Malware Analysis Report

2024-09-22 06:26

Sample ID 230401-bv6pnagd4z
Target TLauncher-2.879-Installer-1.0.9.exe
SHA256 42a309cea201b01a1a135fd651fcbec0d079368ed34d5567d3cf3a3811b47266
Tags
bazarbackdoor backdoor discovery upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

42a309cea201b01a1a135fd651fcbec0d079368ed34d5567d3cf3a3811b47266

Threat Level: Known bad

The file TLauncher-2.879-Installer-1.0.9.exe was found to be: Known bad.

Malicious Activity Summary

bazarbackdoor backdoor discovery upx

BazarBackdoor

Bazar/Team9 Backdoor payload

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

UPX packed file

Checks computer location settings

Checks installed software on the system

Enumerates connected drives

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2023-04-01 01:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-01 01:28

Reported

2023-04-01 01:32

Platform

win7-20230220-en

Max time kernel

132s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe"

Signatures

BazarBackdoor

backdoor bazarbackdoor

Bazar/Team9 Backdoor payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\6e061a.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\6e061a.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1952 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1952 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1952 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1952 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1952 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1952 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1952 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1844 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1844 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1844 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1844 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1844 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1844 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 1844 wrote to memory of 516 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
PID 516 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 516 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 516 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 516 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 516 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 516 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 516 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
PID 1844 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 1844 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 1844 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 1844 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
PID 868 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe
PID 868 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe
PID 868 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\jre-windows.exe C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe" "__IRCT:3" "__IRTSS:23652905" "__IRSID:S-1-5-21-1283023626-844874658-3193756055-1000"

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841947" "__IRSID:S-1-5-21-1283023626-844874658-3193756055-1000"

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe

"C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1

C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe

"C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe" "STATIC=1"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\MsiExec.exe

C:\Windows\system32\MsiExec.exe -Embedding 34DF85A82703A05E245E89D915910005

C:\Program Files\Java\jre1.8.0_351\installer.exe

"C:\Program Files\Java\jre1.8.0_351\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_351\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F64180351F0}

C:\ProgramData\Oracle\Java\installcache_x64\7221036.tmp\bspatch.exe

"bspatch.exe" baseimagefam8 newimage diff

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl2.tlauncher.org udp
US 104.20.234.70:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 tlauncher.org udp
US 104.20.234.70:443 tlauncher.org tcp
US 8.8.8.8:53 javadl.oracle.com udp
NL 69.192.71.29:80 javadl.oracle.com tcp
NL 69.192.71.29:443 javadl.oracle.com tcp
US 8.8.8.8:53 sdlc-esd.oracle.com udp
GB 23.44.232.84:443 sdlc-esd.oracle.com tcp
US 8.8.8.8:53 javadl-esd-secure.oracle.com udp
GB 2.19.148.12:443 javadl-esd-secure.oracle.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 rps-svcs.oracle.com udp
GB 2.19.148.12:443 rps-svcs.oracle.com tcp

Files

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

memory/1952-68-0x0000000002C30000-0x0000000003018000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

memory/1952-73-0x0000000002C30000-0x0000000003018000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

memory/1952-69-0x0000000002C30000-0x0000000003018000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

memory/1844-261-0x0000000000C40000-0x0000000001028000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

memory/1844-367-0x0000000000C30000-0x0000000000C33000-memory.dmp

memory/1844-366-0x0000000010000000-0x0000000010051000-memory.dmp

memory/1844-368-0x0000000000C40000-0x0000000001028000-memory.dmp

memory/1952-370-0x0000000002C30000-0x0000000003018000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

memory/1844-381-0x0000000000C40000-0x0000000001028000-memory.dmp

memory/1844-382-0x0000000010000000-0x0000000010051000-memory.dmp

memory/1844-383-0x0000000000C40000-0x0000000001028000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

MD5 ad413a1fa3406283529429463b3c3582
SHA1 541632da39b89d6370444569130a8780e4917886
SHA256 8fb2c6302a6f56fb23e6a2fd1e5e52136941ac1037c40c26ed5d63c9f71c1a27
SHA512 9dd27101508bc457257a58c4df2473c4050be11f55c6b8b9d670c63d52410e216ac99328aceb25035e88202cab177e9303834441fce3c84677173b2ae3f9ffa6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

MD5 c26a8c3c8a1b4cfa66a04954682cbd00
SHA1 a0fe409f7c63212fa96af3d27e985d1b636d7f5e
SHA256 b215bf4f48b4f943c61a43675ca768f8ff8fa4da813fa3c969a26be550e37b15
SHA512 4088e0d60d5e88ca877af034ee3134a3dec626efcea9a498dfa93c532b77e17f90aca02e03262cf179562136f3b2928d330d3e18dcc9180d22f63c926699baad

memory/1844-425-0x0000000000C40000-0x0000000001028000-memory.dmp

memory/1844-426-0x0000000010000000-0x0000000010051000-memory.dmp

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

memory/1844-449-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG

MD5 c2a26bbdeacb81dd7f8f6bb2bea4a932
SHA1 ed9add65433be66e6a62133632eacf505d23264d
SHA256 9c2e4c1cc89258d95ef6702b7a62d722fdd82ae18f7aab62278aff88ae55a6a9
SHA512 8303b6a274e1d663e9255429dedbbb1eb2b232303d2cce9a6942257c14cc358126684e4bf11f7c111a5cf0063067aa487854daefedf7a4917f6b75b0b6452dcd

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

MD5 bfd3f5e88b85b08269a1209c7efff5ef
SHA1 831bb68b2118d3037b34316e8290f3aaaa986a9b
SHA256 a1c5e2e49e3cc71793e79d5be2e8d6f7aa5490c9262675d6db0e3fd537fc42eb
SHA512 95b76358b3bfbd31914d6b1db578aa0e5a19b1e352833df9537a02dc6c2084676eaaeb36ac7fbf397a5ba43b16068df7109b3e84bfaa398b8b7175993bd2edd5

\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

MD5 a7ffc9cfb682b3e3ce482add624b00d2
SHA1 0f1adc88e667992e02beb414e425265c02c1ecf9
SHA256 d9161ff32f19664afc1d38e1dfc93ce75f4f19f716eff2f9993bfabb984b4448
SHA512 2f19f4a82f296552ecc5953d1409568d79488ebc0577acd805650cc37225e4023b321baf1c7169c2e094c10debd029f793720126d1e11b0a89b0078433cf5059

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

MD5 bd5626a0237933e0f1dccf10e7c9fbd6
SHA1 10c47d382d4f44d8d44efaa203501749e42c6d50
SHA256 7dfc1176d8a507135140b23a0c014093b7e2673f0f3e5727c3d85df4e7323762
SHA512 1fd864a5386580cf8bbafbacb12a043ef51948b729b9aedfe6dc81e6c2948a100526c7c600069f22454d550f7f736ad3045a930cc2ef97458dc1d6c782928087

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

MD5 018c68cdf5ba005b4a380c20b13fee4c
SHA1 bf6043fbd31288e8667fcfc37cd74414bee1805f
SHA256 3c7e2319176b70bed0460000d772da9d4cfeb8d2b06dfd913905f15e65942923
SHA512 506c062854f64c4f0d74e2fe709cbaa60a1d2fef0ca7c226fed264be1843e3d329ee542290288335e337c10d266e487c552836d6cae1919ab035f945afa87ed6

memory/2040-498-0x0000000000A70000-0x0000000000E58000-memory.dmp

memory/516-499-0x0000000002C00000-0x0000000002FE8000-memory.dmp

memory/516-500-0x0000000002C00000-0x0000000002FE8000-memory.dmp

memory/516-501-0x0000000002C00000-0x0000000002FE8000-memory.dmp

memory/1844-502-0x0000000000C40000-0x0000000001028000-memory.dmp

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

MD5 545c62b3d98ee4cc02af837a72dd09c4
SHA1 54446a007fd9b7363d9415673b0ac0232d5d70d5
SHA256 738029a4f974128180fa2cd239e873b01e456e8bf53bfdbf34b8ba8b57897be4
SHA512 8bf9c754861ed267efd2055ac09b4ad44df61b989859fccd14190592dca1dab0fa8f57360209eaceabb5137f742c9cea73a1a985ab1955f87a6875d0be95fdcf

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 4f7be9736242579cb8afa1af86980dfe
SHA1 1c486393847996db4f6b78532dd7bd9a0a924549
SHA256 9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4
SHA512 4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

MD5 233878a1dfdf615c0e1dc81530aa5302
SHA1 2cd4b1b5d072e3aec82eedf6a87b6c38bb59ef9a
SHA256 765cd11265661ef8aba10bafa1330b2311a309c6f8209cbef6ea1f4e7a6c922e
SHA512 c2fd7427dfe2fc564389ae1f86155901e11068ecf502d2e43c9e5f018b91a05e2952b08ea984b52e20ba8c83569b193bcf5ffb9b19b6e2e521d92c8086db6ed2

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG5.PNG

MD5 8aa76bec130c6e445b9afc13e069c705
SHA1 f33b780d401e898ce376dfcc17022efb282613f9
SHA256 f1a88c950c4342a6d2f972ed57d4b2d2bea8d17c76cfaa852aaf8247cb392918
SHA512 76a1a4ff5aad4a839d50e3ecb84130e0335dcbf7ddeaf4f5b36327fdacad92ee13cc3018ab706b3bf0553eca428fa0d2f9c4080007cbeba5042841387c505809

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG22.PNG

MD5 1d20e2d3d0534910b3ceb2659e36b202
SHA1 b36edff00ddd65e57196ca8b650e73fd3d5ee16d
SHA256 0e2c443067936fbcf70f7bcd3f957dcd691124a6684056c1e8407609f6d64226
SHA512 17e9dcb016a4609ea756fe8bf781aa0620f694c67b3135ee24ec03208033aea03ac8f70e445e4fe4a8d707aa7166e13bc284c58cf768a7b9ae1ddbe3ca5f1526

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG23.PNG

MD5 8402b903804427eb60533887407e9e3f
SHA1 9ff615c4441fd6e8c2a998e9728f2df91b79926d
SHA256 3c3728982174ca5451f0fd830e1c33f9c92faa46e2e0492186d980b969db6e2c
SHA512 9a193bdc7f17ea6ba20f8bc3fcde1aaf5925508e4d4cf5f3483f96226b79a2bbda27b888d30475c5967f67809454cee6a41108ab9a18a6e62206fb9ea28fc5de

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

MD5 b02439a5633e53e207a97fd5c3450109
SHA1 4cd39e991796c96bf2256f1b1adcb4a87e6d100c
SHA256 2eda05afa1dc64eb2ff1e5a5a3e07fab9b728a3249ffbd03ae6b78df2cfb9bcf
SHA512 1330302a734fe306c6edf001f1eb8f1abeea00338e507365035d4f78245716b93abf569cc613997b897547747fa6a8578d80e6084cb09c5d6d82d3c6dda2ee60

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

MD5 3ebb90db69ab4f89a809ae955ce084db
SHA1 99cc932c29c7195393a374891e86f2212caed004
SHA256 d20387a537000d2e53048ddf7554c02a3fe095a22d6d6232cf882a4eb4808d39
SHA512 4dab7ff56e46d08afe5649e7da7dd205d2a48ed4e600be03827828d5aa48abf4912f61f19dca0aa63f4243d848af67107caa4212a63c02a0cc6a804f9221361d

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG45.PNG

MD5 93ab8d6d5e320bb55107ed481364e990
SHA1 151a55018eaf7e439791912786701068fbf3a401
SHA256 696bd78a46953d9314b3193983df419f4dcd016b5d31369bd3f3e3b364efc641
SHA512 7b19c69f69cff9f5505f4637eb71364a347fcfb4771f0c91a881f297a527fc347a73c26a259a69e5cbba164ec416d942d5c1188cd24f9dbb425b494db2d48823

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

MD5 0b445ace8798426e7185f52b7b7b6d1e
SHA1 7a77b46e0848cc9b32283ccb3f91a18c0934c079
SHA256 2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6
SHA512 51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG48.PNG

MD5 eb70c64eb9637567556946524aaba3c8
SHA1 5e5574aef69a542c92a366c82d1e5cbd54d9778f
SHA256 c1a8a2116ffea80a1ce556fc51174e46be705310e7cafd9a150035056de9c588
SHA512 8c547e03982e75b00801a4a56cf55705e13f26d17e578d0c7ceab0effd1576863416ee2cbf5f205c306b206bd0ff39ab950276dc4a554d8440d85ef4c7112d87

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

MD5 0339f5d817fd1dd5abee2deb93183118
SHA1 e49bbc34cca35193272b7ce66760dc32e5c19334
SHA256 f110d8f101c31fb2c09f6d41a35b8c561c706f88467923052750781bd5fce37f
SHA512 08e0f45b68cd9e83d018e988de0b0b76dd8b9433f5def67f2137336dbef28bce69f6754b64bd26b04931811351a74d4c58cba4dce547a86d937e4980f1416147

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG67.PNG

MD5 0d49244ce1c34d0ac58389f7403f60e8
SHA1 1c0a3b4b89a0b937231c86cb80e0d4f2214a29c5
SHA256 e5cb63d87eebf491c4fcef41e9a0a2a6f7ceb3f5685932f5f4e9ec158b7dfb65
SHA512 a4362b18c67d4881b952727005902ad9852a2dda45426d1077961199c0d22130a20a0447e05e588e20b0bdcc4224f8a271929864ce476477091d4349f4ce21f5

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG109.PNG

MD5 0e0557b9f62fce2322fa993c91b2e2e7
SHA1 3c31d21dcb323a3faf47dc04663275e2581013b1
SHA256 7cdc6702979255bdc4b0ee0099593e88c94e563f00bfcca3c7d680f2bb2df3dc
SHA512 48bcf980c20e5b9f587d3c9277855171120cf4ef2d3e7f9aed1bfc8e3f894e28043760c5febad7f3806752b1d388ea1a80092351fac107461023fb7bce9cdd6b

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG124.PNG

MD5 6bcf4aff24c28919bf7c8c76c1c13bfd
SHA1 87776afed17d9f9b3a21fabdb530b4083eca3635
SHA256 03a9cdf6e58e6fbf4158af65ba7465a6463a7d2cfefae2b2bcf705f33771149e
SHA512 12fabd4f1818f31d5ca42c7299b576a6b31232b1c2abb468b256df3d57727dce9395affc4ba6334d7362ba1e57022b5341ffc908e08d019bc1ddc4f94a400e68

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

MD5 14c28705dcb54fb9bfe0168e986df9b7
SHA1 00d09f6096c6728c3131b552adb1e726cc36889a
SHA256 cc4d45f8a8e3be2b4d092574fb2c07d773c2e1f75ee99bfe2a7cca1a86b1a7f4
SHA512 f50991eba261eec83b37db6f3c915728ec869fce263d48791a8db5aa2ed8e6e5c903e796dd79c619ab07df88cb4a1dd19c12225aa85bacac0f3e67d0a3628001

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG86.PNG

MD5 9df48291509b109da6fa8565dc46ebd0
SHA1 15e0c52b88cd73f4e294c5b469461e1666fc280a
SHA256 19210a58182587ee81486ca8357177df48bcd667cc4fbdb434965988b02cbb4e
SHA512 4e0136b2170c52762a64d1232cfe2638f059d3cc5337336501f40c369672241cba955433d707d6f3e8bae6f326eff1083be0cecbba0c6da535947641626197b7

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

MD5 a99cea0ae59b6200452ce912f755ebbf
SHA1 84d44cb1e98d59c64b85dd1d447a01e11e18c9d8
SHA256 ae007f0ee65aa1ea5f0a11f116a7613aa61c67259817f3ac2d7fde299a63e174
SHA512 fc9e5f4aa8551a01e7567df4d1ea764966bb4ec7c177c662f4a82c2095fa12f30d67a64c30d03d08ce72267b924eb78c9bd1e0d9ac4da3797cef36f46d5eaa51

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

MD5 74cbb6a9510a5af4e84765729f03aef0
SHA1 44e70d3263b85bcbbf3f40c0b7710284eaed32f8
SHA256 224e1afab80a44dc6bf440bf4a3f3a9535485c271dd38eeefac83cad3a82536e
SHA512 305a8b0f3fd989af6460018bd88edeaf02ff50815d2d8f7553fa511f33eaee9427095f5d0412e7f53e769bf26ef3222cb6df95c4a68ae473fef85d285819641d

memory/1844-1327-0x0000000000C40000-0x0000000001028000-memory.dmp

memory/1844-1328-0x0000000010000000-0x0000000010051000-memory.dmp

memory/1844-1329-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aae016966be85c5d9772b42f230f61f8
SHA1 5ff5ab59f56a7de67bec9df3d2a8f7fae25c55ee
SHA256 cb3a035ad18608d46a1d60238fe5c7bb9131bde75fe346d2a14d86df9a0b036e
SHA512 cbbaca50f6df0444bb6801b573f1285da9ea20fb372fc61a63fd9e0408ef4de54ede1c5a6ffee7dd223bdc926f5207948f5ba126eb348c2b486dad3df94eb2d1

C:\Users\Admin\AppData\Local\Temp\Cab1134.tmp

MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

memory/1844-1349-0x0000000000C40000-0x0000000001028000-memory.dmp

memory/1844-1350-0x0000000010000000-0x0000000010051000-memory.dmp

\Users\Admin\AppData\Local\Temp\jre-windows.exe

MD5 7542ec421a2f6e90751e8b64c22e0542
SHA1 d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256 188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA512 8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

C:\Users\Admin\AppData\Local\Temp\jre-windows.exe

MD5 7542ec421a2f6e90751e8b64c22e0542
SHA1 d207d221a28ede5c2c8415f82c555989aa7068ba
SHA256 188ca8ecc44de1b7f602e883c3054dc392792c3631bf362b1bc4f3e1dba323e6
SHA512 8987bf8aa1b401815fa9850e56954db6015bdd06ce78b65ba435724582ffa615dee4e1452fa237c53257dca8ee97b469d01c27757a5f070ce6f807a4f81094bc

memory/1844-1355-0x0000000000C40000-0x0000000001028000-memory.dmp

\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 7c7369afb4fdc05bc7b723747c6ddda6
SHA1 3069ad26f0b1e2b96769d775d3db37f69528a0bd
SHA256 985fc1c56d65f47cbc2458dad8228fa61481cbc392e57e43a4d70ed513b78085
SHA512 2801ccd36ccdcf358038f49b9f339b695dbd8c59811cfbc9ea8198d91d8a0a61b3847d7d3c49afad7afe093c3653ad45f1266ddfaf78b2fdaae4331c323668a9

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 7c7369afb4fdc05bc7b723747c6ddda6
SHA1 3069ad26f0b1e2b96769d775d3db37f69528a0bd
SHA256 985fc1c56d65f47cbc2458dad8228fa61481cbc392e57e43a4d70ed513b78085
SHA512 2801ccd36ccdcf358038f49b9f339b695dbd8c59811cfbc9ea8198d91d8a0a61b3847d7d3c49afad7afe093c3653ad45f1266ddfaf78b2fdaae4331c323668a9

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 ae27c09ce269bd45e94a0bfee3bf7062
SHA1 af13e9b98cdccba7932da0aa5f1aaf7d7d02b4f0
SHA256 42085b234ab3cf63fba8b7d734b36cdc297e57d71de02a8f94bdc119038e94ab
SHA512 7d39eafe4bba625510aee9fde075da12a0fe47a9127df38b78dd8a7c6cdad8f50448da28ec4ae2324784df3d6c6347aff29612a20646a16ec2ff9edf287b09a5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CCRN9SX9.txt

MD5 ee30ae7465cb41b9f94fd7c1a89f072c
SHA1 4165c5fdeb22f599b3928342fea650120c9f9837
SHA256 4bb4fb54f461398733ad691483a290ece035b55f67426fb3d2f8c127ebe7f139
SHA512 612309f8f333b05f539d150a9aef15b0da19a3cd065c92ac434cd3d8d2e4b3e883b0df39e0d0aed3e7a92ddfb1676578df21fb2b44d6e74eda7e2a44d62fbeef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 21ed9ca0f4579a63723066fab3cdb1e9
SHA1 625f8780cba0177fa7d9b747df0bd45511ddc900
SHA256 818a6653f6011a83d251998208826644fe68d228a739c87ec14e470e10817889
SHA512 203e8fa995dfd86617536e1fc445fa1fdfbc0ec462d238cfbfe1d03c81b51c81297335c4c54503070c25897858fbedd659c348ab994f9195635ff75a0f3ecda4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 a8eae15e782df6b91e675d2c878f6f65
SHA1 8f5e69f0d04b0445ae69c394aba9a7394517d362
SHA256 50fa1d3ae97e359cc4be1887e017060a81e3e3ed9abac1c6460115529070c6af
SHA512 e2388c4b9f3dd1fd56044281e2dedc28bce757766458aa87a298123cc744fa16ea69519ce08aad2a632a868d11679332878e96ca3dbe95e30f623d7c8fff37c4

C:\Users\Admin\AppData\Local\Temp\TarADFD.tmp

MD5 73b4b714b42fc9a6aaefd0ae59adb009
SHA1 efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256 c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA512 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

C:\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

\Users\Admin\AppData\Local\Temp\jds7163035.tmp\jre-windows.exe

MD5 dfcfc788d67437530a50177164db42b0
SHA1 2d9ed0dc5671a358186dcf83abb74bfe39c40e9f
SHA256 a90318bae7d99da633d9cac8ce322120d087e7b6f5eec0d1d0d7f9413fdd4dc1
SHA512 dbdfd02528c9f0e506232e8640a8602fade0d05f4139368187300ea2d537e41d2d167655ded30d938bd445a21c776a3c3721f8db4d3f03e3c06807a84cf232e3

C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_351_x64\jre1.8.0_35164.msi

MD5 1794aaa17d114a315a95473c9780fc8b
SHA1 7f250c022b916b88e22254985e7552bc3ac8db04
SHA256 7682233d155e6d19f30cf61b185a02055be0dbcacd2c9accf90a99de21547eb4
SHA512 fb9defdf73786528e82ffc7e1ccfa03cfb687365ec740e9620993da785414306f03a7e1fa523192a9d690a882b012d1e426afd1757639f3ef5f1e612c01e6516

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 597af69e6d5976964e590b8dd14147b1
SHA1 19982e086821150aa5cf9f8fb27ddf45c656c2db
SHA256 8c2ff092a5cb0b076d6200502a2469e689a427d2f3836a5b45e6d2ca175c2b8b
SHA512 d3e0f39190b187efe53f36a17591b481ea899745c5d264bf8f99d32aae0b5a5c0bbdb9a6e630d07bb0daf073a1cd6754b5f4b92176bf8835132af7efca0872fe

C:\Windows\Installer\MSI1607.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 9a9db334e029b5caa0c2d7a9e37659c6
SHA1 20c64c68ff9936a0c770e00b391e7aa5d4fdfbaa
SHA256 72afe8b65b30da8f13921e015212c9ebcf4f35a72e3537c874a11b94f35cbc60
SHA512 d13296047a02bffad40f434068a313808b99615f6dc4d701eed11eb1db2ec322d87d7400c8dfd8d720ebabf1ec13de134b5ed4806a46abfd90f82ce8ff50e56c

\Windows\Installer\MSI1607.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

\Windows\Installer\MSI1ECF.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Windows\Installer\MSI1ECF.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Windows\Installer\MSI2298.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Windows\Installer\MSI2298.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

\Windows\Installer\MSI2298.tmp

MD5 62cfeb86f117ad91b8bb52f1dda6f473
SHA1 c753b488938b3e08f7f47df209359c7b78764448
SHA256 f06cba20bd40e9d841add1877cf8d3b406f0acfa4800b80ae041ed3cc374eb7e
SHA512 c1b0e76cee4e2c3ca604dcc8f5665e72e70008acc824e20d89404f139d7e7e789e99dff131dafd76409f6ea0a813aa136f96089fbdadcf90d6485b1807762e4e

C:\Windows\Installer\6e061a.msi

MD5 2554b402a26cdf5cfe092b6aff13de1c
SHA1 c4fb100d00af91646a617fb0b61e227254ea06b2
SHA256 5cb1c05d5934ac38d17377d93ed67a40e660e2f5eb7f44f00e89eabad2b07122
SHA512 179346a232f9680ada6e4d40696084be0bc04471bf1978cf3af4f97f837dff22bfc635592e8f3e3446a812391461796749418fe3caeb42bb0dad89575fb48109

\Program Files\Java\jre1.8.0_351\installer.exe

MD5 aa8bbe67d967083d844aba19a611dd43
SHA1 b19ffff87321a2b8ef68c10641980298ca6f2a34
SHA256 7ddcb7acdc7eed83ced23aacd2b0039105be8b5ef73965f9c48ace31eb3f9207
SHA512 cf47d3f8c653d8ab273f38cca10bb06611b4582c1700ad10d7bcdaf59b808ae5267d5dc2132d8aac1c00c991b29d0bb0867a311916925ff6519c126a037eb3a1

C:\Windows\Installer\6e061e.msi

MD5 f7a435015b983eecedd77d34399db13c
SHA1 c716a5d067e6fbac05747f51fb3b63447fc0bdab
SHA256 e5275d8669646e3b51477818e24800a7364650d2a69a01040ab2e02954ce5202
SHA512 5efa3e4f39cb29bdd1e6e1e0f5785410d80e1e20fd668706d4503ff3c5c7184d5145c4ccb64422db17fa6153862dee9a75794b8b67d320ccd10cb2ca4ecfc437

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 d403dcdf922ba814040f661dc38ef0f8
SHA1 8f9c96ba5c06b184155d7982dadeec1c671d67b6
SHA256 4d1eb914e1070d66ac9349d4cab71a7e706a23d3d29a090b4fd825019ba0ea94
SHA512 f2b0baf4fab60e28f52c654795bbb06f51afe45d859ffee8846c5da6693f5b3c7c2db3bd0a6cc8cd6f74e9e89428c28bf4f210befb4a2aa25910b2ab9e80326d

C:\Program Files\Java\jre1.8.0_351\installer.exe

MD5 b851ac0730c8e83e7a9ddba1c60e7495
SHA1 61abfc758194c6ad91ca2f14fbac89f9d3eaf8ef
SHA256 fceef47e7621e5d7628eaab36a0c29d5fe926d63f0e0fee787c26ce129bfc5d0
SHA512 cbb1ea54ccde38309feee9b5979e0c27db995d4972abf8f86b83cf5d0895f6fc409957c4c7495f739958ebb06bd5b434177ea57c3ebc5a8a33eb101fd470e4dc

C:\ProgramData\Oracle\Java\installcache_x64\7221036.tmp\bspatch.exe

MD5 2e7543a4deec9620c101771ca9b45d85
SHA1 fa33f3098c511a1192111f0b29a09064a7568029
SHA256 32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1
SHA512 8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

memory/2140-1737-0x0000000000400000-0x0000000000417000-memory.dmp

C:\ProgramData\Oracle\Java\installcache_x64\7221036.tmp\bspatch.exe

MD5 2e7543a4deec9620c101771ca9b45d85
SHA1 fa33f3098c511a1192111f0b29a09064a7568029
SHA256 32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1
SHA512 8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

\ProgramData\Oracle\Java\installcache_x64\7221036.tmp\bspatch.exe

MD5 2e7543a4deec9620c101771ca9b45d85
SHA1 fa33f3098c511a1192111f0b29a09064a7568029
SHA256 32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1
SHA512 8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

memory/2140-1743-0x0000000000230000-0x0000000000247000-memory.dmp

\ProgramData\Oracle\Java\installcache_x64\7221036.tmp\bspatch.exe

MD5 2e7543a4deec9620c101771ca9b45d85
SHA1 fa33f3098c511a1192111f0b29a09064a7568029
SHA256 32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1
SHA512 8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

\ProgramData\Oracle\Java\installcache_x64\7221036.tmp\bspatch.exe

MD5 2e7543a4deec9620c101771ca9b45d85
SHA1 fa33f3098c511a1192111f0b29a09064a7568029
SHA256 32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1
SHA512 8a69acae37d34930ed1b37a48012f4c1b214eacb18e46c7adc54aaa720b75c17ac0512206e7c7a72669c9f53e393b13ef9b7783f02482f19ea756c1022580f0d

C:\ProgramData\Oracle\Java\installcache_x64\7221036.tmp\diff

MD5 9dfd5f7ef08dfa10a2d53d320c1edbe8
SHA1 94578cefe8f5cda435f73c36ab8a2cad411d5762
SHA256 7f764618463c7719dd53f6f02d0af8751a9cea47f1e262c2163dc7ba0928fc60
SHA512 5ba5409fd9b5e18f3708cb2a93247cd9779525a41107a62b54e2676f0588e99d03f12691776baddf2f655014d6ed97dd675d052ee8209e5a39c7bbd281dc7087

memory/2140-1746-0x0000000000230000-0x0000000000247000-memory.dmp

memory/2140-1745-0x0000000000230000-0x0000000000247000-memory.dmp

C:\ProgramData\Oracle\Java\installcache_x64\7221036.tmp\baseimagefam8

MD5 7ba560dd21feefc518ce07623db1733e
SHA1 2fcb0e8953683317b97e7c81895e9d9d76b3462b
SHA256 0d68b9fbf2ae0c48db9fde29528b4798e23968017056598d8fcfacf6794b2ba1
SHA512 7f93ef55dcb95d29cf75e1f99e40fa3404de5cbc2cb018cb225498614997ea83e3f3fcaad6d8cce8251f22033c4f2cfb1e4fadceb4a9d2d53675c5b86ee52225

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-01 01:28

Reported

2023-04-01 01:32

Platform

win10v2004-20230220-en

Max time kernel

144s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe

"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.879-Installer-1.0.9.exe" "__IRCT:3" "__IRTSS:23652905" "__IRSID:S-1-5-21-1013461898-3711306144-4198452673-1000"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 dl2.tlauncher.org udp
US 104.20.234.70:443 dl2.tlauncher.org tcp
US 8.8.8.8:53 70.234.20.104.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
NL 8.238.177.126:80 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
US 20.189.173.12:443 tcp
US 8.8.8.8:53 62.13.109.52.in-addr.arpa udp
US 93.184.220.29:80 tcp
NL 8.238.177.126:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 9597a91c491d87dfb8209de6b878fe8b
SHA1 da77262030402d701d697c65c7d60d70ff8af4be
SHA256 81fdafeef0c0e4c41a687b3072a86efc96a7d5df4c015d66ba2016e065544208
SHA512 b76480193c755e6d83ec7c257d3efe6800fb8f84169ca61096941aa5fa660218e0239e083fdbb9a1e49a0e0d317236c34de1232d827ec8e740d860bf46e9fcb6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 80d93d38badecdd2b134fe4699721223
SHA1 e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256 c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA512 9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

memory/3004-147-0x0000000000010000-0x00000000003F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

MD5 da1d0cd400e0b6ad6415fd4d90f69666
SHA1 de9083d2902906cacf57259cf581b1466400b799
SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

MD5 1bbf5dd0b6ca80e4c7c77495c3f33083
SHA1 e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256 bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA512 97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

memory/3004-440-0x0000000010000000-0x0000000010051000-memory.dmp

memory/3004-441-0x00000000064B0000-0x00000000064B3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

MD5 8d26aecef0a7bdac2b104454d3ba1a87
SHA1 50c29c58dfece62d94ed01cb5b3d070e593dc9cf
SHA256 e6c069c08e356b05465edb5aa9437e8af82c3cc8367d143d3ba6a8790f99490c
SHA512 0daa8bc75d9a067c3f9c46e4fda2aa4811083a06fc0dac74b45dfcdce60623066dac0189538d48128e55850ba20da12ab5f2f748dfbb9a6ec546802a61065475

memory/3004-461-0x0000000000010000-0x00000000003F8000-memory.dmp

memory/3004-462-0x0000000010000000-0x0000000010051000-memory.dmp

memory/3004-469-0x0000000000010000-0x00000000003F8000-memory.dmp

memory/3004-486-0x0000000010000000-0x0000000010051000-memory.dmp

memory/3004-488-0x0000000010000000-0x0000000010051000-memory.dmp