://logback.qos.ch/codes.html#tbr_fnp_prudent_unsupported"- [Source: 21426]
Pattern match: "http://logback.qos.ch/codes.html#fwrp_parentFileName_not_set"- [Source: 21426]
Pattern match: "http://logback.qos.ch/codes.html#renamingError"- [Source: 216a6]
Pattern match: "http://logback.qos.ch/codes.html#rfa_no_tp"- [Source: 2188f]
Pattern match: "http://logback.qos.ch/codes.html#rfa_no_rp"- [Source: 2188f]
Pattern match: "http://logback.qos.ch/codes.html#rfa_collision"- [Source: 2188f]
Pattern match: "http://logback.qos.ch/codes.html#rfa_file_after"- [Source: 2188f]
Pattern match: "http://logback.qos.ch/manual/appenders.html#SizeAndTimeBasedRollingPolicy"- [Source: 2197e]
Pattern match: "http://logback.qos.ch/codes.html#sbtp_size_format"- [Source: 21a05]
Pattern match: "http://logback.qos.ch/codes.html#rfa_collision_in_dateFormat"- [Source: 21a1c]
Pattern match: "http://logback.qos.ch/codes.html#1andOnly1"- [Source: 21bbd] - source
- File/Memory
- relevance
- 10/10
-
Possibly tries to communicate over SSL connection (HTTPS)
- details
- "https://api.minecraftservices.com/entitlements/mcstore").addHeader("Authorization", "Bearer" (Indicator: "https://") in Source: 37ab
- source
- File/Memory
- relevance
- 1/10
- ATT&CK ID
- T1573 (Show technique in the MITRE ATT&CK™ matrix)
-
Uses HTTPS for communication
- details
- "HTTPS traffic to 104.20.234.70 on port 443, "HTTPS traffic to 104.20.235.70 on port 443
- source
- Network Traffic
- relevance
- 3/10
- ATT&CK ID
- T1573 (Show technique in the MITRE ATT&CK™ matrix)
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"adyoutube" (Indicator: "youtube")
"click"
evt -> StatisticsUtil.startSending("save/adyoutube" (Indicator: "youtube") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
System Security
-
Creates or modifies windows services
- details
- "javaw.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS")
- source
- Registry Access
- relevance
- 10/10
- ATT&CK ID
- T1112 (Show technique in the MITRE ATT&CK™ matrix)
-
Creates or modifies windows services
-
Unusual Characteristics
-
Drops executable files with unusual extensions
- details
- "javacpl.cpl" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" and unusual extension "cpl"
- source
- Binary File
- relevance
- 10/10
- ATT&CK ID
- T1036 (Show technique in the MITRE ATT&CK™ matrix)
-
Drops executable files with unusual extensions
File Details
tmppe9y2v46
- Filename
- tmppe9y2v46
- Size
- 5.5MiB (5719927 bytes)
- Type
- java compressed jar
- Description
- Zip archive data, at least v2.0 to extract
- Architecture
- WINDOWS
- SHA256
- dc755245a0a68b75b0a11e9d00a2b6d1953cf81d1ee01acedfde970d5eb778b1
- MD5
- eade98d11737193c24648276433a0829
- SHA1
- bd3b183c90739f3cdd3d3d97e39d69787c421da6
- ssdeep
-
98304:mqw8pCe+8AS5JWqKZt3rDYAR412Sl7BnMh1FkeUlPf20TMcLL:o8p+I5JWbbbsU412Sl9Mh1FkblH285
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 9 processes in total (System Resource Monitor).
-
javaw.exe
-jar "C:\tmppe9y2v46.jar"
(PID: 3840)
-
cmd.exe
/C chcp 437 & wmic os get osarchitecture
(PID: 3516)
-
cmd.exe
/C chcp 437 & wmic os get osarchitecture
(PID: 2228)
-
javaw.exe
%APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\javaw.exe -Xmx1024m -Dfile.encoding=UTF8 -cp C:\tmppe9y2v46.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\log4j\log4j\1.2.17\log4j-1.2.17.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.5\picture-bundle-3.5.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar;C:\Users\%USERNAME%\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar; org.tlauncher.tlauncher.rmo.TLauncher
(PID: 2800)
-
icacls.exe
%ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage\fbadb5649d7bf34f.timestamp /grant "everyone":(OI)(CI)M
(PID: 1388)
-
-
Network Analysis
DNS Requests
| Domain | Address | Registrar | Country |
|---|---|---|---|
|
cl1-res.tlauncher.org
OSINT |
104.20.235.70
TTL: 300 |
Instra Corporation Pty Ltd.
Organization: Registrant of tlauncher.org Name Server: NS8-L2.NIC.RU Creation Date: 2015-06-26T22:49:22 |
United States |
|
cl2-res.tlauncher.org
OSINT |
104.20.234.70
TTL: 300 |
Instra Corporation Pty Ltd.
Organization: Registrant of tlauncher.org Name Server: NS8-L2.NIC.RU Creation Date: 2015-06-26T22:49:22 |
United States |
|
res.tlauncher.org
OSINT |
78.46.66.120
TTL: 300 |
Instra Corporation Pty Ltd.
Organization: Registrant of tlauncher.org Name Server: NS8-L2.NIC.RU Creation Date: 2015-06-26T22:49:22 |
Germany |
Contacted Hosts
| IP Address | Port/Protocol | Associated Process | Details |
|---|---|---|---|
|
78.46.66.120 |
80
TCP |
javaw.exe PID: 3840 |
Germany |
|
104.20.234.70 |
443
TCP |
javaw.exe PID: 3840 |
United States |
|
104.20.235.70 |
443
TCP |
javaw.exe PID: 3840 |
United States |
Contacted Countries
HTTP Traffic
| Endpoint | Request | URL | |
|---|---|---|---|
| 78.46.66.120:80 (res.tlauncher.org) | GET | res.tlauncher.org/b/client/jre/windows/jre-8u111-windows-i586.zip | GET /b/client/jre/windows/jre-8u111-windows-i586.zip HTTP/1.1
Host: res.tlauncher.org
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_151)
Accept-Encoding: gzip,deflate More Details |
| 78.46.66.120:80 (res.tlauncher.org) | GET | res.tlauncher.org/b/libraries/com/google/guava/guava/19.0/guava-19.0.jar | GET /b/libraries/com/google/guava/guava/19.0/guava-19.0.jar HTTP/1.1
Host: res.tlauncher.org
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_151)
Accept-Encoding: gzip,deflate More Details |
| 78.46.66.120:80 (res.tlauncher.org) | GET | res.tlauncher.org/b/libraries/org/apache/commons/commons-lang3/3.4/commons-lang3-3.4.jar | GET /b/libraries/org/apache/commons/commons-lang3/3.4/commons-lang3-3.4.jar HTTP/1.1
Host: res.tlauncher.org
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_151)
Accept-Encoding: gzip,deflate More Details |
| 78.46.66.120:80 (res.tlauncher.org) | GET | res.tlauncher.org/b/libraries/net/sf/jopt-simple/jopt-simple/4.9/jopt-simple-4.9.jar | GET /b/libraries/net/sf/jopt-simple/jopt-simple/4.9/jopt-simple-4.9.jar HTTP/1.1
Host: res.tlauncher.org
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_151)
Accept-Encoding: gzip,deflate More Details |
| 78.46.66.120:80 (res.tlauncher.org) | GET | res.tlauncher.org/b/libraries/log4j/log4j/1.2.17/log4j-1.2.17.jar | GET /b/libraries/log4j/log4j/1.2.17/log4j-1.2.17.jar HTTP/1.1
Host: res.tlauncher.org
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_151)
Accept-Encoding: gzip,deflate More Details |
| 78.46.66.120:80 (res.tlauncher.org) | GET | res.tlauncher.org/b/libraries/org/tukaani/xz/1.5/xz-1.5.jar | GET /b/libraries/org/tukaani/xz/1.5/xz-1.5.jar HTTP/1.1
Host: res.tlauncher.org
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_151)
Accept-Encoding: gzip,deflate More Details |
| 78.46.66.120:80 (res.tlauncher.org) | GET | res.tlauncher.org/b/libraries/org/tlauncher/tlauncher-resource/1.4/tlauncher-resource-1.4.jar | GET /b/libraries/org/tlauncher/tlauncher-resource/1.4/tlauncher-resource-1.4.jar HTTP/1.1
Host: res.tlauncher.org
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_151)
Accept-Encoding: gzip,deflate More Details |
| 78.46.66.120:80 (res.tlauncher.org) | GET | res.tlauncher.org/b/libraries/com/github/junrar/junrar/0.7/junrar-0.7.jar | GET /b/libraries/com/github/junrar/junrar/0.7/junrar-0.7.jar HTTP/1.1
Host: res.tlauncher.org
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_151)
Accept-Encoding: gzip,deflate More Details |
| 78.46.66.120:80 (res.tlauncher.org) | GET | res.tlauncher.org/b/libraries/org/apache/httpcomponents/fluent-hc/4.5.13/fluent-hc-4.5.13.jar | GET /b/libraries/org/apache/httpcomponents/fluent-hc/4.5.13/fluent-hc-4.5.13.jar HTTP/1.1
Host: res.tlauncher.org
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_151)
Accept-Encoding: gzip,deflate More Details |
Memory Forensics
| String | Context | Stream UID |
|---|---|---|
| http://advancedrepository.com/update/downloads/configs/inner_servers.json | Domain/IP reference | eade98d11737193c24648276433a0829-3c64 |
| https://tlauncher.org/en/closed-minecraft-1073740791.html | Domain/IP reference | eade98d11737193c24648276433a0829-3e3c |
| http://masken.ru/rum.html | Domain/IP reference | eade98d11737193c24648276433a0829-5a2a |
| https://vk.me/tlauncher | Domain/IP reference | eade98d11737193c24648276433a0829-a3ea |
| http://logback.qos.ch/codes.html#appender_order | Domain/IP reference | eade98d11737193c24648276433a0829-1fa0e |
| gpu.info | Domain/IP reference | eade98d11737193c24648276433a0829-a3ea |
| http://www.inetkomp.ru/uroki/488-osvobodit-mesto-na-diske-c.html | Domain/IP reference | eade98d11737193c24648276433a0829-3cf8 |
| os.is | Domain/IP reference | eade98d11737193c24648276433a0829-51dc |
| settings.java.name | Domain/IP reference | eade98d11737193c24648276433a0829-605b |
| dos.name | Domain/IP reference | eade98d11737193c24648276433a0829-35a0 |
| http://www.slf4j.org/codes.html#log4j_version | Domain/IP reference | eade98d11737193c24648276433a0829-18340 |
| http://logback.qos.ch/manual/ | Domain/IP reference | eade98d11737193c24648276433a0829-1f62b |
| ui.go.no | Domain/IP reference | eade98d11737193c24648276433a0829-3383 |
| http://logback.qos.ch/manual/appenders.html#sizeandtimebasedrollingpolicy | Domain/IP reference | eade98d11737193c24648276433a0829-2197e |
| updater.frame.name | Domain/IP reference | eade98d11737193c24648276433a0829-930c |
| http://commons.apache.org/logging/troubleshooting.html. | Domain/IP reference | eade98d11737193c24648276433a0829-18152 |
| http://logging.apache.org/log4j/1.2/faq.html#unload. | Domain/IP reference | eade98d11737193c24648276433a0829-b038 |
| https://tlauncher.org/en/font-error.html | Domain/IP reference | eade98d11737193c24648276433a0829-3cf8 |
| https://vk.com | Domain/IP reference | eade98d11737193c24648276433a0829-68c3 |
| https://tlauncher.org/repo/update/downloads/configs/inner_servers.json | Domain/IP reference | eade98d11737193c24648276433a0829-3c64 |
| http://auth.xboxlive.com | Domain/IP reference | eade98d11737193c24648276433a0829-3b15 |
| https://page.tlauncher.org | Domain/IP reference | eade98d11737193c24648276433a0829-3fbd |
| https://advancedrepository.com/update/downloads/configs/client/ | Domain/IP reference | eade98d11737193c24648276433a0829-3fbd |
| http://logback.qos.ch/codes.html#tbr_fnp_prudent_unsupported | Domain/IP reference | eade98d11737193c24648276433a0829-21426 |
| settings.popup.info | Domain/IP reference | eade98d11737193c24648276433a0829-7732 |
| http://www.slf4j.org/codes.html#multiple_bindings | Domain/IP reference | eade98d11737193c24648276433a0829-186b4 |
| https://advancedrepository.com | Domain/IP reference | eade98d11737193c24648276433a0829-3fbd |
| 127.0.0.255 | Domain/IP reference | eade98d11737193c24648276433a0829-ff6b |
| https://tlauncher.org/en/unsatisfiedlinkerror-java-bin-glass.html | Domain/IP reference | eade98d11737193c24648276433a0829-48b9 |
| 1.3.6.1 | Domain/IP reference | eade98d11737193c24648276433a0829-107c0 |
| https://api.minecraftservices.com/minecraft/profile | Domain/IP reference | eade98d11737193c24648276433a0829-3a96 |
| this.name | Domain/IP reference | eade98d11737193c24648276433a0829-2219f |
| https://tlauncher.org/ | Domain/IP reference | eade98d11737193c24648276433a0829-3ef4 |
| http://logback.qos.ch/codes.html#sat_missing_integer_token | Domain/IP reference | eade98d11737193c24648276433a0829-2197e |
| http://logback.qos.ch/codes.html#rfa_no_tp | Domain/IP reference | eade98d11737193c24648276433a0829-2188f |
| http://repo.tlauncher.org/update/downloads/configs/inner_servers.json | Domain/IP reference | eade98d11737193c24648276433a0829-3c64 |
| https://tlauncher.org/repo/update/lch/additional_hot_servers.json | Domain/IP reference | eade98d11737193c24648276433a0829-a3ea |
| http://logback.qos.ch/codes.html#smtp_no_layout | Domain/IP reference | eade98d11737193c24648276433a0829-20856 |
| http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd | Domain/IP reference | eade98d11737193c24648276433a0829-1f8f3 |
| tlauncher.org | Domain/IP reference | eade98d11737193c24648276433a0829-a3ea |
| https://tlauncher.org/ru/closed-minecraft-1073740791.html | Domain/IP reference | eade98d11737193c24648276433a0829-3e3c |
| console.this.name | Domain/IP reference | eade98d11737193c24648276433a0829-4a39 |
| http://logback.qos.ch/codes.html#block | Domain/IP reference | eade98d11737193c24648276433a0829-1dbfe |
| https://tlauncher.org/en/error-kb4515384.html | Domain/IP reference | eade98d11737193c24648276433a0829-3cf8 |
| http://www.w3.org/tr/html4/loose.dtd | Domain/IP reference | eade98d11737193c24648276433a0829-ac1b |
| https://dl2.fastrepo.org/not_remove_test_file.txt | Domain/IP reference | eade98d11737193c24648276433a0829-a3ea |
| http://masken.ru/enmine.html | Domain/IP reference | eade98d11737193c24648276433a0829-5a2a |
| https://user.auth.xboxlive.com/user/authenticate | Domain/IP reference | eade98d11737193c24648276433a0829-3b15 |
| http://www.slf4j.org/codes.html#substitutelogger | Domain/IP reference | eade98d11737193c24648276433a0829-1867f |
| modpack.name | Domain/IP reference | eade98d11737193c24648276433a0829-6280 |
| curseforge.com | Domain/IP reference | eade98d11737193c24648276433a0829-6621 |
| version.do | Domain/IP reference | eade98d11737193c24648276433a0829-5b2d |
| http://logback.qos.ch/codes.html#earlier_fa_collision | Domain/IP reference | eade98d11737193c24648276433a0829-1f728 |
| http://www.slf4j.org/codes.html#staticloggerbinder | Domain/IP reference | eade98d11737193c24648276433a0829-1864d |
| https://tlauncher.org/en/crash-afterburner.html | Domain/IP reference | eade98d11737193c24648276433a0829-3cf8 |
| sun.nio.ch | Domain/IP reference | eade98d11737193c24648276433a0829-1a498 |
| c.q.l.co | Domain/IP reference | eade98d11737193c24648276433a0829-216ba |
| signature.name | Domain/IP reference | eade98d11737193c24648276433a0829-313d |
| djava.net | Domain/IP reference | eade98d11737193c24648276433a0829-9d1a |
| https://www.howtogeek.com/131632/hardware-upgrade-why-windows-cant-see-all-your-ram | Domain/IP reference | eade98d11737193c24648276433a0829-51dc |
| file.cache.service.time.to | Domain/IP reference | eade98d11737193c24648276433a0829-9c71 |
| 54.1.2.2 | Domain/IP reference | eade98d11737193c24648276433a0829-107c0 |
| http://logback.qos.ch/codes.html#layoutinsteadofencoder | Domain/IP reference | eade98d11737193c24648276433a0829-20cb9 |
| https://tlauncher.org | Domain/IP reference | eade98d11737193c24648276433a0829-791c |
| http://logback.qos.ch/codes.html#renamingerror | Domain/IP reference | eade98d11737193c24648276433a0829-216a6 |
| explorer.button.newfolder.name | Domain/IP reference | eade98d11737193c24648276433a0829-89d1 |
| modpack.selected.so | Domain/IP reference | eade98d11737193c24648276433a0829-5fa7 |
| http://logback.qos.ch/codes.html | Domain/IP reference | eade98d11737193c24648276433a0829-1f62b |
| https://xsts.auth.xboxlive.com/xsts/authorize | Domain/IP reference | eade98d11737193c24648276433a0829-3b6d |
| https://www.dmosk.ru/polezno.php?review=memory-notfull | Domain/IP reference | eade98d11737193c24648276433a0829-51dc |
| log.form.send.no | Domain/IP reference | eade98d11737193c24648276433a0829-57cd |
| java.net | Domain/IP reference | eade98d11737193c24648276433a0829-1e6a7 |
| http://logback.qos.ch/codes.html#socket_no_port | Domain/IP reference | eade98d11737193c24648276433a0829-20517 |
| version.manager.downloader.info.no | Domain/IP reference | eade98d11737193c24648276433a0829-8e07 |
| os.name | Domain/IP reference | eade98d11737193c24648276433a0829-2243a |
| http://www.slf4j.org/codes.html#unsuccessfulinit | Domain/IP reference | eade98d11737193c24648276433a0829-1864d |
| http://logback.qos.ch/codes.html#receiver_no_host | Domain/IP reference | eade98d11737193c24648276433a0829-1e6da |
| http://xml.org/sax/features/external-parameter-entities | Domain/IP reference | eade98d11737193c24648276433a0829-1fdb5 |
| http://logging.apache.org/log4j/1.2/faq.html#noconfig | Domain/IP reference | eade98d11737193c24648276433a0829-acb6 |
| http://logback.qos.ch/codes.html#rfa_collision | Domain/IP reference | eade98d11737193c24648276433a0829-2188f |
| vk.com | Domain/IP reference | eade98d11737193c24648276433a0829-68c3 |
| http://logback.qos.ch/codes.html#socket_no_host | Domain/IP reference | eade98d11737193c24648276433a0829-20517 |
| modpack.backup.button.do | Domain/IP reference | eade98d11737193c24648276433a0829-639b |
| this.id | Domain/IP reference | eade98d11737193c24648276433a0829-3a6e |
| http://www.slf4j.org/codes.html#null_mdca | Domain/IP reference | eade98d11737193c24648276433a0829-18710 |
| http://www.slf4j.org/codes.html#no_static_mdc_binder | Domain/IP reference | eade98d11737193c24648276433a0829-18710 |
| http://repo.tlauncher.org/update/downloads/libraries/org/tlauncher/updater/tlauncherupdater.exe | Domain/IP reference | eade98d11737193c24648276433a0829-51dc |
| http://vk.com | Domain/IP reference | eade98d11737193c24648276433a0829-68c3 |
| check.email.name | Domain/IP reference | eade98d11737193c24648276433a0829-57cd |
| https://tlauncher.org/ru/error-kb4515384.html | Domain/IP reference | eade98d11737193c24648276433a0829-3cf8 |
| click.me | Domain/IP reference | eade98d11737193c24648276433a0829-51dc |
| https://windowsreport.com/windows-10-isnt-using-all-ram | Domain/IP reference | eade98d11737193c24648276433a0829-51dc |
| http://logback.qos.ch/codes.html#fwrp_parentfilename_not_set | Domain/IP reference | eade98d11737193c24648276433a0829-21426 |
| http://logback.qos.ch/codes.html#receiver_no_port | Domain/IP reference | eade98d11737193c24648276433a0829-1e6da |
| javax.net | Domain/IP reference | eade98d11737193c24648276433a0829-20aaa |
| https://repo.tlauncher.org/update/downloads/configs/client/ | Domain/IP reference | eade98d11737193c24648276433a0829-3fbd |
| 127.0.0.1 | Domain/IP reference | eade98d11737193c24648276433a0829-3fbd |
| http://logback.qos.ch/codes.html#missingrightparenthesis | Domain/IP reference | eade98d11737193c24648276433a0829-2100f |
| http://logback.qos.ch/codes.html#sbtp_size_format | Domain/IP reference | eade98d11737193c24648276433a0829-21a05 |
| http://logback.qos.ch/codes.html#rfa_collision_in_dateformat | Domain/IP reference | eade98d11737193c24648276433a0829-21a1c |
| https://repo.tlauncher.org | Domain/IP reference | eade98d11737193c24648276433a0829-3fbd |
| modpack.backup.files.do | Domain/IP reference | eade98d11737193c24648276433a0829-639b |
| http://logback.qos.ch/codes.html#rfa_file_after | Domain/IP reference | eade98d11737193c24648276433a0829-2188f |
| http://xml.org/sax/features/external-general-entities | Domain/IP reference | eade98d11737193c24648276433a0829-1fdb5 |
| https://www.google.com/search | Domain/IP reference | eade98d11737193c24648276433a0829-51dc |
| modpack.creation.input.name | Domain/IP reference | eade98d11737193c24648276433a0829-652c |
| http://support.xbox.com/xbox-live/country-not-authorized | Domain/IP reference | eade98d11737193c24648276433a0829-229a |
| version.name | Domain/IP reference | eade98d11737193c24648276433a0829-7891 |
| https://pastebin.com/api/api_post.php | Domain/IP reference | eade98d11737193c24648276433a0829-9f97 |
| version.manager.downloader.info | Domain/IP reference | eade98d11737193c24648276433a0829-8e07 |
| explorer.view.details.name | Domain/IP reference | eade98d11737193c24648276433a0829-89d1 |
| process.info | Domain/IP reference | eade98d11737193c24648276433a0829-a12e |
| https://tlauncher.org/ru/crash-afterburner.html | Domain/IP reference | eade98d11737193c24648276433a0829-3cf8 |
| https://api.minecraftservices.com/entitlements/mcstore | Domain/IP reference | eade98d11737193c24648276433a0829-37ab |
| x.tile.openstreetmap.org | Domain/IP reference | eade98d11737193c24648276433a0829-ea80 |
| api.minecraftservices.com | Domain/IP reference | eade98d11737193c24648276433a0829-3b6d |
| modpack.creation.name | Domain/IP reference | eade98d11737193c24648276433a0829-652c |
| https://www.windowscentral.com/best-7-ways-free-hard-drive-space-windows-10 | Domain/IP reference | eade98d11737193c24648276433a0829-3cf8 |
| http://logback.qos.ch/codes.html#syslog_layout | Domain/IP reference | eade98d11737193c24648276433a0829-20ba2 |
| https://page.tlauncher.org/update/downloads/configs/client/ | Domain/IP reference | eade98d11737193c24648276433a0829-3fbd |
| modpack.table.pack.element.name | Domain/IP reference | eade98d11737193c24648276433a0829-6f6b |
| http://logback.qos.ch/codes.html#1andonly1 | Domain/IP reference | eade98d11737193c24648276433a0829-21bbd |
| http://www.slf4j.org/codes.html | Domain/IP reference | eade98d11737193c24648276433a0829-1864d |
| http://logback.qos.ch/codes.html#tbr_fnp_not_set | Domain/IP reference | eade98d11737193c24648276433a0829-21a70 |
| reset.net | Domain/IP reference | eade98d11737193c24648276433a0829-51dc |
| launcher.update.no | Domain/IP reference | eade98d11737193c24648276433a0829-8c6a |
| java.io | Domain/IP reference | eade98d11737193c24648276433a0829-1e6a7 |
| explorer.view.list.name | Domain/IP reference | eade98d11737193c24648276433a0829-89d1 |
| http://page.tlauncher.org | Domain/IP reference | eade98d11737193c24648276433a0829-a3ea |
| http://www.slf4j.org/codes.html#version_mismatch | Domain/IP reference | eade98d11737193c24648276433a0829-1867f |
| ui.no | Domain/IP reference | eade98d11737193c24648276433a0829-89d1 |
| user.auth.xboxlive.com | Domain/IP reference | eade98d11737193c24648276433a0829-3b15 |
| https://tlauncher.org/ru/font-error.html | Domain/IP reference | eade98d11737193c24648276433a0829-3cf8 |
| statistics.settings.checkbox.name | Domain/IP reference | eade98d11737193c24648276433a0829-7891 |
| https://tlauncher.org/ru/unsatisfiedlinkerror-java-bin-glass.html | Domain/IP reference | eade98d11737193c24648276433a0829-48b9 |
| http://www.slf4j.org/codes.html#null_lf | Domain/IP reference | eade98d11737193c24648276433a0829-1864d |
| https://api.minecraftservices.com/authentication/login_with_xbox | Domain/IP reference | eade98d11737193c24648276433a0829-38a2 |
| http://logback.qos.ch/codes.html#rfa_no_rp | Domain/IP reference | eade98d11737193c24648276433a0829-2188f |
Extracted Strings
Extracted Files
Displaying 132 extracted file(s). The remaining 13 file(s) are available in the full version and XML/JSON reports.
-
Malicious 1
-
-
JavaAccessBridge-32.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\JavaAccessBridge-32.dll
- Size
- 125KiB (128064 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- Labeled as "Unsafe.AI_Score_99%" (1/72)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
b0cc0013ad9ce5c14e9fb1c8041e41c0
- SHA1
-
3e1349c2dde224bf98221cce89ec2fd33058fba5
- SHA256
-
6108419d7a7f652dea6add9b382a1e10d5987bc6090b2035f4bda21fd658fbbb
-
-
Clean 48
-
-
jvm.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\client\jvm.dll
- Size
- 3.7MiB (3862592 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/69
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
4709659031f155bcd5d363f989bf4fc6
- SHA1
-
0712d5ccb9f3cc82960b793a8612952070f8bdeb
- SHA256
-
85b72cc9cac455d8d417aa04023beab38798b0a90c9ae5786c98e3844f21e973
-
fontmanager.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\fontmanager.dll
- Size
- 218KiB (223296 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/69
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
f00d5bd8a52e829f474e8182bb562352
- SHA1
-
32d68030ed9f607f078b10208f720036fdd03778
- SHA256
-
90454168b1bfb90dba9ce2b7395d70a006ddc9c8a68fc7c192a8359192479dc0
-
javaw.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\javaw.exe
- Size
- 187KiB (191552 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/69
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
a90e29c3839ed2141f80670a3db32f69
- SHA1
-
8fb20f2a44b4e04f5692c47ebf0d596a97343366
- SHA256
-
2169030b4a49e4e7a7f395f85af8ce4350aa32995bde33d996fb85a867147177
-
net.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\net.dll
- Size
- 78KiB (79936 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/63
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
bc2c23e8236690efeff5d2304768c254
- SHA1
-
da2dbad39ad48da7bf91328759f9a9ec8d74e370
- SHA256
-
b585242a0c9cbbc5002bf34686d38856ad9f7680a814c65e02caa41e5e4513a5
-
t2k.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\t2k.dll
- Size
- 191KiB (195136 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/69
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
31ed187fd8d71c82d916cf9f006a3199
- SHA1
-
fa8b7f2341747759dbdde661aa0c98760d5fca36
- SHA256
-
350c081c3e538f9b111ce260185bb2863a5b1c3f6b5a24124ac714e89cb0e628
-
charsets.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\charsets.jar
- Size
- 2.9MiB (3091908 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/55
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
071331354bde1174e4593fc2826a2401
- SHA1
-
6a2865e52918aa2a49fc215777dab8ac89d87b06
- SHA256
-
1cbc91a53338f1234b0e9781aca300bc2eabc1d8c5f70cec3cde040ae4383016
-
access-bridge.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\access-bridge.jar
- Size
- 184KiB (188012 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/58
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
06674149d09c7ba1c59ceed6328c5821
- SHA1
-
49ed4a4a55d2521a69cd02cf324eefebca2ac14f
- SHA256
-
6de51b792258cb1b42b73e1a962589578c2b4066961a9786d249cf95935f877d
-
dnsns.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\dnsns.jar
- Size
- 8.1KiB (8286 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/57
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
18ab51efb1f934a4f9edb66f8b25f130
- SHA1
-
504dc87601d078bb121e2f2fbe14219d48668280
- SHA256
-
ff12cefd0aaab5ee5e6910301c1121c8debbcef6c26df1d8d12db82d3232e7ff
-
jaccess.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\jaccess.jar
- Size
- 43KiB (44516 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/57
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
4d01b3a2d01f8f085c85a4bd25f656fc
- SHA1
-
e3dfa1beb5daef45a85b5767a336d4c470b4fcbf
- SHA256
-
fab5a76267a6570dcafbaec3d5514492cb438f06bc49aad0cfc39cc7939d148b
-
localedata.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\localedata.jar
- Size
- 1.1MiB (1178872 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/58
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
1c78b40444de8d1e8f331f722c29032d
- SHA1
-
141519ed7b3409a07f08355ebaf9d08e4ecae047
- SHA256
-
a965f046d3b5bfffb4a67c49e7193f4818ef31db18009b9fa7dd82cfea48cabb
-
sunec.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\sunec.jar
- Size
- 41KiB (42036 bytes)
- Type
- java compressed jar
- Description
- Zip archive data, at least v2.0 to extract
- AV Scan Result
- 0/60
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
5feafdc6ff20db6b5fe4349886394bb2
- SHA1
-
bda4b15a3efa590b459f76c48b9a9c6237016c03
- SHA256
-
46d9083660bc1ecf0eecac099817f9c02a25528e29fb516b0b7584708fe8bd91
-
sunjce_provider.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\sunjce_provider.jar
- Size
- 273KiB (279427 bytes)
- Type
- java compressed jar
- Description
- Zip archive data, at least v2.0 to extract
- AV Scan Result
- 0/59
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
b04074a9fc78dc1409168e1e2d139647
- SHA1
-
54182c904a48364fc572e3a2631df14823c29cef
- SHA256
-
bfad3fb11e7115aaf34719488551bf3205b2faffb38681c7f6bdad19bb7568c2
-
jfr.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\jfr.jar
- Size
- 547KiB (560043 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/57
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
1781f2fd5530cb48e66efe9d8d870a5f
- SHA1
-
1f481a2ba519eed76bb5ae48964c572d1ac314b3
- SHA256
-
295cb4ff072e47bae29bf212bf617c9df629e7931b9f460cbca076030688d826
-
resources.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\resources.jar
- Size
- 3.3MiB (3490933 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/58
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
4930110077a6d322af61f6d4f419ab18
- SHA1
-
23258bcf6b835292dc44ee02d9703c6defe79226
- SHA256
-
7dfee11e4b59c5816a30cdd17b2b058836cb8a4ef2075b70c73747412f87bcff
-
JavaAccessBridge.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\JavaAccessBridge.dll
- Size
- 125KiB (127552 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/66
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
ead86d0202c160cfcb02355fbecc8ffc
- SHA1
-
e4a60f32641837186d67b0bd5faea02c3c045056
- SHA256
-
54bc15cadaf52fb4f9dcae22d272a16edc682af636405254fc9839ea2a7c7d67
-
WindowsAccessBridge-32.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\WindowsAccessBridge-32.dll
- Size
- 96KiB (97856 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/69
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
c38011359bb765c0d2ceae0261b867ec
- SHA1
-
be041f89905bee5a0d1744105e71a774cf9c0266
- SHA256
-
cae2024b4db192cfe87403a604c84818a7f110e8cbb1a40d40d689096002702b
-
decora_sse.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\decora_sse.dll
- Size
- 63KiB (64064 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/72
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
670771238d37beac959101e359c19e91
- SHA1
-
764dde771ce5fa5a5bcb087512491fa80288f052
- SHA256
-
c0720a0297cb365332cfc595213efee553b0654e003ec89d30b88af3275af5ec
-
deploy.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\deploy.dll
- Size
- 443KiB (453184 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/69
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
a120006d51578f26b3a0bbc6de51631e
- SHA1
-
e269165d145ded1884a07fbf7ec6ba1105609b4c
- SHA256
-
844e4759fbb43b851b0d87a9dd8021607bb9d45e81d5efd49b8f73206a02975e
-
dt_shmem.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\dt_shmem.dll
- Size
- 25KiB (25152 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/71
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
871fc7a20030e5f8311b82f14c2c4003
- SHA1
-
863f7cf5a52742a666a8eb81e27402af6cbfc028
- SHA256
-
3938ff2262312dfe4655bbc478cc63e8a95322f6bf9507fc909f1b68b8edc22e
-
glib-lite.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\glib-lite.dll
- Size
- 392KiB (400960 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/70
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
e210b6b508ebfab52d8bfc82fe2447cf
- SHA1
-
186767ea1e9fe1151d001aa5036a520c780e0c1c
- SHA256
-
5b4db2ccddc4e1b42ae47e96fc7a6cf98097f163cd5ab218ebb4ef24d56f4b4b
-
hprof.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\hprof.dll
- Size
- 130KiB (132672 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/68
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
7d0fd3ec99afa39aec7579c3ddb009c4
- SHA1
-
e3868516c774bcb8a2fb095476d827c289ce0460
- SHA256
-
81164f93269f992769e2a9305190ed13b88bce07a4d409cee6ce39f2808a7206
-
instrument.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\instrument.dll
- Size
- 113KiB (115776 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/73
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
0308e18ee54d859dde51a04f0e47c09e
- SHA1
-
4d1579f871a2087cb75b29f9341f4c18e841f299
- SHA256
-
5efa045eac32f3b3137a9d29788bccd05752d30af84c011dd98b459c64555fe5
-
j2pcsc.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\j2pcsc.dll
- Size
- 16KiB (16448 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/68
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
ef03890e9ed2cdbac6bb549f37f0713d
- SHA1
-
cd6702a0558bbe0af7ab41a719e3f26fe335cd7e
- SHA256
-
27e5906786aa03e99b96855625501b0b598715325506e08a427b01c2c3f1771e
-
jaas_nt.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jaas_nt.dll
- Size
- 19KiB (19520 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/70
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
35461fa1810d0701c89d665fe1551baa
- SHA1
-
6eb9f929413285666652ffe978b5da8690b0e7bb
- SHA256
-
9167c56ad1a575d3b51ce5d2e26431119e25da92ef2878532fcba99549c6d57f
-
java.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\java.exe
- Size
- 187KiB (191040 bytes)
- Type
- peexe executable
- Description
- PE32 executable (console) Intel 80386, for MS Windows
- AV Scan Result
- 0/68
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
1b7f15ea9da5322698988698c7d58959
- SHA1
-
9c49a19effa38d19ce27a4e8a1d661cc8157d710
- SHA256
-
f5fe39aa2170eeda6f5932aa28b20478027c206d71176328421b802af09317e9
-
java_crw_demo.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\java_crw_demo.dll
- Size
- 23KiB (23616 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/65
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
48726ca1fe288db2cb03f131718f6098
- SHA1
-
56d5fb63acc2ac1cc7e837701eaf41998320516d
- SHA256
-
9388706c19b91909816a38cde1d6c33fcd336f91c55573bb451a79cf7a15123f
-
javacpl.cpl
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javacpl.cpl
- Size
- 157KiB (160256 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/73
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
70a99497b21174721d82916d9f6cd2a5
- SHA1
-
769782e0ad22959f1ad5873079d7e9e459df5b94
- SHA256
-
f381547c0ff396828407af3a353445b7658d1d316266f211d323f662640123e4
-
javacpl.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javacpl.exe
- Size
- 69KiB (70208 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/58
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
c07d4839606118bbf7c5153ff171301c
- SHA1
-
b2a71081f24aaec9bf9a6bbab30f73c59583cc55
- SHA256
-
dd6a09bdcb92d23a0b41d37cc892a45f168021ec5d7ed5249762dcced300d8aa
-
javafx_font.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javafx_font.dll
- Size
- 56KiB (57408 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/73
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
239167fcbce01539ddc54f0653b97832
- SHA1
-
9fc1ca29fd31494c36f4d3b90f653fde26cd4e46
- SHA256
-
d372b638c5971d29e6e09dcd5f005fe199209616dec453f4992e3e80c46aa127
-
jawt.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jawt.dll
- Size
- 14KiB (13888 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/73
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
56789de9e08ef2bb059261908a6f6773
- SHA1
-
ad3a1e82ec80c48fd3594d379b049cc63e02451a
- SHA256
-
635a304ae45d61c065e62cf0a6512fcfe3d63a26273ff6bd57cdb373a08a4e68
-
jfxmedia.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jfxmedia.dll
- Size
- 113KiB (115264 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/73
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
f716f9c4771beb18fbcb029943d6a65b
- SHA1
-
24a54f9f2db1282095511588165c7a53b3c1ac5e
- SHA256
-
a979c96f8059da801cfa84804b0b9b7e81154df0d4bfdfda915b7a2411bd1260
-
jp2launcher.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jp2launcher.exe
- Size
- 81KiB (83008 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/67
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
ebf20dda7dda14bbd1f6f2f1b37bc113
- SHA1
-
707325f533ea8f91cf2b6b3e600452675079f08c
- SHA256
-
267e95fc48e39a9d885a5ffb2e272f04488f9037bd8c4bc36dd1c3558097a4ae
-
jsdt.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jsdt.dll
- Size
- 16KiB (16448 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/72
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
f31cf27065bc0729e8f347760361c24d
- SHA1
-
82563dbd6f3f2448a6469853fe23fa0abdfcf48c
- SHA256
-
3190db5841b0ea530dd230c62a2dd0f35c031a97f28e6b409e6eda88bef9d237
-
jsound.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jsound.dll
- Size
- 30KiB (30784 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/71
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
6205b9c2db7c7f8b639d1d296b08e3c6
- SHA1
-
c3cea510f253b50deee19cddf6c7d0d5464d56d2
- SHA256
-
5916a065291b4cc367539a3527ed8b703a8d7816439c0beccbd151c753b8c945
-
ktab.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\ktab.exe
- Size
- 16KiB (15936 bytes)
- Type
- peexe executable
- Description
- PE32 executable (console) Intel 80386, for MS Windows
- AV Scan Result
- 0/65
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
09c754efaee0da93817d5dc0a5ffe8b4
- SHA1
-
b5e1de3ae0e35ccdd57f463cd7057b13ff7c4936
- SHA256
-
8957859b77c98f7ba3ea2107d4e634cc572b85267c027e73d5f0afc61765f793
-
lcms.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\lcms.dll
- Size
- 182KiB (185920 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/65
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
f7726f350c74f020a0a5e77d2cd4104f
- SHA1
-
845c69f30be3ba620127c961f830964ec4a8ecd0
- SHA256
-
4407ad10d5871473a3e96565bfe00e51f62af7c75cc143ca43434cca9a0eeaf4
-
orbd.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\orbd.exe
- Size
- 16KiB (16448 bytes)
- Type
- peexe executable
- Description
- PE32 executable (console) Intel 80386, for MS Windows
- AV Scan Result
- 0/66
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
f38fb008b3816d9585f10a7d2cc22df1
- SHA1
-
478679c6c3497fd63203b0ec899b32002edc0c88
- SHA256
-
8dab5831f7247ee31e8a50e09de7999e48e4d0e0d1cd232ee21eaab38023a85b
-
rmid.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\rmid.exe
- Size
- 16KiB (15936 bytes)
- Type
- peexe executable
- Description
- PE32 executable (console) Intel 80386, for MS Windows
- AV Scan Result
- 0/60
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
b8edc4631e2b5d7ae9e626690f6506ff
- SHA1
-
355e55d0cc56a623539037d245008e50886cbcc9
- SHA256
-
762b42b2a393099ec32d91d9b4a0dcb8caa9a12719e7b80c417a009b4c91f1ba
-
ssvagent.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\ssvagent.exe
- Size
- 52KiB (52800 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/64
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
5f2d0025cb3c078e0aab83e1430827c6
- SHA1
-
88576ad11db3fa88662d2ac822df50fe813fdc9e
- SHA256
-
76280ba3299769d0a73beaa5fe3e57d0096c273fee79b1237eb2b1f0499c622f
-
tnameserv.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\tnameserv.exe
- Size
- 16KiB (16448 bytes)
- Type
- peexe executable
- Description
- PE32 executable (console) Intel 80386, for MS Windows
- AV Scan Result
- 0/66
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
6dda1d127fd0c4b8f93307e6d52b1abd
- SHA1
-
a106cd234ef1a39f301a4292a699d6828c82a8e8
- SHA256
-
729a9df7fc6110814d78baa0c9d6b1181d985b27b38b1a97922eaa343f7c03df
-
unpack200.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\unpack200.exe
- Size
- 156KiB (159296 bytes)
- Type
- peexe executable
- Description
- PE32 executable (console) Intel 80386, for MS Windows
- AV Scan Result
- 0/63
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
ed141a08605af568747c8f418170fc06
- SHA1
-
37b6756b597221cbf56aa924f1be389a62a10089
- SHA256
-
191324e36d5cc76f735a91a343c3b3fe1315cf339aa76dc546f1099e0433ec26
-
wsdetect.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\wsdetect.dll
- Size
- 160KiB (163904 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- AV Scan Result
- 0/71
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
58ecd2d334364d12d8d3945ca78391ae
- SHA1
-
5032a59873b39081ded27d5a598128f1a21e5ad5
- SHA256
-
7da3a2cc1385b1cb0bb34a1df0ea313e774b0a8838356bb2ba0e0c4eedd3a820
-
deploy.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\lib\deploy.jar
- Size
- 2.2MiB (2284288 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/59
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
7c8eac73dd3b152dba568c9621e27dfe
- SHA1
-
489643ecd63f20958935825d6da913a2479dba41
- SHA256
-
b8e5f54ef238281787cb8334c3f22f2d8f7fea33942d737d74c8b8a855ef85e6
-
javaws.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\lib\javaws.jar
- Size
- 464KiB (475438 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/57
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
87f77c08cad9320b11a417deaeb602d6
- SHA1
-
1442d5cf863145bd0ab0fcef5be3cb10adf79b31
- SHA256
-
c3ba28a1d9949611f96a7160548b55eeb1a524309317907a6f4a701b0b03a80c
-
management-agent.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\lib\management-agent.jar
- Size
- 381B (381 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/58
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
de8e79956bd3bc89d462913cfe2c62e6
- SHA1
-
eaaf57bfb00a0a351bb1a0383fced1cd9a1a569b
- SHA256
-
77ae390c7688e797d3af966a5733de1061489ae7a8c1f39798d9dc0529fa9433
-
plugin.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\lib\plugin.jar
- Size
- 987KiB (1010725 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- AV Scan Result
- 0/59
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
c677d63ee4403fa685a630523eae8957
- SHA1
-
ea8b077bdc74ec02dc67fc78b721ef1bd09e8955
- SHA256
-
592d97a4722f5967a33de75b3876b5b308e15ddc7dbb7b121b8fdc5c3898d9dc
-
CHCP.COM.62ACF3C0.bin
- Size
- 12KiB (11776 bytes)
- Type
- peexe executable
- Description
- PE32 executable (console) Intel 80386, for MS Windows
- AV Scan Result
- 0/68
- MD5
-
4436b1a16bdc58d2b3a5263f042c09b3
- SHA1
-
cf2e11809832fc7d3d7f3169418690b8ea4fb969
- SHA256
-
6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2
-
CHCP.COM.62ACF6CC.bin
- Size
- 12KiB (11776 bytes)
- Type
- peexe executable
- Description
- PE32 executable (console) Intel 80386, for MS Windows
- AV Scan Result
- 0/68
- MD5
-
4436b1a16bdc58d2b3a5263f042c09b3
- SHA1
-
cf2e11809832fc7d3d7f3169418690b8ea4fb969
- SHA256
-
6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2
-
-
Informative Selection 1
-
-
fbadb5649d7bf34f.timestamp
- Filepath
- %ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage\fbadb5649d7bf34f.timestamp
- Size
- 78B (78 bytes)
- Type
- text
- Description
- ASCII text, with CRLF line terminators
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
c1a8911a270d786fd32d114eb6b3cfc3
- SHA1
-
e7ec087cadabc0484eaae3ea15448f1106ea7abb
- SHA256
-
8b7b42fab82be9b28c8a8b9dcabcf6272e8713c254908125ee9923a2adb8a128
-
-
Informative 82
-
-
17dfc292991c7c62.timestamp
- Filepath
- %ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage\17dfc292991c7c62.timestamp
- Size
- 51B (51 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
ecaaf1b0060f0b196b41099e89c21ea7
- SHA1
-
e23d22bce818057f96af5669393d32f855409b64
- SHA256
-
5421d48ef1f5d991e811c7ffd834eaf21c86abab3e97e21930c171f3734f6816
-
aopalliance-1.0.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar.tlauncherdownload
- Size
- 4.4KiB (4467 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
04177054e180d09e3998808efa0401c7
- SHA1
-
0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8
- SHA256
-
0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08
-
junrar-0.7.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar.tlauncherdownload
- Size
- 152KiB (155205 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
75a215b9e921044cd2c88e73f6cb9745
- SHA1
-
18cc717b85af0b12ba922abf415c2ff4716f8219
- SHA256
-
7c764fa1af319b98ff452189ab31bb722ea74ed7a52b17b0c6282249c10a61fc
-
guava-19.0.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar.tlauncherdownload
- Size
- 2.2MiB (2308517 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
43bfc49bdc7324f6daaa60c1ee9f3972
- SHA1
-
6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9
- SHA256
-
58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4
-
guice-assistedinject-4.1.0.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar.tlauncherdownload
- Size
- 42KiB (42873 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
65912196b6e91f2ceb933001c1fb5c94
- SHA1
-
af799dd7e23e6fe8c988da12314582072b07edcb
- SHA256
-
663728123fb9a6b79ea39ae289e5d56b4113e1b8e9413eb792f91e53a6dd5868
-
guice-4.1.0.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar.tlauncherdownload
- Size
- 658KiB (674028 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
41f66d1d4d250efebde3bbf8b2d55dfa
- SHA1
-
eeb69005da379a10071aa4948c48d89250febb07
- SHA256
-
9b9df27a5b8c7864112b4137fd92b36c3f1395bfe57be42fedf2f520ead1a93e
-
dnsjava-2.1.8.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar.tlauncherdownload
- Size
- 307KiB (314639 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
540f330717bca9d29c8762cf6daca443
- SHA1
-
eed8a2cbf56cc60d07a189a429ead3067564193c
- SHA256
-
52de1ff2a7556ac2cc4284abd7123bc3d6274210fc4e3b1d9ba90efad5f6a153
-
javax.inject-1.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar.tlauncherdownload
- Size
- 2.4KiB (2497 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
289075e48b909e9e74e6c915b3631d2e
- SHA1
-
6975da39a7040257bd51d21a231b76c915872d38
- SHA256
-
91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff
-
jopt-simple-4.9.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar.tlauncherdownload
- Size
- 65KiB (66469 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
39c6476e4de3d4f90ad4ca0ddca48ec2
- SHA1
-
ee9e9eaa0a35360dcfeac129ff4923215fd65904
- SHA256
-
26c5856e954b5f864db76f13b86919b59c6eecf9fd930b96baa8884626baf2f5
-
commons-lang3-3.4.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar.tlauncherdownload
- Size
- 424KiB (434678 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
8667a442ee77e509fbe8176b94726eb2
- SHA1
-
5fe28b9518e58819180a43a850fbc0dd24b7c050
- SHA256
-
734c8356420cc8e30c795d64fd1fcd5d44ea9d90342a2cc3262c5158fbc6d98b
-
fluent-hc-4.5.13.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar.tlauncherdownload
- Size
- 31KiB (31547 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
8f7e4f1a95a870ebee87ddacc425362c
- SHA1
-
300bf1846737e34b9ea10faae257ca8fdcd0616f
- SHA256
-
f883b6b027d5e05c53e48e4fe3548715c52dbd590ffa3f52d039574f1a4d0728
-
log4j-core-2.14.1.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar.tlauncherdownload
- Size
- 1.7MiB (1745700 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
948dda787593340a7af1a18e328b7b7f
- SHA1
-
9141212b8507ab50a45525b545b39d224614528b
- SHA256
-
ade7402a70667a727635d5c4c29495f4ff96f061f12539763f6f123973b465b0
-
picture-bundle-3.5.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.5\picture-bundle-3.5.jar.tlauncherdownload
- Size
- 2.1MiB (2183511 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
c93265b9d8bbe2b8d07f34893e5945c4
- SHA1
-
ad0a3c5e104b95f842998d39c6a50f38b7bf1d03
- SHA256
-
7238f234112b746de9dd96d7cafe34436c3f43a9f4ebd5659a38e5ba1b11d277
-
skin-server-API-1.0.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar.tlauncherdownload
- Size
- 14KiB (14761 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
13a8e72587ac6eacfb0986f75e51eb7c
- SHA1
-
6c3daf89705427f73e6106d2d4d9619e99c5ecb5
- SHA256
-
1fcffa073f722737431e2699b1f3ea48b92a3b825397d8f0d1464e4d4d15a014
-
tlauncher-resource-1.4.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar.tlauncherdownload
- Size
- 3.2MiB (3312651 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
acbc8aa5ba5cdddf5f1e67befe8cc597
- SHA1
-
63b4bf89744b532e65c1afa3294743d2b3798f2b
- SHA256
-
1f46b3a163012f9729905633b5e5e03ce385066ae43138a564729c942f9ca6b9
-
xz-1.5.jar.tlauncherdownload
- Filepath
- %APPDATA%\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar.tlauncherdownload
- Size
- 97KiB (99555 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
51050e595b308c4aec8ac314f66e18bc
- SHA1
-
9c64274b7dbb65288237216e3fae7877fd3f2bee
- SHA256
-
86f30fa8775fa3a62cdb39d1ed78a6019164c1058864048d42cbee244e26e840
-
doubleRunningProtection.txt
- Filepath
- %APPDATA%\.tlauncher\doubleRunningProtection.txt
- Size
- 13B (13 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
f673afbc3c245efbfef825a63505b4c0
- SHA1
-
5e8cc2f50a1f1c631ec87dd76b53682cbf26058c
- SHA256
-
b33093e8f7cfb5b462ddd5e18f653814d460134f81bb60725a2f45a511e2b7ae
-
jre-8u111-windows-i586.zip.tlauncherdownload
- Filepath
- %APPDATA%\.tlauncher\jvms\jre-8u111-windows-i586.zip.tlauncherdownload
- Size
- 5MiB (5239900 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
9483a23d7e45eb838fccec218bbded07
- SHA1
-
6434774d197c0495d73f556146ec5e6d60cf13ae
- SHA256
-
ab0c1090f0afc5e7ad880cade7557c9e284327afc6da2aaeb34882a0e24bb065
-
awt.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\awt.dll
- Size
- 1.1MiB (1182784 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
17baec36a46d7684605455f2ff4a3def
- SHA1
-
d1d6443ed9e5a3d4c522bce26ecd84480724b014
- SHA256
-
5ef9554a85cf1c8f16c699a10d2b101752f5993c347e922690b0e388744f7997
-
java.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\java.dll
- Size
- 124KiB (127040 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
18f8d84d59784767110b30015c6b1685
- SHA1
-
d74241a66ef18b4331d42a91a90a6163a64b59c2
- SHA256
-
723d9658aea50721f7cc9daf3d15e6daec092f0be2d437bc82c017d1a493749a
-
management.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\management.dll
- Size
- 33KiB (33344 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
f20b93f36a9eccc4599cc61620682823
- SHA1
-
4df294824c209e758aec9f58a0a061f3dbf17ffc
- SHA256
-
a78b18a34dc660181b9b19880a6b0ad27616c54fb1df9bf692db66edaf7f3f8b
-
nio.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\nio.dll
- Size
- 50KiB (51264 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
8ba867f713cd104a4794064ef7ef63e9
- SHA1
-
4b439792403bc7353ab5f5c1768472c59d9017ec
- SHA256
-
4d875a685de8a56d0975a850065a6240f66bfdfc4c6d90082d7c7bcd60a0aec9
-
sunec.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\sunec.dll
- Size
- 121KiB (123968 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
9c45a23d62244276f9d96d5c249a1409
- SHA1
-
c52f3d7abfde1ceffa44ca08d9289189480ec606
- SHA256
-
a48b0b076eeeaa64ba663810fd76d97b8682e9460fc2135c1148803afe9ace55
-
sunmscapi.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\sunmscapi.dll
- Size
- 25KiB (25664 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
ad57e442e0608df0e416884225c5810b
- SHA1
-
40815ad1a83e3e7105e497559f03131ec3c36299
- SHA256
-
4cb7994d8f1579e60ba1ea85564eddab613841d3f10f0a4363f605fe965be18e
-
verify.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\verify.dll
- Size
- 39KiB (39488 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
02ddc43299e61569ccee04ab620bb41b
- SHA1
-
e5aed3e0c685281bd02057f009c9776d42f02795
- SHA256
-
673b06c857814584236759e5890a41b7455750550207b3e95d06094c6e85f9c4
-
zip.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\bin\zip.dll
- Size
- 68KiB (69696 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
e368901c0f982088e9a5196075b2dec1
- SHA1
-
bb57db3420cfdc250364921d8d18e54486f5c8d7
- SHA256
-
6ebf0b270af310b35d39f2c294a0f164824f1bb4d0f0f870043943d6225c7884
-
access-bridge-32.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\access-bridge-32.jar
- Size
- 184KiB (188021 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
89510ab54adad9d9077ed5074141a07d
- SHA1
-
9a7e455ba426e98a4721879c4115fc5156a9afc2
- SHA256
-
5a0e423d80598d504ae6713dd02906cf378037a059ae80891bb488cafa24732d
-
cldrdata.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\cldrdata.jar
- Size
- 3.7MiB (3860502 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
0a836b6c98a599690395c85ad53f2b37
- SHA1
-
a6a4f6f5ff578422369b7b502c113b2d55b10a81
- SHA256
-
908d2789aa7e495f4422b6d7e90449041ddab817178840c80a8315c38ba73fd0
-
jfxrt.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\jfxrt.jar
- Size
- 5MiB (5238554 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
13eaf7d7f5b612e48c193c20b8bba423
- SHA1
-
50a5e090565341926edc8c4af57b5bf543c72361
- SHA256
-
a1847c880d73c7ab4eb7c081607f479a5f1f415d72da8f1611366187d7f36d39
-
nashorn.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\nashorn.jar
- Size
- 1.9MiB (2019023 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
5a57490018869d2ef6282bb346193aa1
- SHA1
-
21bb6218d627b406c1267f01e3a7fca698e4b55c
- SHA256
-
12c8bf683658482ca5e28f713ea17a9e348aa76212b40d59da3b955a6158c37a
-
sunpkcs11.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\sunpkcs11.jar
- Size
- 245KiB (250826 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
2e33d8f1fbeb9239c6ffc0d36de772d1
- SHA1
-
3f881e3b34693a96cd3d9e20d6aeabae98757359
- SHA256
-
938c497e97e893d0b9325522475ad9fb2c365a4af832ed180b570c3e4e6fd559
-
zipfs.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\ext\zipfs.jar
- Size
- 67KiB (68923 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
e15a6e3579e2ad27bfe9043655d90e87
- SHA1
-
66f3d191da4e3df51c41488f2fd6825dedc882da
- SHA256
-
6e9b40451e50443b3fe05026a1905e0741012de0e9dae6c377dec04d14456ae7
-
jsse.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\jsse.jar
- Size
- 620KiB (634758 bytes)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
54ea319a3f605c4087052f685d4edcf9
- SHA1
-
37e5777b57abb384e81bc52c45e9f2b08186dc1c
- SHA256
-
9557f9fb5aa24b58862e95859356c9b7dfa275ed375f2f9ae63930601f70e0b9
-
rt.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111\lib\rt.jar
- Size
- 5MiB (5239702 bytes)
- Type
- java compressed jar
- Description
- Java archive data (JAR)
- Runtime Process
- javaw.exe (PID: 2800)
- MD5
-
95b6713bbb1751be57b49e42e7273f50
- SHA1
-
50a1c0631b5a0f93e9c4e8231f4db2d77fbf34b6
- SHA256
-
007d6bd7634782f4b712610f93be686e1702c19467d38800e6d0887f80d916cc
-
JAWTAccessBridge-32.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\JAWTAccessBridge-32.dll
- Size
- 15KiB (14912 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
c5dcbfe27544dc5f05e02a5b8e4c39af
- SHA1
-
439975f9fa5ec3decc24e97163f77ef7b2db2da7
- SHA256
-
988c8d1bcfe0bd2cf65028f598b6fbdf58c30a9696bd1f79803c7390ba30c9d3
-
JAWTAccessBridge.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\JAWTAccessBridge.dll
- Size
- 15KiB (14912 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
4a4a1bc4c7149bd7c10b3ec14ffbb071
- SHA1
-
25030f314e129a7324a97fbf5cd151ffdf6360aa
- SHA256
-
c7158ae91b9fa6f926b3f7f6ec0101c5f3ea87fb9ac142a7b452621f7cfbda74
-
WindowsAccessBridge.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\WindowsAccessBridge.dll
- Size
- 94KiB (95808 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
fe58674254acc465adcc4c99664f8900
- SHA1
-
7bebd22805f5a14cc497991b33c46c9ca2a313c5
- SHA256
-
02f0c4add1453e811a98bba2d72a1a7138dfd081b12c9bd3ee7fe1d13ef39925
-
bci.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\bci.dll
- Size
- 15KiB (15424 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
173fe21886fd250cbbff396c04c3cf0f
- SHA1
-
6ce9873eb9a933ca92dde55739026837b09f3de2
- SHA256
-
4d7330633b39596f931525c0bcfcdde7c1dfdb035902d16b94468bcdce690552
-
dt_socket.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\dt_socket.dll
- Size
- 21KiB (21568 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
800e677778aa8bc6b3248c38b219e5d2
- SHA1
-
387a5b1b3bd7f092ac61cebfeff37dbaf720d966
- SHA256
-
816a7553d559591df702897b09f36030789211191b2c88ee08f6158f75121849
-
deployJava1.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\dtplugin\deployJava1.dll
- Size
- 807KiB (826432 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
e0850ffad8e860f8d24455e17656fe07
- SHA1
-
ba98f5fdcdf11855e3af122e7900a62607ab73e0
- SHA256
-
f2be52dd0a91052ff36d92fd5ea61d5f5ac6a5bfc90fffc277d4ae8855b218bf
-
npdeployJava1.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\dtplugin\npdeployJava1.dll
- Size
- 887KiB (908352 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
6488ce92fb6a838f51af255760053d39
- SHA1
-
4d6e66403d7e6ae923d875666c0ff434771a9a66
- SHA256
-
a337da98e7f0e32ee2bc6008373c102a2fc59e1c778c40e4d7a3821f69081106
-
eula.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\eula.dll
- Size
- 107KiB (109120 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
3c9bc622fe199d1a6dfb94d9a20eb5fb
- SHA1
-
35273168feb8ea56d353f4fdc2c42a16eb21b82c
- SHA256
-
58fcbdf94afff0ede15bc5115c2288c27c601077c64ef19a68de8bd2b187719f
-
fxplugins.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\fxplugins.dll
- Size
- 149KiB (152640 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
c1b4d3b419f20ec9739e2834bba51b45
- SHA1
-
89390a07bfbd3907c13ad600ef646b158539ecc8
- SHA256
-
202ed55571a63a594677878b0ab320e79ed72eb51c3bb1aa24dd9959f2165ff7
-
glass.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\glass.dll
- Size
- 196KiB (200768 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
4fc0f269cd7ba72edd898b26f95e5c79
- SHA1
-
32d5917bebbc019a1c74014b84b408eae7f3dd2e
- SHA256
-
f6e1feb0e5723ed0e8a2045d2246439f6420794de210f24fbc25ee6082ddf5e5
-
gstreamer-lite.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\gstreamer-lite.dll
- Size
- 503KiB (514624 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
c4bc96bcc0ceb81d1bc79231f7f197b2
- SHA1
-
c0c190ffafa92bbd2874f66c0e033870f10f0741
- SHA256
-
51ba3a204977d992bc5d36fe08c7236d4bc075d12bf7f4f63bb1400e2a83b03a
-
j2pkcs11.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\j2pkcs11.dll
- Size
- 50KiB (51264 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
fa73097219163a9d38fc932e790d276a
- SHA1
-
6420433d7d2dde4fdc1a653b5d93f5be7344acee
- SHA256
-
97a61738731bfd7e8e4b61bdcfdef59e4a6afc3b219b1be241c89b022f346344
-
jabswitch.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jabswitch.exe
- Size
- 30KiB (30784 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
1598cf2fad014e95975560929f578e05
- SHA1
-
7f0347ef9cdb3dd35f0be76057bcaec113889351
- SHA256
-
69445693feeb9d35e969e07d8ae1ed7c9c8e68aeecced830f7d4bb2bc0dc08aa
-
java-rmi.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\java-rmi.exe
- Size
- 16KiB (15936 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
c2b897032a8604e1827b0cd07ebb3306
- SHA1
-
b612bddcda879cf47b0b22b0cad2845f745dafb3
- SHA256
-
2438923f0ced2dc366d6405f55e439c68f8322b2317f54d2622862b4d1a9061c
-
javafx_font_t2k.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javafx_font_t2k.dll
- Size
- 436KiB (446528 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
273b898a7e94cc655ae7412e431ab177
- SHA1
-
e28dfc83e22b314e444032e3032d1399ee10034e
- SHA256
-
fa2e850afac25810eaa8391d4a7ef3781e38e298e71ed23e400c8c903ab81227
-
javafx_iio.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javafx_iio.dll
- Size
- 123KiB (126016 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
7ba323af818603ba205eded7162be0cb
- SHA1
-
61acb3aadfdf6676e320fd7045592f1b46940cc0
- SHA256
-
f737e30ff5f8f54fe12a6335f05b080fb8f1af0ffbfd636f99ddec1a224f497a
-
javaws.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\javaws.exe
- Size
- 264KiB (269888 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
5a92988b4dec8eafe62f7d2dbe8ab620
- SHA1
-
eba90f7d0860442fd26dc64186f928b248e04338
- SHA256
-
337b78f3d05e8d022e52a1fe2cfb89964e28391f9c7309ad33fbb15199ea002e
-
jdwp.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jdwp.dll
- Size
- 160KiB (163904 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
1e3e2cf0685b80997ff551a3d2b89eff
- SHA1
-
a2df56678858f70aa5809ef93c66c41c598c47e6
- SHA256
-
e9413e932046a032ea3e10224c325017e6f96ce2d6a2e0702de776b798e32ee3
-
jfr.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jfr.dll
- Size
- 22KiB (22592 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
48d9088391215cd9751e95db96ebe121
- SHA1
-
64ac399baae6cd084b8bf975c36ba71d4c0f30fb
- SHA256
-
7eaa2ede909d6b971a6734f61740246b8f7db92db63a1e7318a1593c51f0967c
-
jfxwebkit.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jfxwebkit.dll
- Size
- 5MiB (5235538 bytes)
- Type
- pedll executable
- Description
- PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
92172e7a662cba035ca8fff7edb87211
- SHA1
-
d69989fc18c445f4d279932bc314928159079784
- SHA256
-
b4771c4564e6aae5cd0e5498867da6d49fcd636750bc1a4855503f6ec6320438
-
jjs.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jjs.exe
- Size
- 16KiB (15936 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
487c48aa28b0dc99a387f31e7764abfb
- SHA1
-
1a9c4266dadee118d48006dbefaa771a88853d2e
- SHA256
-
2f0782e359b9a738012610996bf708ea580e372a8e3c7080ec838722271c75bb
-
jli.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jli.dll
- Size
- 155KiB (158784 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
993be5d7c819fd05a2e2a85edcc3d710
- SHA1
-
5d2c9d2619804fe7ce85bd96f18b7ed4ed9020ad
- SHA256
-
3aa335c9edc9710ed3c0c5bf74037c920887815179f98d5a9c69281591425927
-
jp2iexp.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jp2iexp.dll
- Size
- 203KiB (207424 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
cb87688fb234a72ce89ff4aaabcd036e
- SHA1
-
9fe78ca4e56b3b2e4cce0396a9d7ac56c7f4c998
- SHA256
-
941dfdb0c929efb8f88f21a373b7943cda5e55392341a36d6e8d5a32864329bf
-
jp2native.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jp2native.dll
- Size
- 19KiB (19008 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
25cb1429e75d5541b65a6e7e84d53235
- SHA1
-
9a36e6a002e5852c9aba51bcf99177530905f787
- SHA256
-
5693f0fedf58eed0a7aaae048a4d2f296a861aac1bdeabffb5ee8e7434a1eaf2
-
jp2ssv.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jp2ssv.dll
- Size
- 183KiB (186944 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
f679c03dee56e10d4196192e1dcefb03
- SHA1
-
96402361ab5b5232d2a45522715c2650137abc0b
- SHA256
-
fa5007a31b612abf351dace0c961b48f4eccca45e77ee279727841b6f7fadc08
-
jpeg.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jpeg.dll
- Size
- 143KiB (145984 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
e99102723a0aab6d3ee2065f75cbc841
- SHA1
-
bb21d412a388c45a178d0f3c2b0caa0877209396
- SHA256
-
8352e4344efec059f88a6f32ee459a30ce3a9f111435187a5852b1341b6092da
-
jsoundds.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\jsoundds.dll
- Size
- 27KiB (27712 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
2920ec7d6d0c7f3b02787c030771f59d
- SHA1
-
b882b03cf67631c9037f138f1dadc221d57d0818
- SHA256
-
63d16e1c003e17b559f49d0636d9b66cede2156a8fa35ece2f73bb0e7a5254bc
-
kcms.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\kcms.dll
- Size
- 174KiB (178240 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
a713f910a411aa3d2157c2e55ba03b4d
- SHA1
-
497e7bdaf53317f494de98e072f769050f788284
- SHA256
-
aff9fbcf0b59b9ec5dcbfa3f42d6de1042d2d88a95c5017319242d9049f3bda7
-
keytool.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\keytool.exe
- Size
- 16KiB (15936 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
a1ad424b821eb9878b985ab43253dca0
- SHA1
-
1145cdf61b88824c4f9e3d95e75ca04ced7a5112
- SHA256
-
d5e2c533a11358d9d84fe087378ca31b54e6094df5cf3151f7987cb611e12cf3
-
kinit.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\kinit.exe
- Size
- 16KiB (15936 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
8448994199bee00f4c40a561ae77672f
- SHA1
-
daa0fc3b264f2104d4afc472fcf852e6de36b3ed
- SHA256
-
1e8be0cc324c0277b7959c7a41c658c8e7560559dd33e79005cc906593adc7b6
-
klist.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\klist.exe
- Size
- 16KiB (15936 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
391d35229bf096e04fee6f8520dc3b21
- SHA1
-
1d1cf4595b546d08be5f56754a5fedd8db793f27
- SHA256
-
51b7882fbfb7684cecba1026a1ebd8ffffb98577dd7aff43a990730d2d3a8a0d
-
mlib_image.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\mlib_image.dll
- Size
- 561KiB (574528 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
7366c43cfe9ab6745b869c1a28213886
- SHA1
-
f05c39d0ffc761e2621283aef0efb6169593af24
- SHA256
-
8ed87197216641df2a81c0b732997db33713987065d815cb205447ee1a5d5bcd
-
npt.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\npt.dll
- Size
- 17KiB (17472 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
275bb3008c3a93a9a8d66b999da53796
- SHA1
-
86b9835af3cacd110b6a655ba53ec9c6a85709e8
- SHA256
-
f713125fac27f4e2b8dc59305feb71b92119fbb5e4a1c9fbebceadafae777a7f
-
pack200.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\pack200.exe
- Size
- 16KiB (15936 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
65e94ec48ae31838c8f6f2f4fc59ab44
- SHA1
-
ba87ca8257fd4ea2abd79db7040a6e1102537cf6
- SHA256
-
b9f98f76f79b89864b5a6f3f12eab67607df99a51467a28aadbcd12c5f4ad313
-
npjp2.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\plugin2\npjp2.dll
- Size
- 168KiB (172096 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
83a6a74450758132aa7ab624645a7365
- SHA1
-
8029d5fbd358dea3bed6e9ed720886b9f88b8bd4
- SHA256
-
91be58a832f400f2f4f588e230b2c366bb0bffc3b4318df6d78b66417204e481
-
policytool.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\policytool.exe
- Size
- 16KiB (15936 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
3faf0c9a1d59f5d196c0578839a00efe
- SHA1
-
147c1483be81fdb53d4bf46bc5548dfbfd1dfd8a
- SHA256
-
cae8fb14a9da5805f38cc59541e0a1131be08314afd4311893313e3730523677
-
prism_common.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\prism_common.dll
- Size
- 52KiB (52800 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
fdb72f1ce51f7aadf99a5cad94dbd072
- SHA1
-
7cab2ca5550c3867b30959787cbe5b95d4a9e6e8
- SHA256
-
6214a49e67e2e8cf0cde7db84e0ff2158fe8717bff1fecb0ee2b56a648b92614
-
prism_d3d.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\prism_d3d.dll
- Size
- 114KiB (116288 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
2854e082e039ecc7289230094387ab40
- SHA1
-
45c007373c381500238585f17b4173dc96961752
- SHA256
-
703433bcb0c4c2a198dee83a13b14165e4159d3b60f0291dd83b26c2c4bf2bbc
-
prism_sw.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\prism_sw.dll
- Size
- 85KiB (86592 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
22ee5c48288da17d6feb21e12466b3d4
- SHA1
-
f7476f5ef0eb5dd1b25fc2192552b5da12092b7f
- SHA256
-
185342b17a66bf263c614b3c031d62b6239c0020d609619c0cd7ff7f3e8f5fe3
-
resource.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\resource.dll
- Size
- 15KiB (14912 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
5afd439bb40300282e4766441269a188
- SHA1
-
020b28361141696dc088e369ca0f85bcfa766b0a
- SHA256
-
3569ce864ed73d1cd0482c8063bfe6e3cb11f5e420ba473a6fc748abf8a7793c
-
rmiregistry.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\rmiregistry.exe
- Size
- 16KiB (15936 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
1d623a885163d6ba50175987b4bb9450
- SHA1
-
e804914475cf22dfa1609c59f731586aa5ea3111
- SHA256
-
d5c45d0d4a0f35c775215f96009e570fbb05365582cc99fdcac0608ebd1b3b58
-
servertool.exe
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\servertool.exe
- Size
- 16KiB (15936 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
490d67c45ee587b06833ada0811f241b
- SHA1
-
bb07d0194be01e3b1044e312b6208562bd48a4d7
- SHA256
-
fa11dc97ecb09139ff1b9788034e58f5e2ae95de366b86ffa23bdedca95708aa
-
splashscreen.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\splashscreen.dll
- Size
- 173KiB (177216 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
17ac105d833c2bafb64ecf62537b3ad8
- SHA1
-
a3f7cc18ab4979d06c732d4462b8ecad67d093c4
- SHA256
-
0fb5a4681cdbfcdce8f5a1f557d5ab6c5091173c91bf8ef4390f24a748109781
-
ssv.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\ssv.dll
- Size
- 462KiB (473152 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
5c9188d55288be35ff0c5d70297090ac
- SHA1
-
af02b0735d233d41aa3c62a92fd9c1486574e4a6
- SHA256
-
0aabf3a52ebca0ea0084a3d4dbded2f4463c0bed9b624cbad55f012a1dc68fea
-
unpack.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\unpack.dll
- Size
- 64KiB (65600 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
294687e0af2854b2a68be75ac709f37d
- SHA1
-
21c62a36e4910d075c31ae7f6093b9e68b117459
- SHA256
-
4d202521891e9accda14677b2ec3a44aaa53fe793ec1a38e9c8c0f56cd5e4dee
-
w2k_lsa_auth.dll
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\bin\w2k_lsa_auth.dll
- Size
- 21KiB (21568 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
8364741963588e7a617810b26d87008c
- SHA1
-
65b69f65cce6c0015ffac271cc0906e35a738cb3
- SHA256
-
3f46d656f2130ece5f71169c0e5f07a52cb8b8aacdde04c614ddd5ad506f7b7d
-
jfxswt.jar
- Filepath
- %APPDATA%\.tlauncher\jvms\jre1.8.0_111_temp\lib\jfxswt.jar
- Size
- 33KiB (33932 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
3c386fac35d104aceaf13c7249ace3ab
- SHA1
-
b11994ee87cd3c15401dac76a1c718b5ccc1ab65
- SHA256
-
0bd61e789f2b52f24c3c85d7619fb6bb05edb9803d088423f7b3d9a23af2eece
-
dcpr.dll
- Filepath
- %PROGRAMFILES%\Java\jre1.8.0_151\bin\dcpr.dll
- Size
- 140KiB (142912 bytes)
- Runtime Process
- javaw.exe (PID: 3840)
- MD5
-
1ba0ced13fcba79a2d0b1081422523fd
- SHA1
-
c922b31506a847d69a970386d327ef4b731915a0
- SHA256
-
343ee44e8bdf35036a7e167c56bdd1b231840d0d8cda4526d73485860eb673ba
-
Notifications
-
Runtime
- Not all Falcon MalQuery lookups completed in time
- Not all IP/URL string resources were checked online
- Not all file accesses are visible for WMIC.exe (PID: 2352)
- Not all file accesses are visible for WMIC.exe (PID: 3488)
- Not all file accesses are visible for chcp.com (PID: 2072)
- Not all file accesses are visible for chcp.com (PID: 3556)
- Not all file accesses are visible for cmd.exe (PID: 2228)
- Not all file accesses are visible for cmd.exe (PID: 3516)
- Not all file accesses are visible for icacls.exe (PID: 1388)
- Not all file accesses are visible for javaw.exe (PID: 2800)
- Not all file accesses are visible for javaw.exe (PID: 3840)
- Not all sources for indicator ID "api-1" are available in the report
- Not all sources for indicator ID "api-6" are available in the report
- Not all sources for indicator ID "binary-0" are available in the report
- Not all sources for indicator ID "binary-1" are available in the report
- Not all sources for indicator ID "binary-16" are available in the report
- Not all sources for indicator ID "mutant-0" are available in the report
- Not all sources for indicator ID "registry-25" are available in the report
- Not all sources for indicator ID "registry-72" are available in the report
- Not all sources for indicator ID "stream-33" are available in the report
- Not all sources for indicator ID "stream-85" are available in the report
- Not all sources for indicator ID "string-101" are available in the report
- Not all sources for indicator ID "string-98" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)
- Some low-level data is hidden, as this is only a slim report
United States
Germany
Anonymous commented 2 years ago updated