Overview

overview

8

Static

static

TLauncher-....1.exe

windows7-x64

8

TLauncher-....1.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2022, 23:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.86-Installer-1.0.1.exe

  • Size

    21.7MB

  • MD5

    f643be370cc9763a17f7746b1b6a0243

  • SHA1

    c65391f59a6e1421d783eaf43eb9661cfd476f82

  • SHA256

    5ab5f39d143b6ff77df2fd5026ac8e4788edfd3de27a4e1fa4b420a7d2f61d38

  • SHA512

    5ce377dc1a4a59723cf2b969c0cadb3197e5bf61d0064e2e8c94a0be9d4fd1cd9b33e05078a17e89f54b763e180be32ce14b46949a58ff47e5df18183291142f

  • SSDEEP

    393216:WXYwVCtYto0fs/dQETVlOBbpFEj9GZdqV56HpkbGCST7yuk9sLx:WowVCWTHExiTTqqHpMsV

Score
8/10
discoveryupx

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 26 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 23 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1908426 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe" "__IRCT:3" "__IRTSS:22693301" "__IRSID:S-1-5-21-1214520366-621468234-4062160515-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:316
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1814730 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1839152" "__IRSID:S-1-5-21-1214520366-621468234-4062160515-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:1628
      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
        "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1988
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Program Files\Java\jre1.8.0_51\installer.exe
      "C:\Program Files\Java\jre1.8.0_51\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_51\\" STATIC=1 REPAIRMODE=0
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
        "bspatch.exe" baseimagefam8 newimage diff
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:684

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Java\jre1.8.0_51\installer.exe
          Filesize

          89.1MB

          MD5

          de052a3a782280dfe0d333bfb894c7d3

          SHA1

          c6a2c5150e1a6f7d5fccf5927aef1c5b2a94ea74

          SHA256

          cacefac05b6719d7ec1bd4945de0e58e9233e54d2ba94d68103bcd2bb04cdde3

          SHA512

          dfd8bfea673f0c1a37199cd76ceb9f7731eb3c502f02b8e81fd72dc6f4d9cec866fb3133b45ff93127a459be75580d1488609ecf2ab337a685a91fe609245935

          Download Submit

        • C:\ProgramData\Oracle\Java\installcache_x64\baseimagefam8
          Filesize

          78.7MB

          MD5

          22646919b87d1a6dfc371464405b373b

          SHA1

          2296c69b12c3e0244fc59586f794457a4735e692

          SHA256

          0a01e1f33b0dd6af5d71fd26261b97eda1f9da77553704afd0a9d176de733c11

          SHA512

          b5cfe6640c3755f3094e248dcd852ade852f904e80bc7d8dfef5772620ef75eac788f503c3df4baa712e73dafcca51c4ef0c73659ae55c1e0afd59b73f90d3a0

          Download Submit

        • C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
          Filesize

          34KB

          MD5

          2e7543a4deec9620c101771ca9b45d85

          SHA1

          fa33f3098c511a1192111f0b29a09064a7568029

          SHA256

          32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

          SHA512

          8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

          Download Submit

        • C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
          Filesize

          34KB

          MD5

          2e7543a4deec9620c101771ca9b45d85

          SHA1

          fa33f3098c511a1192111f0b29a09064a7568029

          SHA256

          32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

          SHA512

          8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

          Download Submit

        • C:\ProgramData\Oracle\Java\installcache_x64\diff
          Filesize

          9.1MB

          MD5

          d417682702b140d7131851bae877f046

          SHA1

          aa78da727e8a62c839a9bb6f7a93b48d3a04be70

          SHA256

          3b3657c83e4f588f0e759cd46e99309cece2ebb54af2c377f9dc087ec764fda8

          SHA512

          9e107b7f61e42410807aa1e6761ac7adce412846f69ae8e2e21b147e39d1a95d41367e21624381750eb11c77322206c4d869a477e5442e8323405c85854c03cd

          Download Submit

        • C:\ProgramData\Oracle\Java\installcache_x64\newimage
          Filesize

          58.4MB

          MD5

          8e53952728b57b4b7534e9f3fdc3aa1c

          SHA1

          a32ec42fedcecf2c6a282fbc217711d8a1ad6586

          SHA256

          3c114eb55b5a9a06d1f3737ae1409e26231ac5da175a2266fa7b0d44394a81f1

          SHA512

          d4ba488d39575eee76a090ba5310257b8f70327eb461f0bae51aabc8613e98763983e95f3117b32b53a0a5ecf1d4345ef2c616cc78997a585b6693bb7eab7e37

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          Filesize

          61KB

          MD5

          fc4666cbca561e864e7fdf883a9e6661

          SHA1

          2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

          SHA256

          10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

          SHA512

          c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          6bbf636a696d48d5853295f50f7bd02e

          SHA1

          d8f8605f354a603f8aa29f3e95b54039a4bbe3ba

          SHA256

          38cf05b0072df44c4e34f8b41f3e3d1cdcec240eedf23d6020826e6754e258e8

          SHA512

          585f33a705fe5e4aa7343f3a532337ccd07fdeb03e250a205cdc352cf4da494a19e959808e4edc28afdcbe2eb39c7c4d80f4ad4d51d7985b063d5225d5984868

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          7f1716dde92f80aa36231683bc030d75

          SHA1

          eed3f9a49b5d9fe8d1a86dd7bd1be6b208e175d3

          SHA256

          3ddb874c17a97fbb3adaf9ba6c3e6763d12ecba19be5a4b9c0a9c882bfe835f9

          SHA512

          1b3010fbbb5c3114901d4f14683ad1734215ccbfd681fb20e87a830e1f2158dceb6746f7efb0391d06b98e0de9847a0b1571602ff10a2d740fbc68ca97a808bb

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          07998d827adda5f9a01ff55f9b04d267

          SHA1

          1c73a356b55df818dc139d92043b3ab3a0fdf276

          SHA256

          00e8e385deb857fa7ce22e3a53c0f0d961261446bce2d3963fa40d27677a1970

          SHA512

          1deb5ac26523dc0ea088aea28d8f33872cee0fc5e424bda2f215ff793698416e3a8329d7e29ce9883d252a2c873e2992718eadf6d2853483ec456f818a132fc5

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          55339bbac8bf6988e088541fa3db8435

          SHA1

          ca491eed6624a19b2c128f3050ed99a76a859a0d

          SHA256

          6257620aa5f5caa830b0951e3c16c8b359bce0bf46cb56ed4ba2ac526104d89c

          SHA512

          621a5082b70af02791e422f28518cc84a0868648c14561eeb9f7b50e25654b4f2f25f78c0c3db914d63ca0c0a08139db34e470408fd8f27ada03388b9f2d51ff

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.8.0_51_x64\jre1.8.0_51.msi
          Filesize

          38.7MB

          MD5

          1ef598379ff589e452e9fc7f93563740

          SHA1

          82ad65425fa627176592ed5e55c0093e685bfeef

          SHA256

          d4bdc230eaebefe5a9aa3d9127d12ac09d050bf51771f0c78a6a9d79a1f9dbf2

          SHA512

          673f4b08fc25e09e582f5f7e01b2369e361f6a5b480f0aa2f1d5991f10076ba8a9d6b1f2227979b514acc458b4fdc254fc3c14173db7e38b50793174d4697f23

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          f8996d2158a69a12b4bc99edd28100bc

          SHA1

          892887691df881fe432e09b618e90f50447340e6

          SHA256

          866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

          SHA512

          d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          f8996d2158a69a12b4bc99edd28100bc

          SHA1

          892887691df881fe432e09b618e90f50447340e6

          SHA256

          866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

          SHA512

          d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          1313bb5df6c6e0d5c358735044fbebef

          SHA1

          cac3e2e3ed63dc147318e18f202a9da849830a91

          SHA256

          7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

          SHA512

          596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          1313bb5df6c6e0d5c358735044fbebef

          SHA1

          cac3e2e3ed63dc147318e18f202a9da849830a91

          SHA256

          7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

          SHA512

          596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e7bbc7b426cee4b8027a00b11f06ef34

          SHA1

          926fad387ede328d3cfd9da80d0b303a865cca98

          SHA256

          e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

          SHA512

          f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e7bbc7b426cee4b8027a00b11f06ef34

          SHA1

          926fad387ede328d3cfd9da80d0b303a865cca98

          SHA256

          e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

          SHA512

          f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
          Filesize

          41.2MB

          MD5

          b9919195f61824f980f4a088d7447a11

          SHA1

          447fd1f59219282ec5d2f7a179ac12cc072171c3

          SHA256

          3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01

          SHA512

          d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\jusched.log
          Filesize

          23KB

          MD5

          2f4b6ac527837d06454482d775f3d953

          SHA1

          bf86e865ee773992de4689a399cf76a4754c41e7

          SHA256

          d2a0393732c89c45f25ea6034d5f3632023b5b4a29f3e1d8732de073b8c9581f

          SHA512

          f889fd3e1b57e07a230fdbdb6f1f891f4a460befc5901c553dac4ff44d5b9eda814345c772c4d7fee8c6d1b161d97d4fccbdc0b0db167987381dafc2bcdbc9eb

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
          Filesize

          602B

          MD5

          5dfa24b76e86169d94a85fc0d7da5d72

          SHA1

          6c66b5244dfa99cb9ddb7376252ad57c87c00394

          SHA256

          a411e18fcd73e5a79b73d81289a55f90674f92e582b5d34ed79b45bb0054edce

          SHA512

          6b4ea698dc0beaf42fe6d1ab3324d933cb931e837f52aa6142d16f6bd8dfb7a5ef3ce1f70d0004670374c3d4f457046bc0f9fef567083acf936476a5093c7d0d

          Download Submit

        • \Program Files\Java\jre1.8.0_51\installer.exe
          Filesize

          89.1MB

          MD5

          de052a3a782280dfe0d333bfb894c7d3

          SHA1

          c6a2c5150e1a6f7d5fccf5927aef1c5b2a94ea74

          SHA256

          cacefac05b6719d7ec1bd4945de0e58e9233e54d2ba94d68103bcd2bb04cdde3

          SHA512

          dfd8bfea673f0c1a37199cd76ceb9f7731eb3c502f02b8e81fd72dc6f4d9cec866fb3133b45ff93127a459be75580d1488609ecf2ab337a685a91fe609245935

          Download Submit

        • \ProgramData\Oracle\Java\installcache_x64\bspatch.exe
          Filesize

          34KB

          MD5

          2e7543a4deec9620c101771ca9b45d85

          SHA1

          fa33f3098c511a1192111f0b29a09064a7568029

          SHA256

          32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

          SHA512

          8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

          Download Submit

        • \ProgramData\Oracle\Java\installcache_x64\bspatch.exe
          Filesize

          34KB

          MD5

          2e7543a4deec9620c101771ca9b45d85

          SHA1

          fa33f3098c511a1192111f0b29a09064a7568029

          SHA256

          32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

          SHA512

          8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

          Download Submit

        • \ProgramData\Oracle\Java\installcache_x64\bspatch.exe
          Filesize

          34KB

          MD5

          2e7543a4deec9620c101771ca9b45d85

          SHA1

          fa33f3098c511a1192111f0b29a09064a7568029

          SHA256

          32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

          SHA512

          8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          f8996d2158a69a12b4bc99edd28100bc

          SHA1

          892887691df881fe432e09b618e90f50447340e6

          SHA256

          866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

          SHA512

          d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          f8996d2158a69a12b4bc99edd28100bc

          SHA1

          892887691df881fe432e09b618e90f50447340e6

          SHA256

          866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

          SHA512

          d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          f8996d2158a69a12b4bc99edd28100bc

          SHA1

          892887691df881fe432e09b618e90f50447340e6

          SHA256

          866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

          SHA512

          d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          f8996d2158a69a12b4bc99edd28100bc

          SHA1

          892887691df881fe432e09b618e90f50447340e6

          SHA256

          866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

          SHA512

          d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          f8996d2158a69a12b4bc99edd28100bc

          SHA1

          892887691df881fe432e09b618e90f50447340e6

          SHA256

          866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

          SHA512

          d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
          Filesize

          1.8MB

          MD5

          f8996d2158a69a12b4bc99edd28100bc

          SHA1

          892887691df881fe432e09b618e90f50447340e6

          SHA256

          866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

          SHA512

          d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
          Filesize

          1.7MB

          MD5

          1bbf5dd0b6ca80e4c7c77495c3f33083

          SHA1

          e0520037e60eb641ec04d1e814394c9da0a6a862

          SHA256

          bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

          SHA512

          97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
          Filesize

          97KB

          MD5

          da1d0cd400e0b6ad6415fd4d90f69666

          SHA1

          de9083d2902906cacf57259cf581b1466400b799

          SHA256

          7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

          SHA512

          f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          1313bb5df6c6e0d5c358735044fbebef

          SHA1

          cac3e2e3ed63dc147318e18f202a9da849830a91

          SHA256

          7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

          SHA512

          596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          1313bb5df6c6e0d5c358735044fbebef

          SHA1

          cac3e2e3ed63dc147318e18f202a9da849830a91

          SHA256

          7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

          SHA512

          596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          1313bb5df6c6e0d5c358735044fbebef

          SHA1

          cac3e2e3ed63dc147318e18f202a9da849830a91

          SHA256

          7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

          SHA512

          596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          1313bb5df6c6e0d5c358735044fbebef

          SHA1

          cac3e2e3ed63dc147318e18f202a9da849830a91

          SHA256

          7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

          SHA512

          596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          Filesize

          1.3MB

          MD5

          1313bb5df6c6e0d5c358735044fbebef

          SHA1

          cac3e2e3ed63dc147318e18f202a9da849830a91

          SHA256

          7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

          SHA512

          596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e7bbc7b426cee4b8027a00b11f06ef34

          SHA1

          926fad387ede328d3cfd9da80d0b303a865cca98

          SHA256

          e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

          SHA512

          f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e7bbc7b426cee4b8027a00b11f06ef34

          SHA1

          926fad387ede328d3cfd9da80d0b303a865cca98

          SHA256

          e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

          SHA512

          f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e7bbc7b426cee4b8027a00b11f06ef34

          SHA1

          926fad387ede328d3cfd9da80d0b303a865cca98

          SHA256

          e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

          SHA512

          f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          Filesize

          1.3MB

          MD5

          e7bbc7b426cee4b8027a00b11f06ef34

          SHA1

          926fad387ede328d3cfd9da80d0b303a865cca98

          SHA256

          e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

          SHA512

          f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
          Filesize

          326KB

          MD5

          80d93d38badecdd2b134fe4699721223

          SHA1

          e829e58091bae93bc64e0c6f9f0bac999cfda23d

          SHA256

          c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

          SHA512

          9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

          Download Submit

        • \Users\Admin\AppData\Local\Temp\jre-windows.exe
          Filesize

          41.2MB

          MD5

          b9919195f61824f980f4a088d7447a11

          SHA1

          447fd1f59219282ec5d2f7a179ac12cc072171c3

          SHA256

          3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01

          SHA512

          d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

          Download Submit

        • \Users\Admin\AppData\Local\Temp\jre-windows.exe
          Filesize

          41.2MB

          MD5

          b9919195f61824f980f4a088d7447a11

          SHA1

          447fd1f59219282ec5d2f7a179ac12cc072171c3

          SHA256

          3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01

          SHA512

          d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

          Download Submit

        • \Users\Admin\AppData\Local\Temp\jre-windows.exe
          Filesize

          41.2MB

          MD5

          b9919195f61824f980f4a088d7447a11

          SHA1

          447fd1f59219282ec5d2f7a179ac12cc072171c3

          SHA256

          3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01

          SHA512

          d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

          Download Submit

        • memory/316-103-0x0000000002C20000-0x0000000003008000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/316-102-0x0000000002C20000-0x0000000003008000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/316-99-0x0000000002C20000-0x0000000003008000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/316-98-0x0000000002C20000-0x0000000003008000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/684-132-0x0000000000230000-0x0000000000247000-memory.dmp

          Filesize

          92KB

          Download

        • memory/684-123-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/684-133-0x0000000000230000-0x0000000000247000-memory.dmp

          Filesize

          92KB

          Download

        • memory/684-134-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/952-70-0x0000000010000000-0x0000000010051000-memory.dmp

          Filesize

          324KB

          Download

        • memory/952-106-0x0000000002DF0000-0x0000000002E00000-memory.dmp

          Filesize

          64KB

          Download

        • memory/952-81-0x0000000002DF0000-0x0000000002E00000-memory.dmp

          Filesize

          64KB

          Download

        • memory/952-74-0x0000000000A90000-0x0000000000ABC000-memory.dmp

          Filesize

          176KB

          Download

        • memory/952-66-0x0000000000FB0000-0x0000000001398000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/952-73-0x0000000000FB0000-0x0000000001398000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/952-124-0x0000000010000000-0x0000000010051000-memory.dmp

          Filesize

          324KB

          Download

        • memory/952-71-0x0000000000A90000-0x0000000000ABC000-memory.dmp

          Filesize

          176KB

          Download

        • memory/1344-72-0x0000000002E00000-0x00000000031E8000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/1344-54-0x0000000076391000-0x0000000076393000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1344-65-0x0000000002E00000-0x00000000031E8000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/1344-64-0x0000000002E00000-0x00000000031E8000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/1628-104-0x0000000000140000-0x0000000000528000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/1988-110-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

          Filesize

          8KB

          Download