Trojan.DownLoader34.47370

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Classes\screen-recorder-launcher\shell\open\command] '' = '"%LOCALAPPDATA%\WebLaunchRecorder\Screen Recorder Launcher.exe" "%1"'
[<HKCU>\Software\Classes\somrec\shell\open\command] '' = '"%LOCALAPPDATA%\WebLaunchRecorder\Screen Recorder Launcher.exe" "%1"'
[<HKCU>\Software\Classes\somopen\shell\open\command] '' = '"%LOCALAPPDATA%\WebLaunchRecorder\Screen Recorder Launcher.exe" "%1"'

Modifies file system

Creates the following files

%WINDIR%\temp\cab5d.tmp
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\novosibirsk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\omsk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\oral
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\phnom_penh
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\pontianak
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\pyongyang
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\qyzylorda
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\samarkand
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\rangoon
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\riyadh
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\riyadh87
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\riyadh88
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\riyadh89
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\sakhalin
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\novokuznetsk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\qatar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\nicosia
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\kolkata
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\kabul
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\kamchatka
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\karachi
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\kashgar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\kathmandu
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\khandyga
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\krasnoyarsk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\manila
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\kuala_lumpur
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\kuching
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\kuwait
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\macau
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\magadan
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\makassar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\muscat
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\seoul
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\shanghai
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\singapore
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\reykjavik
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\south_georgia
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\st_helena
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\stanley
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\adelaide
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\faroe
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\madeira
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\brisbane
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\darwin
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\eucla
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\hobart
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\lindeman
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\lord_howe
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\broken_hill
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\currie
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\cape_verde
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\canary
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\bermuda
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\tashkent
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\tbilisi
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\tehran
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\thimphu
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\tokyo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\ulaanbaatar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\taipei
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\urumqi
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\vientiane
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\vladivostok
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\yakutsk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\yekaterinburg
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\yerevan
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\atlantic\azores
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\ust-nera
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\jerusalem
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\melbourne
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\jayapura
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\irkutsk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\ushuaia
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\indiana\indianapolis
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\indiana\knox
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\indiana\marengo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\indiana\petersburg
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\indiana\tell_city
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\indiana\vincennes
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\antarctica\casey
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\indiana\winamac
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\kentucky\louisville
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\kentucky\monticello
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\north_dakota\beulah
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\north_dakota\center
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\north_dakota\new_salem
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\tucuman
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\indiana\vevay
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\san_luis
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\yellowknife
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\tijuana
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\toronto
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\vancouver
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\whitehorse
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\winnipeg
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\yakutat
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\buenos_aires
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\salta
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\catamarca
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\cordoba
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\jujuy
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\la_rioja
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\mendoza
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\rio_gallegos
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\argentina\san_juan
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\antarctica\davis
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\antarctica\dumontdurville
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\antarctica\macquarie
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\chongqing
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\colombo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\damascus
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\dhaka
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\dili
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\brunei
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\choibalsan
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\dubai
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\harbin
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\hebron
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\ho_chi_minh
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\hong_kong
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\hovd
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\dushanbe
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\gaza
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\bishkek
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\beirut
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\bangkok
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\antarctica\palmer
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\antarctica\rothera
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\antarctica\syowa
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\antarctica\vostok
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\aden
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\almaty
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\antarctica\mawson
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\amman
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\aqtau
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\aqtobe
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\ashgabat
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\baghdad
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\bahrain
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\baku
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\anadyr
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\asia\jakarta
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\antananarivo
%LOCALAPPDATA%\weblaunchrecorder\uninstall.exe
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\galapagos
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\gambier
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\guadalcanal
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\guam
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\honolulu
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\kiritimati
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\kwajalein
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\noumea
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\majuro
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\marquesas
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\midway
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\nauru
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\niue
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\norfolk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\funafuti
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\kosrae
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\fiji
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\mayotte
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\cocos
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\comoro
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\kerguelen
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\mahe
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\maldives
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\mauritius
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\reunion
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\enderbury
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\apia
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\auckland
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\chatham
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\chuuk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\easter
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\efate
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\fakaofo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\pago_pago
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\palau
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\pitcairn
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\yst9
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\yst9ydt
%LOCALAPPDATA%\weblaunchrecorder\msvcr100.dll
%LOCALAPPDATA%\weblaunchrecorder\app.properties
%LOCALAPPDATA%\weblaunchrecorder\frame_icon_launcher.png
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\pst8
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\pst8pdt
%LOCALAPPDATA%\weblaunchrecorder\frame_icon_screenrecorder.png
%LOCALAPPDATA%\weblaunchrecorder\som.ico
%LOCALAPPDATA%\weblaunchrecorder\somrec.ico
%LOCALAPPDATA%\weblaunchrecorder\somopen.ico
%LOCALAPPDATA%\weblaunchrecorder\appmain-2.10.jar
%LOCALAPPDATA%\weblaunchrecorder\screen recorder launcher.exe
%LOCALAPPDATA%\weblaunchrecorder\proxy-selector.jar
%LOCALAPPDATA%\weblaunchrecorder\screen_recorder_launcher.ico
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\mst7mdt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\mst7
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\hst10
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\port_moresby
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\rarotonga
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\saipan
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\tahiti
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\tarawa
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\tongatapu
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\pohnpei
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\wake
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\ast4
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\ast4adt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\cst6
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\cst6cdt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\est5
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\systemv\est5edt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pacific\wallis
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\christmas
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\thunder_bay
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\indian\chagos
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\zurich
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-2
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-3
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-4
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-5
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-6
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-7
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-9
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\berlin
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\uct
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\utc
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\amsterdam
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\andorra
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\athens
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\belgrade
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-14
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-8
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-13
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+4
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+1
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+10
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+11
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+12
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+2
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+3
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+5
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-11
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+6
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+7
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+8
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt+9
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-1
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-10
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\etc\gmt-12
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\brussels
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\bucharest
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\budapest
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\rome
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\samara
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\simferopol
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\sofia
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\stockholm
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\prague
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\riga
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\tallinn
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\vienna
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\vilnius
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\volgograd
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\warsaw
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\zaporozhye
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\tirane
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\uzhgorod
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\paris
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\oslo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\moscow
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\copenhagen
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\dublin
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\gibraltar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\helsinki
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\istanbul
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\kaliningrad
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\chisinau
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\kiev
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\london
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\luxembourg
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\madrid
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\malta
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\minsk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\monaco
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\europe\lisbon
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\perth
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\australia\sydney
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\thule
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\algiers
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\cmm\srgb.pf
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\access-bridge-32.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\dnsns.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\jaccess.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\localedata.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\meta-index
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\sunjce_provider.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\images\cursors\cursors.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\sunmscapi.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\sunpkcs11.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\zipfs.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\fonts\lucidasansregular.ttf
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\i386\jvm.cfg
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\images\cursors\thumbs.db
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\cmm\linear_rgb.pf
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\ext\sunec.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\cmm\gray.pf
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\management-agent.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\javafx.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\jce.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\jfr.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\jsse.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\jvm.hprof.txt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\logging.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\meta-index
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\tzmappings
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\net.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\psfont.properties.ja
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\psfontj2d.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\resources.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\rt.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\sound.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\cmm\ciexyz.pf
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\images\cursors\invalid32x32.gif
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\images\cursors\win32_copydrop32x32.gif
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\images\cursors\win32_copynodrop32x32.gif
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\cst6cdt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\eet
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\est
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\est5edt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\gmt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\security\local_policy.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\cet
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\hst
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\mst7mdt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\pst8pdt
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\wet
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\zoneinfomappings
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\abidjan
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\met
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\mst
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\security\javaws.policy
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\security\javafx.policy
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\security\java.security.bak
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\images\cursors\win32_linknodrop32x32.gif
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\images\cursors\win32_movedrop32x32.gif
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\images\cursors\win32_movenodrop32x32.gif
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\jfr\default.jfc
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\jfr\profile.jfc
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\management\jmxremote.access
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\images\cursors\win32_linkdrop32x32.gif
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\management\jmxremote.password.template
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\management\snmp.acl.template
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\security\us_export_policy.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\security\blacklist
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\security\cacerts
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\security\java.policy
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\security\java.security
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\management\management.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\fontconfig.properties.src
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\accra
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\fontconfig.bfc
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\currency.data
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\glass.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\glib-lite.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\gstreamer-lite.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\hprof.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\installer.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\instrument.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\j2pkcs11.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jdwp.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jaas_nt.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\java.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\java_crw_demo.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\javafx-font.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\javafx-iio.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jawt.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\fxplugins.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\j2pcsc.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\fontmanager.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\thirdpartylicensereadme.txt
%WINDIR%\temp\tar5e.tmp
%TEMP%\som9202.tmp.exe
%TEMP%\nsr2d96.tmp
%LOCALAPPDATA%\weblaunchrecorder\jre\copyright
%LOCALAPPDATA%\weblaunchrecorder\jre\license
%LOCALAPPDATA%\weblaunchrecorder\jre\thirdpartylicensereadme-javafx.txt
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jawtaccessbridge-32.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\dt_shmem.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\javaaccessbridge-32.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jdbcodbc.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\windowsaccessbridge-32.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\awt.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\dcpr.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\decora-sse.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\dt_socket.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jfr.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jfxmedia.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jli.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\sunmscapi.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\t2k.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\unpack.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\verify.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\w2k_lsa_auth.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\ssv.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\sunec.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\zip.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\alt-rt.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\calendars.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\charsets.jar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\classlist
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\content-types.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\client\jvm.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\accessibility.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\splashscreen.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\prism-d3d.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\npt.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jp2native.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jp2ssv.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jpeg.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jsdt.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jsound.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jsoundds.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\jp2iexp.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\kcms.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\libxslt.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\management.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\mlib_image.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\msvcr100.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\net.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\nio.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\bin\libxml2.dll
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\flavormap.properties
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\creston
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\swift_current
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\asmara
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\hermosillo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\inuvik
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\iqaluit
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\jamaica
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\juneau
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\la_paz
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\los_angeles
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\menominee
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\maceio
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\managua
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\manaus
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\martinique
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\matamoros
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\mazatlan
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\havana
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\lima
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\halifax
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\eirunepe
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\danmarkshavn
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\dawson
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\dawson_creek
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\denver
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\detroit
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\edmonton
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\el_salvador
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\guayaquil
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\fortaleza
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\glace_bay
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\godthab
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\goose_bay
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\grand_turk
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\guatemala
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\guyana
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\merida
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\metlakatla
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\mexico_city
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\rankin_inlet
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\recife
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\regina
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\resolute
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\rio_branco
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\puerto_rico
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\rainy_river
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\santa_isabel
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\santo_domingo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\sao_paulo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\scoresbysund
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\sitka
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\st_johns
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\santarem
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\santiago
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\porto_velho
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\port_of_spain
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\port-au-prince
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\moncton
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\monterrey
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\montevideo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\montreal
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\nassau
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\new_york
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\miquelon
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\nipigon
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\noronha
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\ojinaga
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\panama
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\pangnirtung
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\paramaribo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\phoenix
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\nome
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\curacao
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\tegucigalpa
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\cuiaba
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\costa_rica
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\harare
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\johannesburg
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\kampala
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\khartoum
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\kigali
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\kinshasa
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\libreville
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\maseru
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\lome
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\luanda
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\lubumbashi
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\lusaka
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\malabo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\maputo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\gaborone
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\lagos
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\freetown
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\bujumbura
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\bamako
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\bangui
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\banjul
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\bissau
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\blantyre
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\brazzaville
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\cairo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\douala
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\casablanca
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\ceuta
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\conakry
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\dakar
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\dar_es_salaam
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\djibouti
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\el_aaiun
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\mbabane
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\mogadishu
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\monrovia
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\belize
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\blanc-sablon
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\boa_vista
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\bogota
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\boise
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\barbados
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\belem
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\cambridge_bay
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\caracas
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\cayenne
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\cayman
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\chicago
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\chihuahua
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\campo_grande
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\cancun
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\bahia_banderas
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\bahia
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\atikokan
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\ndjamena
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\niamey
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\nouakchott
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\ouagadougou
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\porto-novo
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\sao_tome
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\nairobi
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\tripoli
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\windhoek
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\adak
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\anchorage
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\antigua
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\araguaina
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\america\asuncion
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\tunis
%LOCALAPPDATA%\weblaunchrecorder\jre\lib\zi\africa\addis_ababa
%TEMP%\hsperfdata_user\1248

Deletes the following files

%WINDIR%\temp\cab5d.tmp
%WINDIR%\temp\tar5e.tmp
%TEMP%\som9202.tmp.exe

Network activity

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://sc#####ast-o-matic.com/checkproxy

'sc#####ast-o-matic.com':443

'fi####.##reencast-o-matic.com':443

UDP

DNS ASK sc#####ast-o-matic.com
DNS ASK microsoft.com
DNS ASK fi####.##reencast-o-matic.com

Miscellaneous

Creates and executes the following

'%TEMP%\som9202.tmp.exe'
'%LOCALAPPDATA%\weblaunchrecorder\screen recorder launcher.exe' "screen-recorder-launcher://s/screencast-o-matic.com/launcher/args?id=88052b65-be19-421a-ba5d-f628b62f2559&al=true&exetime=1600209012"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial