Technical Information
- [<HKCU>\SOFTWARE\Classes\mc\shell\open\command] '' = '"<Full path to file>" %1'
- %APPDATA%\craftbox\dl_success.mp3
- %WINDIR%\temp\tar104f.tmp
- %WINDIR%\temp\cab104e.tmp
- %WINDIR%\temp\tarfb18.tmp
- %WINDIR%\temp\cabfb17.tmp
- %WINDIR%\temp\tarfaf6.tmp
- %WINDIR%\temp\cabfaf5.tmp
- %WINDIR%\temp\tare581.tmp
- %WINDIR%\temp\cabe580.tmp
- %WINDIR%\temp\tare570.tmp
- %WINDIR%\temp\cabe55f.tmp
- %WINDIR%\temp\tard039.tmp
- %WINDIR%\temp\cabd038.tmp
- %WINDIR%\temp\tard018.tmp
- %WINDIR%\temp\cabd017.tmp
- %WINDIR%\temp\tarbac2.tmp
- %WINDIR%\temp\cabbac1.tmp
- %WINDIR%\temp\tarbaa0.tmp
- %WINDIR%\temp\cabba9f.tmp
- %WINDIR%\temp\tarba7f.tmp
- %WINDIR%\temp\cabba7e.tmp
- %WINDIR%\temp\tara539.tmp
- %WINDIR%\temp\caba538.tmp
- %WINDIR%\temp\tara49b.tmp
- %WINDIR%\temp\caba49a.tmp
- %APPDATA%\craftbox\temp\{c7c55375-c4e6-4349-82e9-eb7931c45f17}.jar
- %WINDIR%\temp\tar76e5.tmp
- %WINDIR%\temp\cab76e4.tmp
- %APPDATA%\craftbox\log\craftbox.tqlnsfmkbf.user.log.info.20210412-003656.1848
- %APPDATA%\craftbox\dl_failed.mp3
- %WINDIR%\temp\cab52cb.tmp
- %WINDIR%\temp\tar52cc.tmp
- %WINDIR%\temp\cab76e4.tmp
- %WINDIR%\temp\tar104f.tmp
- %WINDIR%\temp\cab104e.tmp
- %WINDIR%\temp\tarfb18.tmp
- %WINDIR%\temp\cabfb17.tmp
- %WINDIR%\temp\tarfaf6.tmp
- %WINDIR%\temp\cabfaf5.tmp
- %WINDIR%\temp\tare581.tmp
- %WINDIR%\temp\cabe580.tmp
- %WINDIR%\temp\tare570.tmp
- %WINDIR%\temp\cabe55f.tmp
- %WINDIR%\temp\tard039.tmp
- %WINDIR%\temp\cabd038.tmp
- %WINDIR%\temp\tard018.tmp
- %WINDIR%\temp\cabd017.tmp
- %WINDIR%\temp\tarbac2.tmp
- %WINDIR%\temp\cabbac1.tmp
- %WINDIR%\temp\tarbaa0.tmp
- %WINDIR%\temp\cabba9f.tmp
- %WINDIR%\temp\tarba7f.tmp
- %WINDIR%\temp\cabba7e.tmp
- %WINDIR%\temp\tara539.tmp
- %WINDIR%\temp\caba538.tmp
- %WINDIR%\temp\tara49b.tmp
- %WINDIR%\temp\caba49a.tmp
- %WINDIR%\temp\tar76e5.tmp
- %WINDIR%\temp\cab52cb.tmp
- %WINDIR%\temp\tar52cc.tmp
- 'la####er.zuimc.com':80
- 'o.##2.us':80
- 'ap##.bdimg.com':80
- 'microsoft.com':80
- 'cr#.#igicert.cn':80
- 'cr#.##gicert-cn.com':80
- 'x.##2.us':80
- 'oc##.#igicert.cn':80
- 'oc##.dcocsp.cn':80
- 'la#####rmeta.mojang.com':443
- 'wp#.qq.com':443
- 'pu#.#dqqimg.com':443
- 'pu#.#dqqimg.com':80
- 'wp#.qq.com':80
- 's1#.#nzz.com':80
- 'us##.zuimc.com':80
- 'oc##.###tg2.amazontrust.com':80
- 'oc##.####ca1.amazontrust.com':80
- http://www.zu##c.com/data/attachment/block/ac/acffd1553908518b74aa94b028d27195.jpg
- http://www.zu##c.com/data/attachment/block/69/69ed5e9ce1128aba19a9a4d90ce32606.jpg
- http://www.zu##c.com/data/attachment/block/0e/0ea762d7b6c495d6a8ef76c4a7c5aeb8.jpg
- http://www.zu##c.com/data/attachment/block/76/766476cbfc697cee13f74d777a48e4d0.jpg
- http://wp#.qq.com/pa?p=###########
- http://www.zu##c.com/data/attachment/block/e4/e40e5ba7c4c19ebef9e5bb5e9fda30e6.jpg
- http://www.zu##c.com/data/attachment/block/3f/3f267d1862154031d7b51d964200d88f.jpg
- http://www.zu##c.com/data/attachment/block/5c/5c40d5fcd846d6b6217860a6fa9afea8.jpg
- http://www.zu##c.com/data/attachment/block/57/574a1d93c7d9397275c165248d774176.jpg
- http://cr#.##gicert-cn.com/DigiCertGlobalRootCA.crl
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEAWVZ9XVvXmt3%2BlanInd0PE%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEA1FKMVdJ6wGke4ziXRF0c4%3D
- http://us##.zuimc.com/serverlist/old/1
- http://us##.zuimc.com/login
- http://us##.zuimc.com/Public/addition/all.css
- http://cr#.#igicert.cn/DigiCertSecureSiteCNCAG3.crl
- DNS ASK la####er.zuimc.com
- DNS ASK o.##2.us
- DNS ASK li##.zuimc.com
- DNS ASK ap##.bdimg.com
- DNS ASK microsoft.com
- DNS ASK cr#.#igicert.cn
- DNS ASK cr#.##gicert-cn.com
- DNS ASK x.##2.us
- DNS ASK oc##.#igicert.cn
- DNS ASK oc##.dcocsp.cn
- DNS ASK wp#.qq.com
- DNS ASK pu#.#dqqimg.com
- DNS ASK s1#.#nzz.com
- DNS ASK zu##c.com
- DNS ASK us##.zuimc.com
- DNS ASK la#####rmeta.mojang.com
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK oc##.####ca1.amazontrust.com
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' -jar "%APPDATA%\craftbox\temp\{C7C55375-C4E6-4349-82E9-EB7931C45F17}.jar"' (with hidden window)
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' -jar "%APPDATA%\craftbox\temp\{C7C55375-C4E6-4349-82E9-EB7931C45F17}.jar"