Overview

overview

8

Static

static

TLauncher-....1.exe

windows7-x64

8

TLauncher-....1.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2023 23:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-2.86-Installer-1.0.1.exe

  • Size

    21.7MB

  • MD5

    f643be370cc9763a17f7746b1b6a0243

  • SHA1

    c65391f59a6e1421d783eaf43eb9661cfd476f82

  • SHA256

    5ab5f39d143b6ff77df2fd5026ac8e4788edfd3de27a4e1fa4b420a7d2f61d38

  • SHA512

    5ce377dc1a4a59723cf2b969c0cadb3197e5bf61d0064e2e8c94a0be9d4fd1cd9b33e05078a17e89f54b763e180be32ce14b46949a58ff47e5df18183291142f

  • SSDEEP

    393216:WXYwVCtYto0fs/dQETVlOBbpFEj9GZdqV56HpkbGCST7yuk9sLx:WowVCWTHExiTTqqHpMsV

Score
8/10
discoveryupx

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 26 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 23 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1908426 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.86-Installer-1.0.1.exe" "__IRCT:3" "__IRTSS:22693301" "__IRSID:S-1-5-21-3406023954-474543476-3319432036-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1814730 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1839152" "__IRSID:S-1-5-21-3406023954-474543476-3319432036-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:904
      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
        "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        PID:948
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Program Files\Java\jre1.8.0_51\installer.exe
      "C:\Program Files\Java\jre1.8.0_51\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_51\\" STATIC=1 REPAIRMODE=0
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
        "bspatch.exe" baseimagefam8 newimage diff
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:916
      • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
        "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\deploy.pack" "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar"
        3⤵
          PID:1936

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
      Filesize

      192KB

      MD5

      5b071854133d3eb6848a301a2a75c9b2

      SHA1

      ffa1045c55b039760aa2632a227012bb359d764f

      SHA256

      cc8d67216b1e04d7a41bf62f9c1088cd65a3d21796c5a562851e841b3afa28cf

      SHA512

      f9858ec0a1bfb7540512ede3756653d094ff9fe258d13a8431599280db945e8d9ea94c57595c6a21aa4fbfcd733eea9b887bfcf87e84279a7e632db55380920c

      Download Submit

    • C:\Program Files\Java\jre1.8.0_51\installer.exe
      Filesize

      44.3MB

      MD5

      61121e040ba44d308133f642caa0f9d4

      SHA1

      46635fa4b8308784211ca0bfda6d38977eef924f

      SHA256

      2464d03b30ae67a87d4a1d68c605ce8adafc4d2eb501fdce90ac605c966f7791

      SHA512

      ed7937269738a1ca2c25650962e4be090d7374fc7023a3d532a018dafff289deac518f318170ac0af96e12f0aa32f72584c851574e8dfc6e200959cd2a07ab0e

      Download Submit

    • C:\ProgramData\Oracle\Java\installcache_x64\baseimagefam8
      Filesize

      35.2MB

      MD5

      4552c9d83b719d599cfb1d4cbe17c128

      SHA1

      79668a20a37b72e78d9b76ad83781d9887b6f1fb

      SHA256

      2e96f73092bbe89b36504fe994bfebba5bc976fcd6c51f72b4c7652eacf64672

      SHA512

      414d652dfa028c1c884be39942c9abfec6ff2812fca0cb31dd0f378a489d2df02c1c30554e52a60385403e9ceea17960d8631c21d762a416f056848734a520dd

      Download Submit

    • C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
      Filesize

      34KB

      MD5

      2e7543a4deec9620c101771ca9b45d85

      SHA1

      fa33f3098c511a1192111f0b29a09064a7568029

      SHA256

      32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

      SHA512

      8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

      Download Submit

    • C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
      Filesize

      34KB

      MD5

      2e7543a4deec9620c101771ca9b45d85

      SHA1

      fa33f3098c511a1192111f0b29a09064a7568029

      SHA256

      32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

      SHA512

      8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

      Download Submit

    • C:\ProgramData\Oracle\Java\installcache_x64\diff
      Filesize

      9.1MB

      MD5

      d417682702b140d7131851bae877f046

      SHA1

      aa78da727e8a62c839a9bb6f7a93b48d3a04be70

      SHA256

      3b3657c83e4f588f0e759cd46e99309cece2ebb54af2c377f9dc087ec764fda8

      SHA512

      9e107b7f61e42410807aa1e6761ac7adce412846f69ae8e2e21b147e39d1a95d41367e21624381750eb11c77322206c4d869a477e5442e8323405c85854c03cd

      Download Submit

    • C:\ProgramData\Oracle\Java\installcache_x64\newimage
      Filesize

      15.7MB

      MD5

      6974cab80b543c89ba692fd80505e389

      SHA1

      71d4d9ea7303769dd206cef41f1feb849e3c728d

      SHA256

      2b3b7e811b3a92950a61039fc0fab7be33b0fad9da6ddb0556f65d94a1f61191

      SHA512

      a0a2ce9f019f830fb5597efa3e97478905c3032bdb402f467850b0ea36370ac321c5eee872a08684fe23878e8e25a50d86f0e3a38e578bd08f4543d3c6ab5cab

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      61KB

      MD5

      fc4666cbca561e864e7fdf883a9e6661

      SHA1

      2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

      SHA256

      10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

      SHA512

      c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      df650d9fc55238656d2e735ace9be819

      SHA1

      2c945829256b865d6ccfd399dc7e79d1e9b5c6ed

      SHA256

      149422cd8a24150dfca69f930391bc802e5658ed6017d85c8e9bd16408995e6b

      SHA512

      f910ce4bb38fa516a31d3ae151a2bca7aecfa930de00f6a59dada600d24e53837ceec40563f09c8ee01a08bb6db82a7656f68c03d9558f4343887a28a1e9683f

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      ab9ac984053f8464ecc725ff7618ece2

      SHA1

      d203c2b590c95e24e3c62c2e35e00ac36389c2be

      SHA256

      5f373a741d3c27ef7d4bb613f73e65bebf46d2d1067eeb47a14009b4a89ef5c2

      SHA512

      2527d80432a28b8fd048a497645b1c43bc0a58aea7209373ac5fdb33e3ac0c62a58783dc054389678ff2a10b090cd7ed257aad15c9d79d7f0c8151d148438693

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      1b28fad6dca8702fef9307086319a652

      SHA1

      402dde15a0be7ba76585ecefc994a90cb6ad77c5

      SHA256

      37e8a8045715dbbdca8c79270ebfbf52b1a610f1b745e12de300cec83534500a

      SHA512

      a8a97f9e97cc2eb19548d40fd762549c0091ebb6ec2d3bf105870cb21fe908c00a17bb8932f52c29bea2ad2be605d80e17fdfebc79955e91371c1cd977be3bb8

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      7fc5ea3f67c9ade35e246e1fda0b5a78

      SHA1

      808c8b49197b37154a86f04c7a981fe008490a42

      SHA256

      d1a3a2bc3470aead64809315f23eef71106a3b26cef347340dd39f610cf6e78c

      SHA512

      fa5594a360582cea9dbcc6da0294eaededa1c8ade5bdb3958b4c192ff8bc938efda1333f788019a444495388a53ac7217516ab438da69d3e2b80044ed432acaf

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.8.0_51_x64\jre1.8.0_51.msi
      Filesize

      38.7MB

      MD5

      1ef598379ff589e452e9fc7f93563740

      SHA1

      82ad65425fa627176592ed5e55c0093e685bfeef

      SHA256

      d4bdc230eaebefe5a9aa3d9127d12ac09d050bf51771f0c78a6a9d79a1f9dbf2

      SHA512

      673f4b08fc25e09e582f5f7e01b2369e361f6a5b480f0aa2f1d5991f10076ba8a9d6b1f2227979b514acc458b4fdc254fc3c14173db7e38b50793174d4697f23

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.3MB

      MD5

      1313bb5df6c6e0d5c358735044fbebef

      SHA1

      cac3e2e3ed63dc147318e18f202a9da849830a91

      SHA256

      7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

      SHA512

      596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.3MB

      MD5

      1313bb5df6c6e0d5c358735044fbebef

      SHA1

      cac3e2e3ed63dc147318e18f202a9da849830a91

      SHA256

      7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

      SHA512

      596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      Filesize

      1.3MB

      MD5

      e7bbc7b426cee4b8027a00b11f06ef34

      SHA1

      926fad387ede328d3cfd9da80d0b303a865cca98

      SHA256

      e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

      SHA512

      f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      Filesize

      1.3MB

      MD5

      e7bbc7b426cee4b8027a00b11f06ef34

      SHA1

      926fad387ede328d3cfd9da80d0b303a865cca98

      SHA256

      e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

      SHA512

      f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
      Filesize

      41.2MB

      MD5

      b9919195f61824f980f4a088d7447a11

      SHA1

      447fd1f59219282ec5d2f7a179ac12cc072171c3

      SHA256

      3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01

      SHA512

      d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      17KB

      MD5

      76c2cfe898b2fca56550ff1d83dbb80b

      SHA1

      baeae651e4048f54a408fb61a9291d20b674a211

      SHA256

      5d9c7fd550bd10927490362d48414e0339cc3aa93545f0be2753be14f9b26512

      SHA512

      f464f34d2da412b6d1c2f4ffe6b3921ef209b6e2ffdd3464170697a51abcbd9222740ea51af685e939abe67520cfce3d530c6612469c0b855c65b4ceeb3ec01e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
      Filesize

      602B

      MD5

      5dfa24b76e86169d94a85fc0d7da5d72

      SHA1

      6c66b5244dfa99cb9ddb7376252ad57c87c00394

      SHA256

      a411e18fcd73e5a79b73d81289a55f90674f92e582b5d34ed79b45bb0054edce

      SHA512

      6b4ea698dc0beaf42fe6d1ab3324d933cb931e837f52aa6142d16f6bd8dfb7a5ef3ce1f70d0004670374c3d4f457046bc0f9fef567083acf936476a5093c7d0d

      Download Submit

    • \Program Files\Java\jre1.8.0_51\bin\unpack200.exe
      Filesize

      192KB

      MD5

      5b071854133d3eb6848a301a2a75c9b2

      SHA1

      ffa1045c55b039760aa2632a227012bb359d764f

      SHA256

      cc8d67216b1e04d7a41bf62f9c1088cd65a3d21796c5a562851e841b3afa28cf

      SHA512

      f9858ec0a1bfb7540512ede3756653d094ff9fe258d13a8431599280db945e8d9ea94c57595c6a21aa4fbfcd733eea9b887bfcf87e84279a7e632db55380920c

      Download Submit

    • \Program Files\Java\jre1.8.0_51\installer.exe
      Filesize

      45.2MB

      MD5

      ce6ec6aae2ab6a2ca27833e1b53754ef

      SHA1

      587af40cf8c8f6bff0fb0f815a70d8bc571b0661

      SHA256

      4a391ce31ea4f327d0dc49af814d2af8bf8360cbd7c0e54b4fa1c6fffaf6977b

      SHA512

      29b97a7b56eea642b8c997652a22243ea28d55493697a092f3d7fd5f4b2fd65437a22434f1be49c5a955537e8ca0838160943ea1abb3f255b646b3d74405f117

      Download Submit

    • \ProgramData\Oracle\Java\installcache_x64\bspatch.exe
      Filesize

      34KB

      MD5

      2e7543a4deec9620c101771ca9b45d85

      SHA1

      fa33f3098c511a1192111f0b29a09064a7568029

      SHA256

      32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

      SHA512

      8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

      Download Submit

    • \ProgramData\Oracle\Java\installcache_x64\bspatch.exe
      Filesize

      34KB

      MD5

      2e7543a4deec9620c101771ca9b45d85

      SHA1

      fa33f3098c511a1192111f0b29a09064a7568029

      SHA256

      32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

      SHA512

      8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

      Download Submit

    • \ProgramData\Oracle\Java\installcache_x64\bspatch.exe
      Filesize

      34KB

      MD5

      2e7543a4deec9620c101771ca9b45d85

      SHA1

      fa33f3098c511a1192111f0b29a09064a7568029

      SHA256

      32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1

      SHA512

      8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
      Filesize

      1.8MB

      MD5

      f8996d2158a69a12b4bc99edd28100bc

      SHA1

      892887691df881fe432e09b618e90f50447340e6

      SHA256

      866836c68a3c7b313fa6a0ab6d7b9d74112ca07e4709487951ff572938eff547

      SHA512

      d6856d91ded75901a4af914e66bcdd904a51a2aba24e4762a2986f9a5f4b42f5b758b91c37ee5c9783c5797f19026e7f31e73d0e063f71bf5df8355a3213dd44

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
      Filesize

      1.7MB

      MD5

      1bbf5dd0b6ca80e4c7c77495c3f33083

      SHA1

      e0520037e60eb641ec04d1e814394c9da0a6a862

      SHA256

      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

      SHA512

      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
      Filesize

      97KB

      MD5

      da1d0cd400e0b6ad6415fd4d90f69666

      SHA1

      de9083d2902906cacf57259cf581b1466400b799

      SHA256

      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

      SHA512

      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.3MB

      MD5

      1313bb5df6c6e0d5c358735044fbebef

      SHA1

      cac3e2e3ed63dc147318e18f202a9da849830a91

      SHA256

      7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

      SHA512

      596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.3MB

      MD5

      1313bb5df6c6e0d5c358735044fbebef

      SHA1

      cac3e2e3ed63dc147318e18f202a9da849830a91

      SHA256

      7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

      SHA512

      596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.3MB

      MD5

      1313bb5df6c6e0d5c358735044fbebef

      SHA1

      cac3e2e3ed63dc147318e18f202a9da849830a91

      SHA256

      7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

      SHA512

      596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.3MB

      MD5

      1313bb5df6c6e0d5c358735044fbebef

      SHA1

      cac3e2e3ed63dc147318e18f202a9da849830a91

      SHA256

      7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

      SHA512

      596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.3MB

      MD5

      1313bb5df6c6e0d5c358735044fbebef

      SHA1

      cac3e2e3ed63dc147318e18f202a9da849830a91

      SHA256

      7590d0f21687327812a6c61d0429c6df1345b97c53ad7115f03bd4cb2e4f4c8d

      SHA512

      596d877b3906f877f124d705933391478ed425ad860ca5341493f04050c4605fc8e9a1c890859105da1b6817da5e874e0afaabbc86a80597f296e642795fc33c

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      Filesize

      1.3MB

      MD5

      e7bbc7b426cee4b8027a00b11f06ef34

      SHA1

      926fad387ede328d3cfd9da80d0b303a865cca98

      SHA256

      e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

      SHA512

      f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      Filesize

      1.3MB

      MD5

      e7bbc7b426cee4b8027a00b11f06ef34

      SHA1

      926fad387ede328d3cfd9da80d0b303a865cca98

      SHA256

      e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

      SHA512

      f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      Filesize

      1.3MB

      MD5

      e7bbc7b426cee4b8027a00b11f06ef34

      SHA1

      926fad387ede328d3cfd9da80d0b303a865cca98

      SHA256

      e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

      SHA512

      f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      Filesize

      1.3MB

      MD5

      e7bbc7b426cee4b8027a00b11f06ef34

      SHA1

      926fad387ede328d3cfd9da80d0b303a865cca98

      SHA256

      e7a43c6f10e3e65b8462b6d67c91c628db5402d3209f549e90998c875cf21538

      SHA512

      f08b4833c1dcb9c2b0f8c90e092275795fda3c20aaec6590504c20a93cb6d50b8ce11301bc3a42d9417c78ddb25a5e991fad688c39d1dede3fce0b67f3e13e70

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      Download Submit

    • \Users\Admin\AppData\Local\Temp\jre-windows.exe
      Filesize

      41.2MB

      MD5

      b9919195f61824f980f4a088d7447a11

      SHA1

      447fd1f59219282ec5d2f7a179ac12cc072171c3

      SHA256

      3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01

      SHA512

      d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

      Download Submit

    • \Users\Admin\AppData\Local\Temp\jre-windows.exe
      Filesize

      41.2MB

      MD5

      b9919195f61824f980f4a088d7447a11

      SHA1

      447fd1f59219282ec5d2f7a179ac12cc072171c3

      SHA256

      3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01

      SHA512

      d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

      Download Submit

    • \Users\Admin\AppData\Local\Temp\jre-windows.exe
      Filesize

      41.2MB

      MD5

      b9919195f61824f980f4a088d7447a11

      SHA1

      447fd1f59219282ec5d2f7a179ac12cc072171c3

      SHA256

      3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01

      SHA512

      d9f4e268531bd48f6b6aa4325024921bca30ebfff3ae6af5c069146a3fc401c411bdeceb306ba01fbf3bcdc48e39a367e78a1f355dc3dd5f1df75a0d585a10c6

      Download Submit

    • memory/904-101-0x00000000009F0000-0x0000000000DD8000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/904-104-0x00000000009F0000-0x0000000000DD8000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/916-134-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

      Download

    • memory/916-133-0x0000000000230000-0x0000000000247000-memory.dmp

      Filesize

      92KB

      Download

    • memory/916-132-0x0000000000230000-0x0000000000247000-memory.dmp

      Filesize

      92KB

      Download

    • memory/916-131-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

      Download

    • memory/948-110-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1216-73-0x0000000000B40000-0x0000000000F28000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1216-106-0x0000000003000000-0x0000000003010000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1216-82-0x0000000003000000-0x0000000003010000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1216-71-0x0000000000560000-0x0000000000563000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1216-66-0x0000000000B40000-0x0000000000F28000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1216-70-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

      Download

    • memory/1216-114-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

      Download

    • memory/1728-72-0x0000000002E40000-0x0000000003228000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1728-63-0x0000000002E40000-0x0000000003228000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1728-64-0x0000000002E40000-0x0000000003228000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1728-54-0x0000000075881000-0x0000000075883000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1764-98-0x0000000002D90000-0x0000000003178000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1764-99-0x0000000002D90000-0x0000000003178000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1764-97-0x0000000002D90000-0x0000000003178000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1764-100-0x0000000002D90000-0x0000000003178000-memory.dmp

      Filesize

      3.9MB

      Download