Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2022, 19:35

General

  • Target

    TLauncher-2.86-Installer-1.0.1.exe

  • Size

    21.7MB

  • MD5

    f643be370cc9763a17f7746b1b6a0243

  • SHA1

    c65391f59a6e1421d783eaf43eb9661cfd476f82

  • SHA256

    5ab5f39d143b6ff77df2fd5026ac8e4788edfd3de27a4e1fa4b420a7d2f61d38

  • SHA512

    5ce377dc1a4a59723cf2b969c0cadb3197e5bf61d0064e2e8c94a0be9d4fd1cd9b33e05078a17e89f54b763e180be32ce14b46949a58ff47e5df18183291142f

  • SSDEEP

    393216:WXYwVCtYto0fs/dQETVlOBbpFEj9GZdqV56HpkbGCST7yuk9sLx:WowVCWTHExiTTqqHpMsV

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 21 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1908426 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe" "__IRCT:3" "__IRTSS:22693301" "__IRSID:S-1-5-21-3406023954-474543476-3319432036-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1292
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1814730 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1839152" "__IRSID:S-1-5-21-3406023954-474543476-3319432036-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:1868
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:280
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:872
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:872 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1336

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c3c055ef817b4012c2eb2f86ff6cc495

    SHA1

    3e77f8bbd4717ab9b246c60a2b57410919d6af36

    SHA256

    9df2f34b080e0b639d4bca05b4d298e44b4d8167d7f8981699f4551e4e75eb17

    SHA512

    cefdbc826ca8dcbaefcb9ae464db0e6dfe12291a8ff5015e61e1e0de88969d6e11ae31e5bf545d9f8c9b47d578cd139e3a69814152745e9a65740f039f325e9b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    807582ef0789b640f302b7e66c4faca1

    SHA1

    510205b4767b0c6099405228705ca743f5884c3a

    SHA256

    87622f1aa91e2e756b14b4b47db745a6466ae17215e28994c8d4d71e2e56f139

    SHA512

    e96a67fd8e4c95cd805c34f8c8ebaed9a537b947aef7c2ad9ec7e02c0a84300096c7378e02264ef7cc2125634b429dbcba62f038bad44037ebd3b3cad0a30adb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    be5ca50b93be924b2e326332aaa36326

    SHA1

    c499c6274242e18b9317b908649fe1ad616c23b5

    SHA256

    26ae46464eae2ae3998226d0b81f66dafdd526a200dff8588c117f453f8d4ad4

    SHA512

    6fcc25b47521b639a3985392f88be28fbd1b5e8d824985578352cf569a9173922befa056e80af2b1252cf4ce91d2152e35669cb3870ee3da85206f033164bba1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    44658814304a19abc7c3e002b120a534

    SHA1

    8570f4dac664674e04e37e31bb7afb270e9729ca

    SHA256

    d9dc0290fddb7008b9345b73242723fce42e13cd8d7e2c0dd09789627bf8dabf

    SHA512

    c7a1595394fba17d5510831e5555f9c6bafd5f85f290a201d955df1bab9b79b05d08439451c5026fca2367927dd84162efbf2c769b7fbdbb30ef925c43d5906f

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t9o3c8r\imagestore.dat

    Filesize

    28KB

    MD5

    31afe45e360c5e722ba8aa0c15ebc51d

    SHA1

    b4a9dd09b419d09216324c7a891de77f08e87264

    SHA256

    d1194f0a172bc7293a8b4b912b8d8db1c502ccc41d283bded0efa34e751bc854

    SHA512

    d3a45b84034cd7c21e44ac958dae28012eabc542eb043425d5c35a6fae585d8332bb8f806956841b81a632f8310c998ca582be2de9fa8653a56a3aab9cd64f85

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    f8996d2158a69a12b4bc99edd28100bc

    SHA1

    892887691df881fe432e09b618e90f50447340e6

    SHA256

    866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

    SHA512

    d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    f8996d2158a69a12b4bc99edd28100bc

    SHA1

    892887691df881fe432e09b618e90f50447340e6

    SHA256

    866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

    SHA512

    d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    1313bb5df6c6e0d5c358735044fbebef

    SHA1

    cac3e2e3ed63dc147318e18f202a9da849830a91

    SHA256

    7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

    SHA512

    596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    1313bb5df6c6e0d5c358735044fbebef

    SHA1

    cac3e2e3ed63dc147318e18f202a9da849830a91

    SHA256

    7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

    SHA512

    596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e7bbc7b426cee4b8027a00b11f06ef34

    SHA1

    926fad387ede328d3cfd9da80d0b303a865cca98

    SHA256

    e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

    SHA512

    f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e7bbc7b426cee4b8027a00b11f06ef34

    SHA1

    926fad387ede328d3cfd9da80d0b303a865cca98

    SHA256

    e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

    SHA512

    f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

    Filesize

    602B

    MD5

    24ef1db48cb47d37316b2356e7fb29ee

    SHA1

    cba7e54e51129cf77dcb072d970fb9f90a1a3b40

    SHA256

    de26b9757ec1e3e3fb987ff65b336c526c228e9bd912346f5da1d28019ced4b9

    SHA512

    2472cf9cf7e9034e729baf192c3ef44ffb05952cf6359aba13fdb7634ee420b5fc81cee6e33a0df8c04a67f3d98f19dc5abb5335015e0c4f5a0af3c58b495711

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    f8996d2158a69a12b4bc99edd28100bc

    SHA1

    892887691df881fe432e09b618e90f50447340e6

    SHA256

    866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

    SHA512

    d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    f8996d2158a69a12b4bc99edd28100bc

    SHA1

    892887691df881fe432e09b618e90f50447340e6

    SHA256

    866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

    SHA512

    d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    f8996d2158a69a12b4bc99edd28100bc

    SHA1

    892887691df881fe432e09b618e90f50447340e6

    SHA256

    866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

    SHA512

    d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    f8996d2158a69a12b4bc99edd28100bc

    SHA1

    892887691df881fe432e09b618e90f50447340e6

    SHA256

    866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

    SHA512

    d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    f8996d2158a69a12b4bc99edd28100bc

    SHA1

    892887691df881fe432e09b618e90f50447340e6

    SHA256

    866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

    SHA512

    d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    f8996d2158a69a12b4bc99edd28100bc

    SHA1

    892887691df881fe432e09b618e90f50447340e6

    SHA256

    866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

    SHA512

    d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

    Filesize

    1.7MB

    MD5

    1bbf5dd0b6ca80e4c7c77495c3f33083

    SHA1

    e0520037e60eb641ec04d1e814394c9da0a6a862

    SHA256

    bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

    SHA512

    97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

    Filesize

    97KB

    MD5

    da1d0cd400e0b6ad6415fd4d90f69666

    SHA1

    de9083d2902906cacf57259cf581b1466400b799

    SHA256

    7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

    SHA512

    f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    1313bb5df6c6e0d5c358735044fbebef

    SHA1

    cac3e2e3ed63dc147318e18f202a9da849830a91

    SHA256

    7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

    SHA512

    596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    1313bb5df6c6e0d5c358735044fbebef

    SHA1

    cac3e2e3ed63dc147318e18f202a9da849830a91

    SHA256

    7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

    SHA512

    596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    1313bb5df6c6e0d5c358735044fbebef

    SHA1

    cac3e2e3ed63dc147318e18f202a9da849830a91

    SHA256

    7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

    SHA512

    596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    1313bb5df6c6e0d5c358735044fbebef

    SHA1

    cac3e2e3ed63dc147318e18f202a9da849830a91

    SHA256

    7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

    SHA512

    596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    1313bb5df6c6e0d5c358735044fbebef

    SHA1

    cac3e2e3ed63dc147318e18f202a9da849830a91

    SHA256

    7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

    SHA512

    596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e7bbc7b426cee4b8027a00b11f06ef34

    SHA1

    926fad387ede328d3cfd9da80d0b303a865cca98

    SHA256

    e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

    SHA512

    f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e7bbc7b426cee4b8027a00b11f06ef34

    SHA1

    926fad387ede328d3cfd9da80d0b303a865cca98

    SHA256

    e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

    SHA512

    f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e7bbc7b426cee4b8027a00b11f06ef34

    SHA1

    926fad387ede328d3cfd9da80d0b303a865cca98

    SHA256

    e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

    SHA512

    f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e7bbc7b426cee4b8027a00b11f06ef34

    SHA1

    926fad387ede328d3cfd9da80d0b303a865cca98

    SHA256

    e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

    SHA512

    f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • \Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • \Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • memory/960-81-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

    Filesize

    64KB

  • memory/960-109-0x0000000001250000-0x0000000001638000-memory.dmp

    Filesize

    3.9MB

  • memory/960-67-0x0000000001250000-0x0000000001638000-memory.dmp

    Filesize

    3.9MB

  • memory/960-70-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/960-72-0x0000000001250000-0x0000000001638000-memory.dmp

    Filesize

    3.9MB

  • memory/960-71-0x0000000000320000-0x0000000000323000-memory.dmp

    Filesize

    12KB

  • memory/1292-98-0x0000000002CD0000-0x00000000030B8000-memory.dmp

    Filesize

    3.9MB

  • memory/1292-96-0x0000000002CD0000-0x00000000030B8000-memory.dmp

    Filesize

    3.9MB

  • memory/1292-97-0x0000000002CD0000-0x00000000030B8000-memory.dmp

    Filesize

    3.9MB

  • memory/1688-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

    Filesize

    8KB

  • memory/1688-63-0x0000000002E80000-0x0000000003268000-memory.dmp

    Filesize

    3.9MB

  • memory/1688-60-0x0000000002E80000-0x0000000003268000-memory.dmp

    Filesize

    3.9MB

  • memory/1868-102-0x0000000000AC0000-0x0000000000EA8000-memory.dmp

    Filesize

    3.9MB

  • memory/1868-99-0x0000000000AC0000-0x0000000000EA8000-memory.dmp

    Filesize

    3.9MB