Malware Analysis Report

2024-09-22 06:27

Sample ID 230322-ryphjshc94
Target TLauncher-2.876-Installer-1.0.7-global.exe
SHA256 78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655
Tags
bazarbackdoor backdoor discovery upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

78d84068b47cf28b76c88ba4474c7c187510f4e4e967d079d3761dcab7851655

Threat Level: Known bad

The file TLauncher-2.876-Installer-1.0.7-global.exe was found to be: Known bad.

Malicious Activity Summary

bazarbackdoor backdoor discovery upx

BazarBackdoor

Bazar/Team9 Backdoor payload

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

UPX packed file

Checks computer location settings

Checks installed software on the system

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Modifies system certificate store

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2023-03-22 14:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-22 14:36

Reported

2023-03-22 14:39

Platform

win7-20230220-en

Max time kernel

144s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"

Signatures

BazarBackdoor

backdoor bazarbackdoor

Bazar/Team9 Backdoor payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1700 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1700 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1700 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1700 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1700 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1700 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1700 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 292 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1780 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 1780 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 1780 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 1780 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 1780 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 1780 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 1780 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 292 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 292 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 292 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 292 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 580 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe C:\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe
PID 580 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe C:\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe
PID 580 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe C:\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe" "__IRCT:3" "__IRTSS:23645635" "__IRSID:S-1-5-21-1283023626-844874658-3193756055-1000"

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816338 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1840798" "__IRSID:S-1-5-21-1283023626-844874658-3193756055-1000"

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe

"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1

C:\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe

"C:\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe" "STATIC=1"

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl2.tlauncher.org udp
US 104.20.234.70:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 tlauncher.org udp
US 104.20.234.70:443 tlauncher.org tcp
US 8.8.8.8:53 javadl.oracle.com udp
NL 23.206.103.83:80 javadl.oracle.com tcp
NL 23.206.103.83:443 javadl.oracle.com tcp
US 8.8.8.8:53 sdlc-esd.oracle.com udp
NL 173.223.112.78:443 sdlc-esd.oracle.com tcp
US 8.8.8.8:53 javadl-esd-secure.oracle.com udp
NL 23.206.103.83:443 javadl-esd-secure.oracle.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 rps-svcs.oracle.com udp
NL 23.206.103.83:443 rps-svcs.oracle.com tcp

Files

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

memory/1700-60-0x0000000002E00000-0x00000000031E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

memory/1700-146-0x0000000002E00000-0x00000000031E8000-memory.dmp

memory/1700-231-0x0000000002E00000-0x00000000031E8000-memory.dmp

memory/292-330-0x0000000000020000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

memory/292-366-0x0000000010000000-0x0000000010051000-memory.dmp

memory/292-367-0x0000000000FF0000-0x0000000000FF3000-memory.dmp

memory/292-368-0x0000000000020000-0x0000000000408000-memory.dmp

memory/292-369-0x0000000010000000-0x0000000010051000-memory.dmp

memory/292-384-0x0000000000020000-0x0000000000408000-memory.dmp

memory/292-385-0x0000000000020000-0x0000000000408000-memory.dmp

memory/292-386-0x0000000010000000-0x0000000010051000-memory.dmp

memory/292-388-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

MD5 05d7bba3d6ac92766c4495b8928202a6
SHA1 50b65a8ba5ed2633e43929ee4bd58c95a91a3363
SHA256 4804f3c4fae714657fdb85e98244828acc6ac938505c2da1ed694ae7b58f2949
SHA512 1544d5cd6f85aaeeacd26f2deb9da9eb510226b41079ee78c4dede14386e5ea3446efdfd475bfbfa3a6846fa2ff23d64f4dad3a4ddd304e32de80e4d7bcbc600

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

MD5 5a7901f7df307fba45b1c377f2c94ccc
SHA1 d6630cf733033cdfbda7af3213d49b32f5b06919
SHA256 d8471d5a5b4792c4b49e80b5cb22ef1e938dc3069b210646704f658548d7a9f8
SHA512 fc0036a7ed4b53edd72b91c4824919e6e8a82b5be1e82cdc134e267ef4792424124fb6ba5d7c86cf686910da0baba8453d7a6c12b39a5b4c0cb70658580f3bc9

memory/292-408-0x0000000000020000-0x0000000000408000-memory.dmp

memory/292-411-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

MD5 52e46b1adf9cd40428b41755df527bd4
SHA1 5f0bb9c9c14208851beb5c93d9268c16ab39dc07
SHA256 a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13
SHA512 813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 52e46b1adf9cd40428b41755df527bd4
SHA1 5f0bb9c9c14208851beb5c93d9268c16ab39dc07
SHA256 a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13
SHA512 813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

memory/292-448-0x0000000000020000-0x0000000000408000-memory.dmp

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 52e46b1adf9cd40428b41755df527bd4
SHA1 5f0bb9c9c14208851beb5c93d9268c16ab39dc07
SHA256 a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13
SHA512 813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 52e46b1adf9cd40428b41755df527bd4
SHA1 5f0bb9c9c14208851beb5c93d9268c16ab39dc07
SHA256 a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13
SHA512 813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 52e46b1adf9cd40428b41755df527bd4
SHA1 5f0bb9c9c14208851beb5c93d9268c16ab39dc07
SHA256 a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13
SHA512 813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 52e46b1adf9cd40428b41755df527bd4
SHA1 5f0bb9c9c14208851beb5c93d9268c16ab39dc07
SHA256 a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13
SHA512 813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

memory/292-450-0x0000000010000000-0x0000000010051000-memory.dmp

memory/292-467-0x00000000034E0000-0x00000000034F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

MD5 bbdf2e8c0262e7e606d41ddbe5a3cd12
SHA1 acbb25f729af14b692ec9c8187a23b1a696f8e47
SHA256 d7c76896d206d977739556ad2d5811f7cf3117252afcd439a5aa0f2b645f6949
SHA512 0334fae3682889adbc18594b7917d8c93252a86bc04d08efc6860d5714ba4eb8aabc39c51e532c4aee57a938021540d2f2899781d9cd1de311036e1850a65067

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG

MD5 d8a095202e08fa1ac2578982e9a486db
SHA1 397ffc8af43ac18466b8df245b4faa6b278659e6
SHA256 28fed2b9a3cbde34da4b6b5d1af2d2844437d21f6dec85b3ca2faa5cd3b512e5
SHA512 ac751386a0004e335f4e5f4ea24bf6a474478c8a7ca54d018734e7cd44b8e9a0eb262b00fe1219b1c62c96b018b08ba6b1056d3a13e64b55c7e70d748a6ae9c6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 5027f3112ac2d6f764769102a9145c8e
SHA1 a369a0e1d4ace1a8d66908aa43543bea03c76f5b
SHA256 d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c
SHA512 181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 52e46b1adf9cd40428b41755df527bd4
SHA1 5f0bb9c9c14208851beb5c93d9268c16ab39dc07
SHA256 a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13
SHA512 813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 5027f3112ac2d6f764769102a9145c8e
SHA1 a369a0e1d4ace1a8d66908aa43543bea03c76f5b
SHA256 d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c
SHA512 181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 5027f3112ac2d6f764769102a9145c8e
SHA1 a369a0e1d4ace1a8d66908aa43543bea03c76f5b
SHA256 d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c
SHA512 181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 5027f3112ac2d6f764769102a9145c8e
SHA1 a369a0e1d4ace1a8d66908aa43543bea03c76f5b
SHA256 d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c
SHA512 181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 5027f3112ac2d6f764769102a9145c8e
SHA1 a369a0e1d4ace1a8d66908aa43543bea03c76f5b
SHA256 d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c
SHA512 181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 5027f3112ac2d6f764769102a9145c8e
SHA1 a369a0e1d4ace1a8d66908aa43543bea03c76f5b
SHA256 d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c
SHA512 181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 5027f3112ac2d6f764769102a9145c8e
SHA1 a369a0e1d4ace1a8d66908aa43543bea03c76f5b
SHA256 d61d2469b6058ac40def94cea42045a6f53e39694645add82949e0a011d5b36c
SHA512 181a00ac87820a08f73ffe7c3d26dfec56d3440a40d9ea67ab9b242b4653b712461a201118c9d0f747502a06e689d3badcc0986667814bb0a19c8f00d47d491f

C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

MD5 fb042a1c0c5a09fe374320b48118df3a
SHA1 da3055bd1a20f4329b4bd92a50075176ee759284
SHA256 d31689f7259a96b3e8cd2de8b8e04a430878d60a3a82ef684be4cb88a5cf89d6
SHA512 f337537586182db712cb437379e248de99da25a3fed9a873453c5fdc7743395b6f6e309be2081bac2bb3b608eb06631e4023ac31224a7d50a690e692e698179d

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

MD5 aec508468d53ab8d55f5b4beb82c347d
SHA1 477d1ffb28834243f5811a4a2a54b4f0ca240120
SHA256 ebee84e34e221ad822486432333bad9e6357af2fb0d9651cc61c7fab8ec9b5bf
SHA512 26a0278af2a9e75ef966bc3f7f40d7669204c2004a043adaad102ef440caa6282e69372ca0c3c7d39a8450691d528c2dc77a4386bfb0c6e5a2a76c3fef900fbe

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 52e46b1adf9cd40428b41755df527bd4
SHA1 5f0bb9c9c14208851beb5c93d9268c16ab39dc07
SHA256 a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13
SHA512 813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 52e46b1adf9cd40428b41755df527bd4
SHA1 5f0bb9c9c14208851beb5c93d9268c16ab39dc07
SHA256 a2794481de60c7dd95b148cd5197db8f8b6a549c74e9ba7ac54da7590f89cf13
SHA512 813186667e3c63ee624482642609901d2210a8f99fb134e5fc58e5d1e603055ed2903eadf62c6419c16f00a3a41ed6580bc7693cfed1957d077f53a96b577669

memory/1780-491-0x0000000002930000-0x0000000002D18000-memory.dmp

memory/1780-492-0x0000000002BA0000-0x0000000002F88000-memory.dmp

memory/1780-493-0x0000000002BA0000-0x0000000002F88000-memory.dmp

memory/1092-498-0x00000000012C0000-0x00000000016A8000-memory.dmp

memory/1092-553-0x00000000012C0000-0x00000000016A8000-memory.dmp

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 f08d9bbc61cff8e8c3504524c3220bef
SHA1 b4268c667469620bb528c04eaa819d508159b398
SHA256 2c4d8b48344ae221e349e525ac16eb364ffb5ab8deae80c7caa28dd5967cabdb
SHA512 a64a03d959487399fb57e1bd062c0e9f88a17ff9b3ad15e6b96a4b7332341d0fc9186ef99b2ab9bdcfa51864f21d08bce48479202c01d15470916e90fb09fef4

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 4f7be9736242579cb8afa1af86980dfe
SHA1 1c486393847996db4f6b78532dd7bd9a0a924549
SHA256 9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4
SHA512 4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

MD5 2799f9daca46770a871ce1b5eed32e7c
SHA1 a2792f571210a7f38cdbe49391017300ee7b1ce4
SHA256 fc22676f5b6cdae17b78ddfd16bb070687516fbc827a7edd0541f3a32d85c9e9
SHA512 c41f2e4c4ca59d6f9d11fac11296ab87f1b508b5d64e5db7762f2f6dd387aa96206b2b0fa127f17c0b8c24a0b56e81af12d5937474a450222d9c4416c1acb16a

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

MD5 3094925a8de871bcc72ae50882d2a6f7
SHA1 9f7894bc4b2a498ad20b14b2b3cac175bf4d7a9f
SHA256 523e7230db0c47a436abbc442db93e41b6f549b32da6c2a10db7a18228491216
SHA512 bf2349354321397652d834507aae4c32885273209d1409b796170292e37ebf35878e2934d3f53545e66724561e646cc660f952e0bb5006cd7a262a790b64e39e

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

MD5 fa8aa84ef4bf0de505f6e3447d4b55b3
SHA1 b99654dfa5f6c56857b4f4102af2d27503bcdc74
SHA256 f3b7e85e8e5e41496fb563816fbf79e6640feb1591bd5e0c0b876d80053ad913
SHA512 b3a7d0d5abe554301b8745bd738662d80e439fba8df6f984cc05151ec8c081a61f0538765653e8587b431cdc97d384ee35d17ab3324c06a2ca40a069e1525ba6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG

MD5 46a65321aa1fce57d465c26e8b6eb392
SHA1 9efb9a3acd5b32556ea66398c74b014f91087559
SHA256 61df7a1f0367209668d4f0f6a285b8baff864d1341d382ebbc7fd4e71036b666
SHA512 094d69016f066ae835c71d7a950217b9ad09e8cd4d74131787203cae950e572c18213dc1ded139b1fa46c7f803cc15bf4f596c9d51aefe0d43850ae2865f3707

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

MD5 ce17d7ce06488f394ce124f17d5acafc
SHA1 8a5dceae9ea369b686123c8f940bb0ea07870ffa
SHA256 c4b04568930f03979d71f48a57b9ad06b4cdf687272f6753ff662006e8e6237f
SHA512 c33f1370213cabd1b84c936f1ac14f9bcc83bc03a633bbe25efe1e906bcee515d0e615c86b7ee3b34404dd1d95ce74d1a00908de8cdacbf9961de3f1ceb8362b

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

MD5 1f5c8939031a7f93762862cfc88a8e56
SHA1 6dc4df87344db0ddf09c777e7a80d1b5661559b8
SHA256 14be26e969eb15ef7e76e0ad02d8aa0516c5391e8b09dba0a9a6c5f57ae24aba
SHA512 de45d700c86329c704777917863fd1ddeca90d2bed67a72794164882bf15725ce83c7733f664ee0a2af7df54a6be2def729d19237fb2c434115396ac126ff47f

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

MD5 09229c3bfb801177839a7c2e22e33a1b
SHA1 f679c05c4c7b2f3722069420c6d6481fc856e7aa
SHA256 cbf81d779b469942613297a3ca6c09d885e3b1d4aa952dc1994a7175fbfc7e3f
SHA512 503bfa063b29dda95f15da303f707e5b78a6bdb74662c222d8a8b7e3a33264016a66acdd9de44aea932e7cde80a43c2406ea6f0250d3df8e182217bc4a0a7ed7

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

MD5 0b445ace8798426e7185f52b7b7b6d1e
SHA1 7a77b46e0848cc9b32283ccb3f91a18c0934c079
SHA256 2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6
SHA512 51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

MD5 59d6f22fdc11d6b116b38193ed5f4b97
SHA1 cddc7eb2110b3179dd6d1e32b4b37f3568a22ebf
SHA256 782cafea76d24d76885d88ee1302e5f78d75a4e335529dc20ad476fdb9e34744
SHA512 5b0fab5139736d30a69c98ea88d95a5c70f59aab1b82394c58b33617b824447b861a6e6067b62dd1ca1812a4989937e06ad473c6c94376af957871e9e63553fa

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

MD5 1557c08e187b7783083e0b80051fd321
SHA1 2c6ee47799d713e88fd589609b81912a4522044e
SHA256 0c0e74dd07c45833a5dd7ba931e5d528eb16334defdd06171df2f632d6e47842
SHA512 485f69b3878b2bd7fdf52ad020dde2cbc34dd1970aaa4e5eb8f8618f6091b5b827b428447859499c3d61ea9cde2edcbb97c8fb0560cd0aaff50027c0f97ee6f3

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

MD5 5eecdc666e6dc0b8e5e8d2fc3b9cc1b2
SHA1 72a16d461bd2410d5749c6bf939a127683d83a95
SHA256 052f0289886f9cc0931d7026dfe1f5253ad39123479627e37afa5c430e8f8ff1
SHA512 5d465d2c61d97ec2a52db3aeee8d42ececdef08930692842f9c6a41b0611cb774015d369e4fe5186079e97839acc78e8403ea6a6c33ee54a7aef3eea41c3d7db

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG

MD5 03b1d78771eb279766efb2d9f2fa8463
SHA1 8f10e304fd65e58136ccd6ab012ffc594e6fb707
SHA256 eec16d2cb57e38b485b6a269e9c2554c1dfc3b70dec9f7bbddc2b62526b3d832
SHA512 ca51cbaf20e6f62eb6ec69555d259ef61828d3166d09106bcd335dd417ed30660af71e7fd8db6bd22bf134cc530e1a55ecdd2c307e64e8edb28af95299d66f5a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 e0f019a633c34caf64c4155336c2b7ef
SHA1 f0fb5f98550f9391b3b3b3ca7536fe50ef70983c
SHA256 14da7e180ecd3f8855e251ab1559e2a8793898d3026d1f2ed8ac63ce8595753e
SHA512 8d854e6626b2ec7fe8c5bbc34e424ee54953179dba45b635490c5c79ec5a028cec2808abfadfca31e734de0dd7ff1a53468a6ec80e41237edbe72d791de551cf

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

MD5 5bc85d12eb492baa3be9230f1fbdc342
SHA1 456fe4284fa916ad3817e7c3d419c13f4c949737
SHA256 9a27f240758513aa1cc05500171fe22fdb3a485781cba4798cefc29f6944373c
SHA512 3d55c597ac29d7f810980dfd89404d3ecbd2e652ae1bc5e6710668ad5386a0caecf3149289df13f6dabed6b2e4305a26684ab3bd21b255b37f8a596fe8d641b9

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

MD5 38c12e1a54f8fd216ed3f13b36798cc6
SHA1 ccf1fe585d3374ebce4c1ec025e2d8ec39968a7c
SHA256 608924ba294590b5b706658d9aaa71b480ad9aa1b6797bbc5cf1632ac6c616b1
SHA512 0918af63f006d7fa04a3faeeb813e61c060316a126c4742a948a30f5b6ea368c3b8592011319dad3dbf8427dfcc095aa72f7b651d6fc31061f861f070447331b

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

MD5 667b0b54ee5ba0d1cb66190226596e46
SHA1 b8658b35e7cf44b24053e4d01d3b51233d6526f6
SHA256 3a9ab8c3640f1b40b33553d7d3dd3d15bd6e702ef510ec0b66a2f14aa744bf83
SHA512 9ccc773214a0074634be66801d81d7a593ab154351fdbd1b93f56ffa80cf824ee31ff2e13f26536d5f3096e90df43fa223080b4dc55340614b076c08ef976dcb

memory/292-1331-0x0000000000020000-0x0000000000408000-memory.dmp

memory/292-1333-0x0000000000020000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b732027b441e09a999879d0e20032394
SHA1 229f0947bc35e436856931d8da54484157bd0796
SHA256 266c0d70e5ecdb387626a3145602a13067dd1c1efa288e084a30692181be7069
SHA512 327b69ae9ba81d342ae776c35b4aaa25dffb1521cac28daec00d833808ac091c24e33386d9fd0701b420acefd851b143edec2a5e3f918fe93a5e0c3b235f5e63

C:\Users\Admin\AppData\Local\Temp\Cab8B24.tmp

MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

memory/292-1352-0x0000000000020000-0x0000000000408000-memory.dmp

memory/292-1353-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe

MD5 7542ec421a2f6e90751e8b64c22e0542
SHA1 d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256 188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA512 8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

\Users\Admin\AppData\Local\Temp\jre-windows.exe

MD5 7542ec421a2f6e90751e8b64c22e0542
SHA1 d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256 188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA512 8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

memory/292-1362-0x0000000000020000-0x0000000000408000-memory.dmp

\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

C:\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 0f1df8103a64678e288dd7dac0577a57
SHA1 60a1d13f336328e927163256c8234989c9f5453e
SHA256 b200755ed595017d586a6c18a31830f5a4d6b2d1500084fa6e0e31bff44f1704
SHA512 bf1c5bdc7a6c199752b5284e38a43e03452687b38695b22e2ba2529fa172bff2c9ed1d5ffc92cc84905d8c8afc2e19254afc09514069364cab0c8ae64420483b

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 0f1df8103a64678e288dd7dac0577a57
SHA1 60a1d13f336328e927163256c8234989c9f5453e
SHA256 b200755ed595017d586a6c18a31830f5a4d6b2d1500084fa6e0e31bff44f1704
SHA512 bf1c5bdc7a6c199752b5284e38a43e03452687b38695b22e2ba2529fa172bff2c9ed1d5ffc92cc84905d8c8afc2e19254afc09514069364cab0c8ae64420483b

memory/292-1386-0x0000000010000000-0x0000000010051000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 30916bcc2f319775ce6503c97238cb6b
SHA1 fd079b92495bda32e863d1189d2d6551685277e5
SHA256 dd9f933bf6aa4180f3156b940bc65c6b029251ce918108f74ec66252acdb374d
SHA512 86c2d91e502292020a4e0fbdf89149dbc53a8bc5fd04c8f1ffd9c6a9cc57fc67687a2fa7fe571096ce89dccf30f1eabb2b6d82349b88890089ff6fee33d7cf53

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0MG1ZE92.txt

MD5 327af9451de29e69f09897767b32c4a6
SHA1 7bb7e96af11af3393cebda710278ed62954364ee
SHA256 728d451568c9af85e992592dbf7c16dce4a22742eda8b8081232155c88e18a35
SHA512 1fe7938a18268fefdc49a251edb5f63cf74d7a2910e55cc2648c174ffaf027736da768a9b4e6cdd1be93ddf7bcf89093a6feab57cf3de04d7eceed17790f959c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 f5006f1d4deeb74f64ebe8320b30c04a
SHA1 4501b48f015503084cb7ccbe71f9471fedb6c7a3
SHA256 0f170e97d9e78977f9b3e2ec8b5530dd2b57006e3cb1e8a80325c45fb1446a11
SHA512 a2a9c6be56731ceb199d926a4de5121eff520ab1f628ff33028718f142f088396c50df1ee36cb6a7a5799ffe3a241b845fb6866398c9bf27a04a6e7fafc2cb06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 b2b3764a0eb3b6ee8f395cc1f3c31d85
SHA1 c3293471d6d018cd316b53c809036835c4060e9b
SHA256 e741768fc8a1a618b926abb44bacd1cb178cd73489d5fd828304c913d785fa52
SHA512 99b7549e1a058d37f47977c312ca8c6a83139f7a1a684022205f930ab7d2f00a57e4e09416860770d86dda1fcf9dcef441693cd2cce13ad42369805a0a1b6f23

C:\Users\Admin\AppData\Local\Temp\Tar3084.tmp

MD5 73b4b714b42fc9a6aaefd0ae59adb009
SHA1 efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256 c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA512 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

C:\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe

MD5 6571b84d6a9c83406935c09c17889e39
SHA1 5d4ee286b28d85e24966fea6288943c2b2eb854d
SHA256 b69bd4c2d32b5a239b4c450a99c27f50830aa5b96238733e9e008da2457cc4f6
SHA512 7776f06fed03f264502375b6c91e635837b9a16d8a4541e609a19af156b3f125daab77a6d38fa0443f052e70d6722b8b0f36698039db9345102d7d220d4f528d

\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe

MD5 c0706557d673db88633c1d4d937914ae
SHA1 81196e8fa025ca845dc5d9a6b507c58a86ab7db0
SHA256 e0fcb3ee3e799e4640273c6cdb40d6f3700d5e909e45eb2bd480625d8e9cc4e0
SHA512 e4dd76215c26a26254bc273beaa3a74cbcbc0dfc630f9e878dcdce38c36f24344516adda7e9cb79fcc19ad1296f906e2d922825964680697e61e80c22a3ca99c

\Users\Admin\AppData\Local\Temp\jds7191365.tmp\jre-windows.exe

MD5 b5588a56991cd54b83b9d0ee3fe30d73
SHA1 142fbada4dec5c0486cac0f57c36d1bff8397336
SHA256 960ceef3c41c0782f6270b57b7afb88e60ad1a178748994b2e4333efa0002e8b
SHA512 81b665f9b987c58bff285c3bf14c5a4fedacd176d63784319c06186ec76b736adf46fed62c70c78886722142eae3ecc6cba9efa89207b8574298bad540e6be58

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-22 14:36

Reported

2023-03-22 14:39

Platform

win10v2004-20230220-en

Max time kernel

143s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.876-Installer-1.0.7-global.exe" "__IRCT:3" "__IRTSS:23645635" "__IRSID:S-1-5-21-1675742406-747946869-1029867430-1000"

Network

Country Destination Domain Proto
US 117.18.237.29:80 tcp
US 8.8.8.8:53 123.108.74.40.in-addr.arpa udp
US 8.8.8.8:53 199.176.139.52.in-addr.arpa udp
US 8.8.8.8:53 140.145.190.20.in-addr.arpa udp
US 8.8.8.8:53 dl2.tlauncher.org udp
US 104.20.234.70:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 70.234.20.104.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 13.89.178.26:443 tcp
NL 95.101.78.106:80 tcp
US 8.8.8.8:53 203.151.224.20.in-addr.arpa udp
US 209.197.3.8:80 tcp
NL 173.223.113.164:443 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 210.81.184.52.in-addr.arpa udp
US 8.8.8.8:53 216.74.101.95.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 111dddf2f308abc2a8f7555d5f642751
SHA1 11e6cdccbf29a71a97011b9444cf20c83ad8b57b
SHA256 c65af78739ffcd7bb6673f167624522ac8172516a1d3783e5171f9eabd625be0
SHA512 11662a0f5cd850578d2799217393f979f0dc029450f4fbf17780eae69494fb3f4de5a617d31f3fbf5b3a7179eea7bf9ded2555fb61703baeb74885d6bf0421c4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

memory/2692-147-0x0000000000B80000-0x0000000000F68000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

memory/2692-440-0x0000000010000000-0x0000000010051000-memory.dmp

memory/2692-441-0x0000000002E60000-0x0000000002E63000-memory.dmp

memory/2692-456-0x0000000000B80000-0x0000000000F68000-memory.dmp

memory/2692-457-0x0000000010000000-0x0000000010051000-memory.dmp

memory/2692-464-0x0000000000B80000-0x0000000000F68000-memory.dmp

memory/2692-481-0x0000000010000000-0x0000000010051000-memory.dmp

memory/2692-483-0x0000000010000000-0x0000000010051000-memory.dmp