f1b132f7ecf06d2aa1dd007fc7736166af3ee7c177c91587ae43930c65e531e0

Analysis

max time kernel
131s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230621-es
resource tags

arch:x64arch:x86image:win10v2004-20230621-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/07/2023, 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.885-Installer-1.1.3.exe
Size

22.6MB
MD5

bd3eefe3f5a4bb0c948251a5d05727e7
SHA1

b18722304d297aa384a024444aadd4e5f54a115e
SHA256

f1b132f7ecf06d2aa1dd007fc7736166af3ee7c177c91587ae43930c65e531e0
SHA512

d7df966eeda90bf074249ba983aac4ba32a7f09fe4bb6d95811951df08f24e55e01c790ffebc3bc50ce7b1c501ff562f0de5e01ca340c8596881f69f8fed932d
SSDEEP

393216:KXGWOLBh2NPfs/dQETVlOBbpFEjdGphRqV56HpkoaH3D8P2Q6YS6x9DOc:K2/BhSHExi73qqHpu34kYbzOc

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\International\Geo\Nation	TLauncher-2.885-Installer-1.1.3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\International\Geo\Nation	irsetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\International\Geo\Nation	BrowserInstaller.exe

Executes dropped EXE 7 IoCs

pid	Process
4960	irsetup.exe
1720	BrowserInstaller.exe
1992	irsetup.exe
4888	TLauncher.exe
2772	TLauncher.exe
1604	TLauncher.exe
4528	TLauncher.exe

Loads dropped DLL 4 IoCs

pid	Process
4960	irsetup.exe
4960	irsetup.exe
4960	irsetup.exe
1992	irsetup.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023163-138.dat	upx
behavioral2/files/0x0009000000023163-143.dat	upx
behavioral2/files/0x0009000000023163-144.dat	upx
behavioral2/memory/4960-145-0x00000000009F0000-0x0000000000DD8000-memory.dmp	upx
behavioral2/memory/4960-461-0x00000000009F0000-0x0000000000DD8000-memory.dmp	upx
behavioral2/memory/4960-463-0x00000000009F0000-0x0000000000DD8000-memory.dmp	upx
behavioral2/files/0x00060000000232aa-518.dat	upx
behavioral2/files/0x00060000000232aa-529.dat	upx
behavioral2/files/0x00060000000232aa-530.dat	upx
behavioral2/memory/4960-534-0x00000000009F0000-0x0000000000DD8000-memory.dmp	upx
behavioral2/memory/1992-536-0x0000000000890000-0x0000000000C78000-memory.dmp	upx
behavioral2/memory/1992-544-0x0000000000890000-0x0000000000C78000-memory.dmp	upx
behavioral2/memory/4960-1530-0x00000000009F0000-0x0000000000DD8000-memory.dmp	upx
behavioral2/memory/4960-1834-0x00000000009F0000-0x0000000000DD8000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4960	irsetup.exe
4960	irsetup.exe
4960	irsetup.exe
4960	irsetup.exe
4960	irsetup.exe
4960	irsetup.exe
4960	irsetup.exe
1720	BrowserInstaller.exe
1992	irsetup.exe
1992	irsetup.exe
1992	irsetup.exe
4888	TLauncher.exe
3588	javaw.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4960	3228	TLauncher-2.885-Installer-1.1.3.exe	82
PID 3228 wrote to memory of 4960	3228	TLauncher-2.885-Installer-1.1.3.exe	82
PID 3228 wrote to memory of 4960	3228	TLauncher-2.885-Installer-1.1.3.exe	82
PID 4960 wrote to memory of 1720	4960	irsetup.exe	92
PID 4960 wrote to memory of 1720	4960	irsetup.exe	92
PID 4960 wrote to memory of 1720	4960	irsetup.exe	92
PID 1720 wrote to memory of 1992	1720	BrowserInstaller.exe	93
PID 1720 wrote to memory of 1992	1720	BrowserInstaller.exe	93
PID 1720 wrote to memory of 1992	1720	BrowserInstaller.exe	93
PID 4960 wrote to memory of 4888	4960	irsetup.exe	101
PID 4960 wrote to memory of 4888	4960	irsetup.exe	101
PID 4960 wrote to memory of 4888	4960	irsetup.exe	101
PID 4888 wrote to memory of 3588	4888	TLauncher.exe	102
PID 4888 wrote to memory of 3588	4888	TLauncher.exe	102
PID 2772 wrote to memory of 4836	2772	TLauncher.exe	104
PID 2772 wrote to memory of 4836	2772	TLauncher.exe	104
PID 1604 wrote to memory of 2812	1604	TLauncher.exe	106
PID 1604 wrote to memory of 2812	1604	TLauncher.exe	106
PID 3816 wrote to memory of 1412	3816	chrome.exe	110
PID 3816 wrote to memory of 1412	3816	chrome.exe	110
PID 4528 wrote to memory of 4804	4528	TLauncher.exe	111
PID 4528 wrote to memory of 4804	4528	TLauncher.exe	111

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe" "__IRCT:3" "__IRTSS:23661420" "__IRSID:S-1-5-21-4025927695-1301755775-2607443251-1000"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841988" "__IRSID:S-1-5-21-4025927695-1301755775-2607443251-1000"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1992
- - C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3588

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
  2⤵
  PID:4836

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
  2⤵
  PID:2812

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:3292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa040f9758,0x7ffa040f9768,0x7ffa040f9778
  2⤵
  PID:1412

C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
  2⤵
  PID:4804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
7bad44ea36aa548c85d73f7e61faa1e9

SHA1
7df87753f0cea5e155d1adcf118be89e4a13a85f

SHA256
58dbbd6d84e6946615d9ac53d4835aa483a2086b922141b3d14b2f09b596cfcc

SHA512
b52229600b6ab56b61fa8214768a8699d149ad1cd84a0b3b7ffbf6856743689af78a31d3228074e43dc91844300ae584aa9ee4becd50671d2eaefc1a03fcbff4

Download Submit
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
5cf32d62717c0b5e9aac4c88fda1fbb7

SHA1
879c45e25c1e7652233b524549d644acbf330577

SHA256
ac4ba5d866a1f0d652cc79849e28b6a6e0027d87922eaff7b076d8d07e0b1bc3

SHA512
e079a429d56292e3b4a81022516d4639147f2f42d22f0b9f7810f33b029cd871d2b631971cd01117a187fe58fb71bdd8436ba791c8d49c2179c8e347c8d20ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
cb50d496ae05fa1c8bfbcb3b7f910bfe

SHA1
3ec4d77b73c4d7e9858b11224314e99d082497a8

SHA256
7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

SHA512
22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

Filesize
1.8MB

MD5
cb50d496ae05fa1c8bfbcb3b7f910bfe

SHA1
3ec4d77b73c4d7e9858b11224314e99d082497a8

SHA256
7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

SHA512
22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.8MB

MD5
cb50d496ae05fa1c8bfbcb3b7f910bfe

SHA1
3ec4d77b73c4d7e9858b11224314e99d082497a8

SHA256
7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

SHA512
22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

Filesize
339B

MD5
e5e9c323b6a9533a09982b2117c61528

SHA1
3dc0e877803d6e16b28ce0840e2967cc74494a61

SHA256
ba1f3e4598c5716bbfea508fada40b7dfd0989ddabd453e8c8703c04270151fd

SHA512
bbfa29299a1e948506f6ec3802aceb27f8aef3a5b2e3c9789a92b2bcc959fc2523d2344739ccc89df370dde6ea23c1db5ffc7e4799b5e532b0ec85dc98996865

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG104.PNG

Filesize
644B

MD5
d59d425a5672bdb23aced47f2cf4c897

SHA1
6eb8bf3f328975250fb0f9fcf56bd1fe530971a9

SHA256
09858e3e9eea849635ec67d94dac9b6f0c1f8d4bf021fd4bd2998f7e23069026

SHA512
0f45ec639bb40c216dfd858df1a65766fd7ca95d5015ddbeff525dbe5433bb83ff786665864e386c92ce3ab3de0c3e409bd90b93260dc5f8ff5a983dec87b7d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG105.PNG

Filesize
40KB

MD5
5c1172831dec567dbdf05ae8e8a0a7f5

SHA1
cf9281b3bbfed132faece1c19ff5c9c0ef700d4a

SHA256
4d04ba36110afcd0c4d0e3c214cdfa42fb975bf3f5da6b78fd7e8f6a97eea4c5

SHA512
03f5341bb49404d96bf3532d1432ee3b40f377891f7ee1464011bbc7a6c76f0ea7162931fb18d89b5c16950c93bc0288da0ae5bce4f04565b627c92cd9c9972c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG108.PNG

Filesize
2KB

MD5
9e6e117037f3eea2ac5ba39de4891519

SHA1
156773a282502194ebc894922269dfea9fb3ba4c

SHA256
43398f595e5a0498cb9303252dcd5d0c0f98c1a1bc843c21debe8386e82700bd

SHA512
6afd9968434878ad1b739e298b351a221b00b9f140c475c9ab00d70b7e5ebaf6df6d20c70356db6f6f41c3ccb9ddbc34f1e8b4bf70f5ffcb64f0e0bdc0d9797c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG112.PNG

Filesize
2KB

MD5
94e78c50cdf3789d78eea228f58eb23d

SHA1
8d3b81782568b41313fbf395f53cff2647f28b3b

SHA256
7d6f45f40582c87f37e118081239f6202e103954b7063a7a4e9e2701724e5a89

SHA512
aed1a8e34e82a749c8117c8cc69249dad44570523cb43654c6f13033bc760e40dcfbcd4e508aed293681832bb19d472f8c87e548c724d6bdcb1b08d37454c7c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG19.PNG

Filesize
1KB

MD5
2003db45b3b05d65f34d7047e68a25bf

SHA1
418d27146938b810c31ddb6a1f8075e7be1d2f14

SHA256
10cf5fdda26ed5f3762d5a527fd2bac692034b8d848547e5c320037026317310

SHA512
8eb6143e3732bde22ba72da70b6ce6ee4ec9c9038334c2380b60e49dc24021792c32a2c7224bf04aa1cd8d77d57b0e3fdaf4606eeb3d4c2985bb9bd91b10738c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

Filesize
280B

MD5
5803b5d5f862418b64caa83396e69c7f

SHA1
97b6c8209b8ad65f4f9f3b953fe966bb09ee4e13

SHA256
ee340f8560ba2e71d7e6d305b959ff8fa77869dac916287da2bff7ce5aa2e159

SHA512
e9bf37f0c89299bfa369a8677ac56b12177dd3153246e5e6a9390577658111b731b0ab987044d30f43e05cb41d79ed31dae3b6f4521f225925920617d0414edd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

Filesize
281B

MD5
60a19921c7ff3c75e28c302f95460994

SHA1
07ac64ffbb153c8675e2ce0651afeaa5e8c6652d

SHA256
33341d30463fbc7cf3fba5070925569c822b6835aabdb8ef2c3cf09547912d46

SHA512
b30b960152dc13b1a9d384c4972169392cd405bdf4d3ecf73f85cf8a9a68a075131b2495c0348f54d43d0e7a279907bc7b76ac103f4a624738cbfc73bbeeba02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG45.PNG

Filesize
438B

MD5
1f4c666195230d70d3eb563429d7f2fe

SHA1
841e76c2570b50edb29560ff2d4c9a2cd460e4ef

SHA256
f1fb2782f6b321afa66a82c686ac0ce11919f38e7f33496f0f0b7241a901019b

SHA512
eacb98e7f9cef2f8d2ba13808f1f7a77d4244bac0b4a45ed788628064e8c86c4e15cf091b8adac1539a4705c867e72714c4b7d902ac0c281f04925661d3bce89

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG

Filesize
206B

MD5
6b2addb09533ae5cc0650ebc8779f948

SHA1
7bef900d216614f9f498d33b345372e40d872628

SHA256
260b130f51840a7b353a640ae69484498c6ec957e37f3bac831a140db533da84

SHA512
769bbde3aaac255bd5464acaedae0a5b9ca0e11e9cc9ce0d71cdb4e47ee21fc3610bf43240d52cf2d9bdc74478384f5c1130f0d919927067631d01a1446aece4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG85.PNG

Filesize
43KB

MD5
380f7b952bf592f1d46afc860e9634ad

SHA1
50c467afe895945bb246b700d66af758662bdbb0

SHA256
43303ebbb809356c71c8b040d2fa289106996aa04ccf54d9bf742db763a7213a

SHA512
08cba7883a4ed219f9da8537756d75a94219e2a3fb6dd50c81ca607b97388e7aedc19bebaa5d375f533f7ab17d8a748f85589f61a2e09d8a9c591ac5cd0bca8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG92.PNG

Filesize
1KB

MD5
e2bfeff9b2c00ed300d6e3d0e96e1d8f

SHA1
700ce64fc839b206166f2e215d5f5d29c5ec087f

SHA256
563d5613003932532f9d4c59fd4c429790cee101f1603c7e9520f0f3b08ed83a

SHA512
cbbc2b3af6ddc05f9b8f5e5c14e418e9d4361d28eeb4b1115074b8bc2f903183d65ad533579ee819265b65a21cbbf95887784e98751d6cfda9f0e2fd4870a462

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
a70accbc1f1001cbf1c4a139e4e5d7af

SHA1
138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

SHA256
b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

SHA512
46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
a70accbc1f1001cbf1c4a139e4e5d7af

SHA1
138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

SHA256
b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

SHA512
46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
a70accbc1f1001cbf1c4a139e4e5d7af

SHA1
138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

SHA256
b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

SHA512
46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

Filesize
114KB

MD5
4a6a32076a6ec33b804682a0630d916e

SHA1
5f59244343506596b8b13145cc7b7685a85b25af

SHA256
91106348245a378a20028de836ca8c4f8b21248d6d5b115892f1d915d3f83ab5

SHA512
a0ac7f21f4d9c247915615faaaff2e164e6defb58bf015cdd3420a63238df8d3c984545179a4567d48882c4c59b483819f6bf59ca532d2449cd6deb081451fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
2b2fb67e0f041923ce66c1d1f2d91eee

SHA1
31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

SHA256
dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

SHA512
b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
2b2fb67e0f041923ce66c1d1f2d91eee

SHA1
31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

SHA256
dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

SHA512
b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

Filesize
1.3MB

MD5
2b2fb67e0f041923ce66c1d1f2d91eee

SHA1
31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

SHA256
dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

SHA512
b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

Filesize
637B

MD5
6174013bac9f647929eb192732570cef

SHA1
8eecb927055bed3f0e6b018ece94694120430afa

SHA256
8cac727fc93d10917160bbed2d7ab91a03f3279e8c2cf74f3fe6264348d35373

SHA512
16c99ab1d9752e5b89eddfc69fec918aa33c3837eec19695a57e093f4ea06f36a8328f9739140b124af510d7e9bb3cc07dfa3390c483b02050488f507c92502c

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

Filesize
6.3MB

MD5
a09d58d5281883d9b555cb8f99974f57

SHA1
f900108770e0ee69a88df27bfeb3aa13322385b0

SHA256
dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

SHA512
0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

Filesize
6.3MB

MD5
a09d58d5281883d9b555cb8f99974f57

SHA1
f900108770e0ee69a88df27bfeb3aa13322385b0

SHA256
dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

SHA512
0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

Filesize
6.3MB

MD5
a09d58d5281883d9b555cb8f99974f57

SHA1
f900108770e0ee69a88df27bfeb3aa13322385b0

SHA256
dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

SHA512
0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

Filesize
6.3MB

MD5
a09d58d5281883d9b555cb8f99974f57

SHA1
f900108770e0ee69a88df27bfeb3aa13322385b0

SHA256
dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

SHA512
0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

Filesize
6.3MB

MD5
a09d58d5281883d9b555cb8f99974f57

SHA1
f900108770e0ee69a88df27bfeb3aa13322385b0

SHA256
dd5891adfd1f98f945cd02c02a231a41c8224ccc350050b65e2b987e075920aa

SHA512
0f9fc01df7bd6fcf25893ef1a31d0105e19a853d81d475312c1ad4d3f17b77ad6cba659c4b78bda8040279c91947d9277987447a3795b7acb393a5eb95ae8f3c

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.BMP

Filesize
451KB

MD5
0b445ace8798426e7185f52b7b7b6d1e

SHA1
7a77b46e0848cc9b32283ccb3f91a18c0934c079

SHA256
2bbf97ccba3f87d469eac909c4ce8a3f13ed29c8f31b611e7d5cf89a0619eda6

SHA512
51523d5b711481293305465a3a3c6a3a50dca984cdc8cca1f4c44f3c21bfa430cd9aac1a8782d9605e6954cbafb307beb6b1a52e9785de1bc3f71067d80c6b6e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG11.PNG

Filesize
1KB

MD5
de9c66b226d72061c49008a461f1c6ab

SHA1
d0a0e66f62ed9388058b9dc9810fe6d099c8f6fc

SHA256
2e33e8b1c2c2c465e6ac580e09b8031afd17b5ebce8a13c94f5fd39b771cc59b

SHA512
853fddfcfc972b8b3141d63b0785d67e4982ba650b68a150fdba430b9e498919cd2c730685777ab8cb75a516df5f806890780d1ade2b1f330706d90fd103d836

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG29.PNG

Filesize
1KB

MD5
2bd924be3326a60ac70a21c9dcedaad3

SHA1
5c321ffc7bc9deca7f1ea5541066f1eb82cbe401

SHA256
f66b2e34f57e42c2649cb546a8a5a395425efe306129e50cb07f96ab1cfaadee

SHA512
7bfe01facc850e705be68f7c10330f86a94e920ffe1a5a5bb803a7f8c3ebd62e007b20d617f1871aa18257f50575cbf26f1ca09672f7b24cc281035348b0d38b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

Filesize
45KB

MD5
b3af6be5f4d16abd764157ec3cffb2c4

SHA1
bdb2c7ae18e9dd6d2edf3ed59be14ccfc400f4b1

SHA256
0e34299965ba1e761daabad45cad9aa27dccaf90a30a4badf5008b6a3d15cb5c

SHA512
eaf0951a615dbc0c7d6a364a53fd3401b60f53875f5d9a3bba922eeeadff83cb12b81e4b8cae1c612c3782c3c16b20a6e0d882dd913bbb533277d82af71a317d

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG41.PNG

Filesize
457B

MD5
6afc90de971a64e963b2b2b2c9cfe0d3

SHA1
2198f7fc711a848ee4c20b51e72819b07bb81ce9

SHA256
d720258ffe5025af550847c3f674ca9854eb052b0bd964a40b920188d26f3ab4

SHA512
e418485b852e6ebed96bd85da59254ff63b7c6e390e71ae3e298252fee980b89942bd26070c4ae6615f44685fb496a87f7549a1ae45e2fcf091c10ae2bef661a

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG42.PNG

Filesize
352B

MD5
269665f4752b9a668b8ead9b4d6cead8

SHA1
9eac14e0358fde1a2d7bbcdaf61eee90b46589bb

SHA256
68c133a816069421a9e384aeffdb3dff59945ce69da2a77da947545aead75b27

SHA512
0c2040775584d05271b701b3e43c45c621b48e63b537f9d441bddd44d25d18042fdb3a213836c6b52582bb358d7cb08bce9c292f4ce0c79dc0ad879d259fb74e

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG54.PNG

Filesize
2KB

MD5
88201e077a2a38aaa26f73ac029bbbff

SHA1
216334687e3057da13fe727ca2fdff0a061d98ce

SHA256
85265c1f5607b43f1c774730822bfab73162fd0ff651735884d68257c8f1a7e7

SHA512
7f73ddcf18b619721a43dbb5b56e706ea6351b8cc85fb3ee653f4d340f27f6d07f04cb0cb45ae8d0c92d292197ef1b6ec7b0d352944e4c4e442aebf781d72dd7

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG66.PNG

Filesize
41KB

MD5
93989ba5ff12871a1574740f636c8698

SHA1
44c795f434bffd4efcdb915cffd1f18f959e08ba

SHA256
8585b72b8a5088e213b97ddb2f25a4bf5502a7c65058817722e0332b6017facb

SHA512
bd8f78d1ea50d05a528784b276b846f091a258bb51e27c7e6fb4d8757c05c62c801df570edaba67ad457e7cf3ef2363c777bccf56e9c8b68a74acf2a453825d2

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG73.PNG

Filesize
1KB

MD5
04605e441a8aa1a9490cbdde12070791

SHA1
fbd4303ce75c15f279f8921f40ecdf83c79064f3

SHA256
fdbae6ad0511f609f8a435eb296fe7b674054b76f10ee7667092ce3fb723b2e3

SHA512
a7006b059631311511ac6081600e1b41ecdc9f19d22aa68e780b2d13d2e7e8de06956641048750ad687fcfec3b82a720f5d187dfd59831d598b9e6dc49c1079f

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG8.BMP

Filesize
451KB

MD5
d2b43decae0a14deb90423bfb687dc63

SHA1
c191705fcb927d476d4fc639860bd52e324a274c

SHA256
3266fb3a33a97fac7d71652129865c3d0dd06e70af6ed5a3b2506d842eb69e70

SHA512
3cd903b0c4590e25502cd0f91b678c1e798989211e174d5a6dbfd52b343a426b867204979cc078a4919d63a4c4401c4f8eaa295227cec0ccc043c7e285d3d2df

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
33KB

MD5
38c7e2e6b3c34fd0c9c89ef424db99ed

SHA1
f7908cfbf463cb8309371b6598690d5e002453a5

SHA256
a4e26135cc4a749165bc694a06fba0d73ed63432f5bda9eb3db117d4ebe685b6

SHA512
f1c3b2514fd50919a64dd4a39369a41393dd7a53a198a2607240dd386d97a2de71e832e5795943eb8317b64e1664651ff7c53c7f037bb62dd23e529268cbb1e3

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

Filesize
6KB

MD5
4f7be9736242579cb8afa1af86980dfe

SHA1
1c486393847996db4f6b78532dd7bd9a0a924549

SHA256
9cecc28716f392d2394829f4cc3f307d08f5aecaf3e2124bdaaa0d6d9c3400b4

SHA512
4c55bc2698d8934713e791c015480248198e22efa66dd5ca79ea834b9835c9e85ca8c2869c9b40dc394ae7e27da039f79c392f88472dedc1adfa83dd1e94f1c9

Download Submit
memory/1604-1851-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1992-536-0x0000000000890000-0x0000000000C78000-memory.dmp

Filesize
3.9MB

Download
memory/1992-544-0x0000000000890000-0x0000000000C78000-memory.dmp

Filesize
3.9MB

Download
memory/2772-1840-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2812-1876-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/3588-1865-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/4836-1864-0x0000000001010000-0x0000000001011000-memory.dmp

Filesize
4KB

Download
memory/4888-1832-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4960-1530-0x00000000009F0000-0x0000000000DD8000-memory.dmp

Filesize
3.9MB

Download
memory/4960-1834-0x00000000009F0000-0x0000000000DD8000-memory.dmp

Filesize
3.9MB

Download
memory/4960-441-0x00000000036A0000-0x00000000036A3000-memory.dmp

Filesize
12KB

Download
memory/4960-534-0x00000000009F0000-0x0000000000DD8000-memory.dmp

Filesize
3.9MB

Download
memory/4960-440-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/4960-535-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/4960-461-0x00000000009F0000-0x0000000000DD8000-memory.dmp

Filesize
3.9MB

Download
memory/4960-145-0x00000000009F0000-0x0000000000DD8000-memory.dmp

Filesize
3.9MB

Download
memory/4960-1531-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/4960-462-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/4960-463-0x00000000009F0000-0x0000000000DD8000-memory.dmp

Filesize
3.9MB

Download