Analysis

  • max time kernel
    167s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15-04-2024 16:39

General

  • Target

    TLauncher-2.919-Installer-1.3.3.exe

  • Size

    23.0MB

  • MD5

    38d4740072a8962d2301b482c96ad41d

  • SHA1

    f4058683b559f1a3cac9e19ff6121a3d990a5909

  • SHA256

    1127fd6ea53d54feb45168d7e98488387e11b0673123142cf8a8f84fbe73140d

  • SHA512

    77b981c49fdcb351a5b6cbe0a0feae3c702b98d68c71ae28b570f0e8a449c664f284059887fbf3f7d32d7e3ea0ae54ce63cd7c2c4ecfdcb89b9a9d0aab2179b7

  • SSDEEP

    393216:c25K22hvhyr4hQ5+kcOWyiGhtkNtdal39+ytpUcOy0rr6of5MJ7ZWqxPAIgtMIMo:5K2Q7m+QWpGEtgl3n3vObrrKJBH5lFRq

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Blocklisted process makes network request 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.919-Installer-1.3.3.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.919-Installer-1.3.3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.919-Installer-1.3.3.exe" "__IRCT:3" "__IRTSS:24067351" "__IRSID:S-1-5-21-3627615824-4061627003-3019543961-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1679762 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1708464" "__IRSID:S-1-5-21-3627615824-4061627003-3019543961-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2660
      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
        "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Users\Admin\AppData\Local\Temp\jds259456151.tmp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jds259456151.tmp\jre-windows.exe" "STATIC=1"
          4⤵
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2936
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Loads dropped DLL
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding AD85DB43C92457CE321BDCD0C00E5ECF
      2⤵
      • Loads dropped DLL
      PID:1400
    • C:\Program Files\Java\jre-1.8\installer.exe
      "C:\Program Files\Java\jre-1.8\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre-1.8\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={71024AE4-039E-4CA4-87B4-2F64180401F0}
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Registers COM server for autorun
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Program Files\Java\jre-1.8\bin\javaw.exe
        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2628
      • C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        "C:\Program Files\Java\jre-1.8\bin\ssvagent.exe" -doHKCUSSVSetup
        3⤵
        • Executes dropped EXE
        • Registers COM server for autorun
        • Modifies registry class
        PID:2176
      • C:\Program Files\Java\jre-1.8\bin\javaws.exe
        "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -permissions -silent
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
          "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2084
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1736
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk

    Filesize

    197B

    MD5

    b5e1de7d05841796c6d96dfe5b8b338c

    SHA1

    c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547

    SHA256

    062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d

    SHA512

    963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url

    Filesize

    177B

    MD5

    6684bd30905590fb5053b97bfce355bc

    SHA1

    41f6b2b3d719bc36743037ae2896c3d5674e8af7

    SHA256

    aa4868d35b6b3390752a5e34ab8e5cba90217e920b8fb8a0f8e46edc1cc95a20

    SHA512

    1748ab352ba2af943a9cd60724c4c34b46f3c1e6112df0c373fa9ba8cb956eb548049a0ac0f4dccff6b5f243ff2d6d210661f0c77b9e1e3d241a404b86d54644

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url

    Filesize

    160B

    MD5

    62ed33ed45788c600fd57baff9555e7b

    SHA1

    0e8ec983de468f506695480a0a62223a8645e694

    SHA256

    1305d513bdd452931512e0027a7464dce822c3d72ec4353a2c3b2468ed21f7ec

    SHA512

    304e9847922a287815e0b86385d23c976afeaf409676db287ea19e58ce733874f47d9908aefb17ebb4e8d7f920437836c8d0aecdac0709fbbe49550447f84e78

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

    Filesize

    471B

    MD5

    17965f5ac37a3d2a0e07c0d41f7d4196

    SHA1

    b82ccf16459772f471d2fe330dd3376d09bb6eec

    SHA256

    819ce2088812aa36c3ab0ad9884d57ce81db03be13aa1200c9ea6abe06d5f9d1

    SHA512

    0b84bbac81ace00a670ad65cc73edb6cd87234dc795d03263f1d4dacef440fbc424544ab1d3fa97b8766b01b44fdcef92f2ac9b0b258059fc223175b8f497492

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    80bf2fee995ae11a096d3dae2c7ee673

    SHA1

    d22e3a995b56bd0404943247f638819f8281c582

    SHA256

    36f0f73903d5f0ae9662e9eb7d8cb91e947142db65157c529fba8533d78ea1c8

    SHA512

    4c93afbaf06d7ca7de01bb086a6f596b35cf9f6fcfc78b15c42e184c8c9df2bcbec56382ac5470de83c8082dc38f7def3deaa01fbfddce464b1bc82c1baf83d2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    af62ef74720397a9df28fa5ad7aaa4be

    SHA1

    1ca095c4c1f2580d16fae6556a806e6e7c061b5c

    SHA256

    0dccc7fdd7b475c5156c17f133db7851255c2a011f1ff82fb30a12c61ebdb949

    SHA512

    15aba1ceaf914a34ea7de05931cbee03da1d628d133579fbc72512dadb0198e780565911487fa387fe860eb18725522db34352d3c7334fac301e5ba2a9387516

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    588c5b023ea7933a86a41844726b6b83

    SHA1

    c00b33257eccafdadf9a7927071e8847ae85bb85

    SHA256

    5ede6b25644a9de72611ef54ef7ef092336ae8d79a2c0b80079f827c7a45838a

    SHA512

    71241f7c495a0488792f2574e679f825ae6ec110b84d736efb3b7a17282397b8decee7c6fef540d025575413ddb9b069ee5dc720cdbecf9e1341392739e9f40f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

    Filesize

    400B

    MD5

    576c5eecbcf528d220f5fe948b2ecbe5

    SHA1

    c9f69b9bbe27ce7ce4a784ea16ab0c25f29ee545

    SHA256

    eced3827612c9f184a81b98c1452ac1c23707b77cded349c95dd13d2694279f6

    SHA512

    d24f58b7fbd40a5ccf68c688a8837c38447c931116245b5eea0d219011fcff166ecf540225954fe69b73553a3670a58ee1b34addcd9241a83d64941ad0f053c7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    39f18ebfb97d7f6402b8cc9515a64324

    SHA1

    49000a20eb14f10ad063bfd3eb8225ea51a51dd9

    SHA256

    8e43b060e48d8789c6e7b72ebe94c87a043fa0d77cedea99b46fe75523cd902c

    SHA512

    84313c89aa40358a66532ffd6b180a1f2c4116c756cedd9ada0caf57e1bf918bbf6be271d84df625ff8c2186dd9ae24b667b313fcb05f39966191c9f03946e32

  • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_401_x64\jre1.8.0_40164.msi

    Filesize

    60.9MB

    MD5

    4b80c230492aedab6757f904167b4e17

    SHA1

    ca169fc089c12341ac8a023e98e5f7d58a1d5d90

    SHA256

    0d961da2bc9f0fe029c31beb616d5069b718abd7f494f28a86fc6ace8e4718ea

    SHA512

    fcfbaa9c987bda1143f2596aca5bb3c04eebbb8ff7cacb9f855ef66d4c1b433a0a07c9694dcaff56f481df0234e8cc833e0c4b66aa52c2541db5fc562a741aca

  • C:\Users\Admin\AppData\Local\Temp\Tar1AA8.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

    Filesize

    116KB

    MD5

    e043a9cb014d641a56f50f9d9ac9a1b9

    SHA1

    61dc6aed3d0d1f3b8afe3d161410848c565247ed

    SHA256

    9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

    SHA512

    4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

    Filesize

    1.6MB

    MD5

    83a8f0546164c9ba1a248acedefd6e5d

    SHA1

    7652f353ed74015e7e78bc9f9e305a48d336b6d1

    SHA256

    e7c5072ec60d32022b3c818c527ad86f4985837a4f0e9fc6477f54ae86d9f1c9

    SHA512

    111d11acdaef0036ff5cabeb16ed55bf4c681fa6eb3c006af450a0ebadae3e213a8f3abb0f4a9aecc8e893af7a79b4eb7f74a5fc3743e338c3e3136b5d7f9f2d

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP

    Filesize

    12KB

    MD5

    3adf5e8387c828f62f12d2dd59349d63

    SHA1

    bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a

    SHA256

    1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0

    SHA512

    e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

    Filesize

    45KB

    MD5

    300bf5341502ba7eee93c2b16c63af7a

    SHA1

    c0b30be839455dfe2f514c07c52dd085392bb022

    SHA256

    046d24487296987dd7126d52df2bcf36040bb573f8fa695018e255b48200f7b2

    SHA512

    7720d9e1b94bcd4480100d430bb103d332214b7062212a33e066e60457659645251b86c1e331b1afd872ac5cae1835b826c94f9400c56bc40fd43ba1c4daa6a7

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG

    Filesize

    43KB

    MD5

    75decfe97d92fa34481d3b502316fd2f

    SHA1

    b98065fcacb2e19cb67eec0bf6f2fce53403b38b

    SHA256

    247a19e724dc8cf8ff5d3dce60fdc12c839e55149670d0366b362d827f7d0a91

    SHA512

    10dfd147f5366143357de272b0f2ff2db517c0a9b6b5da2956b52a5bd141c8d6898d0575d3efec3b146fe194eafa3b8cc968bbc5dcf6776de2d16cb62eb85aea

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG

    Filesize

    644B

    MD5

    e9f67b64d881a992b1cfd8e3530cca32

    SHA1

    2a94600e58d1d88e7ddd19419b98c58cb3202be3

    SHA256

    b1b65f3ef3b45ea3d98a19c8b1b2dcc25c54a2a5887525724434ec64d7677089

    SHA512

    0d1bf5b51368132b9bae5510227e15ff9d4c68716b2760950adef49735553f4c721067ee4867255607d492a9f756e5501ea1095dd0ed35b65aba6a7122b16635

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP

    Filesize

    12KB

    MD5

    f35117734829b05cfceaa7e39b2b61fb

    SHA1

    342ae5f530dce669fedaca053bd15b47e755adc2

    SHA256

    9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3

    SHA512

    1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP

    Filesize

    12KB

    MD5

    f5d6a81635291e408332cc01c565068f

    SHA1

    72fa5c8111e95cc7c5e97a09d1376f0619be111b

    SHA256

    4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26

    SHA512

    33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

    Filesize

    475B

    MD5

    ff54bcac65743e803865f43f041284b2

    SHA1

    4ab743a7d2a0a9a5237c1d503f134339e4d31f7a

    SHA256

    c0506574d1b5b01f7906fd8c6baf99e9631f6a204d1ab5b8c5bd8f6bbd907743

    SHA512

    3b21c743ffdec316597c143cd293bb98fb58da911ba9af5c1df8e602082b75b131ec3d8bb3b07d89bbe589f3e062fbe1bb70e57176ee1de10bfc5f30b76f63c6

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.PNG

    Filesize

    368B

    MD5

    9a922807c184a7f18f808735ac851f3b

    SHA1

    142c5e76464e31ce99795f0126e284c25d11040c

    SHA256

    a576357ae47d4bb1aa07fb6a503c1f88e55467c97275e85f48792c0351f7e408

    SHA512

    38f2c9c5881ba07fccebcef28c5a7b75b72fea8d30e7049b62142868c803be6e01409d8bd6e371c5bb6188eef505e268274894a9a8ebd65053f35f8d53f1ed3a

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG

    Filesize

    438B

    MD5

    121558ff4a60cbdd63a2c563f64e3a8d

    SHA1

    c5a58189193a6dd14ecea5e8f9abfa534182afab

    SHA256

    57e4e472dd3e5a8d82a63b607d79e9d96ed42c69bca5d3f9aa4b1a338ff7318c

    SHA512

    36b2366bd1fa8597c20ff43b041c5dc1c62183ba536dea31ca1125cc1f99ff1dcb7e907959d6f0672e57ed82be585615ceaa6b963a8b5e540510d329c610a267

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    325KB

    MD5

    c333af59fa9f0b12d1cd9f6bba111e3a

    SHA1

    66ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0

    SHA256

    fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34

    SHA512

    2f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

    Filesize

    136KB

    MD5

    1ffd93751bc3400074dc0affa49ddfaf

    SHA1

    81be618514bdb88161333386f326cfcac2075517

    SHA256

    e65cc17886b8632c1ff12ff8a97128d3ca379a6b9ad2c0300788f43958c458be

    SHA512

    b2aefcf3a2f3e4da57c3507f7b419d229985cee88c782232dd90a96a6e9dbe46c18a7a58c7c4d1a3fe4b8b4b187f884fa09ac9e9a70d179e941704d7cbfddb30

  • C:\Users\Admin\AppData\Local\Temp\jds259456151.tmp\jre-windows.exe

    Filesize

    64.0MB

    MD5

    96d622d62567def49ad8999324a66709

    SHA1

    5a4749631631d97e9db816f5cca2392e69d0b7d9

    SHA256

    953b06705f72bfffac774c41ceb359fe1d3f8a0c5d6a44f93597ce9c39399994

    SHA512

    c2d350895f47c5164138d2e3befbeb0acda8097a7904a28d9ad9db70ea0aabb3ec54a476dcb2746a41308fb79616d810305c53f7e23a4856a3f9eb656896de0d

  • C:\Users\Admin\AppData\Local\Temp\jusched.log

    Filesize

    3KB

    MD5

    00dde3afc7ffa0f1d5eb6dd444f5f5b3

    SHA1

    ab4f56ebf4ee2f1547f01dd5cce1a859be51598e

    SHA256

    4bbf67cf699fa676c40eebd778c5ce40d8859ec9b6f98cbb95e5b7923ad00c58

    SHA512

    0accd44f89b2e6d2f9102068475968634ab18c6daeb270af4823ee5e706fe9978471c8c801fc2ef9f2894aad994db3aab9c960fcf58607a6ac418e4f7840ff5a

  • C:\Users\Admin\AppData\Local\Temp\jusched.log

    Filesize

    4KB

    MD5

    d54a9e2aa7e61bb444ec62a7aae8df56

    SHA1

    5d964c16f212fcea071f14bd04c209b3f9bd7d94

    SHA256

    b17406f42e53e74132daaee044a8a1def30c5d59e6c0c961b4b31208f0ad0625

    SHA512

    e5cc661f5ae1f786b531f81c94695dbac46d02b532487ef7d25317659de15ea2b32f94cdc33a8d8d1c4f30d1b11456a929141ea7ab048c31c80fd051025d8a17

  • C:\Users\Admin\AppData\Local\Temp\jusched.log

    Filesize

    24KB

    MD5

    2a95b96aa54133ce47328ea9408d5f88

    SHA1

    b7a938a4fa6d9b12bd58b13087500e0cc13578ee

    SHA256

    37b1583adce4a749dd79d7a0d3a4c7083dbf30806b2e0ea2a8f1e172cff8a054

    SHA512

    7a453b36a8e59e85256b392723029b65ab4f29a0a7a319f5eb1a9731c27f6dd7d278ba125af0bfab819024598a33b8e40d22ad891887d58f62b6c446ce026636

  • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

    Filesize

    741B

    MD5

    390e3528cc96e591b57b8e3d367fb329

    SHA1

    dced322bbc44700fe664d645fc9824624a3160be

    SHA256

    6695dfad09c47dc004be8cd16e6dfe5ef8239b36f7f3df2b1631917b8afbed20

    SHA512

    0dd831a5c273caa286deb34c10865867e00e723d5b556ee7d60d50466838ef9540c125ded5d3f09f23c3f2328dacd0ea795c3de90f0b596989dd0306a9e3c394

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    9.1MB

    MD5

    4f7fa4dee62924a4fd3b726cc150c256

    SHA1

    684319e7c90f8101980c88e9b327eaf3e00c3aa1

    SHA256

    16ee6b2cb0ad4b9e862bc8511dc916c6fcfa3e1898e4f8d96ee3ce98a1e84401

    SHA512

    a3a38b96e7376d083edeef681a5eec21baee2e736547840ed6e41397f85c917e25c57d9201df9fdc9c0140a7fac4cf775d7af2d218646cd921d5b468b21a1c66

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNG

    Filesize

    206B

    MD5

    e5d58eadbf836dd10e686eebc3a5be5c

    SHA1

    d1ca91793d766019ddb08e92e8734b0dcc866c46

    SHA256

    1d55e1a2619072c43fde1846479bdf096de360fe157939569965e75bebd1a4b2

    SHA512

    c52187077ef449bcd85424cd629390752998e4fc492dbe22ad3a9ec1b757e68d2901d491dffdfaed1269f8c8022adafa3987c4c2b55428262d0dc9052b6ce60d

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG13.PNG

    Filesize

    41KB

    MD5

    44b7f88f828cb198ef4d3bb74c491da9

    SHA1

    e152b950eae01d9f8a3255bfc1576f63239d73ea

    SHA256

    4f0d9bddf74090d9deaf5fa332e93ce98ab673ca9d4a7ae722a8641bfb572c2f

    SHA512

    9d97e8d8e93112f93d21428fbb8170d699973bcb28604b49541c0f20d6b0b803fcc9bb4ce0c55f03912675c08963d33490c0dabc9bba9524f2d6bc224e95ec78

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

    Filesize

    4KB

    MD5

    196566efa6012836eb7dbff1b8cfd199

    SHA1

    749c62d50665e5a4c4e857c4cd977d364d19f5bd

    SHA256

    5aaba6de85eae4e9d6b0cae21133d44a8a78318439b672a1d3077b7eeff58fd0

    SHA512

    993bbf9937b85724863fdc09cf1277611d22b9ab789e52d431790917992b2f7e921cf3bb3d7c0508f7116c43ed091e8f6af748dc8f1b1e9b6244e722277d4c3d

  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

    Filesize

    18KB

    MD5

    28491631d1231ae19400403b5c0b94ea

    SHA1

    a82a23096907f4816bd70a0317329fdf5d31af24

    SHA256

    7f411676c07c5c4a5ca8cfde36f0313d2b8c3d6535b47f8391135eb7c59c4231

    SHA512

    61248d3fb8458742ca32a428af9d3ec5340192d18e74af1ff3c5d4740b518f892ac6539c9960711d8bd5f2af7e3b76d50f43bfdd6cd18b7e0305809f45fdba34

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BAORJO84.txt

    Filesize

    869B

    MD5

    5104a7536bee2dde785a36e4f635211f

    SHA1

    aae01fcc75395b5e4615449f66c4f6bd2204ce6c

    SHA256

    efe87f026539a676e64ad5b5f6ff77f79589da35d9e912eb0fec4cd95a00e468

    SHA512

    479ef4120c5c02b0ed53ed160f5542244cfb075f618b35768c2395213cbe65d9b91734a5980ccad0372c572b00a564a31eaaaf0d649d3d1c89db1d190eba2516

  • C:\Windows\Installer\MSI171F.tmp

    Filesize

    953KB

    MD5

    64a261a6056e5d2396e3eb6651134bee

    SHA1

    32a34baf051b514f12b3e3733f70e608083500f9

    SHA256

    15c1007015be7356e422050ed6fa39ba836d0dd7fbf1aa7d2b823e6754c442a0

    SHA512

    d3f95e0c8b5d76b10b61b0ef1453f8d90af90f97848cad3cb22f73878a3c48ea0132ecc300bfb79d2801500d5390e5962fb86a853695d4f661b9ea9aae6b8be8

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

    Filesize

    1.7MB

    MD5

    dabd469bae99f6f2ada08cd2dd3139c3

    SHA1

    6714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b

    SHA256

    89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606

    SHA512

    9c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

    Filesize

    97KB

    MD5

    da1d0cd400e0b6ad6415fd4d90f69666

    SHA1

    de9083d2902906cacf57259cf581b1466400b799

    SHA256

    7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

    SHA512

    f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.2MB

    MD5

    85772cc6142fd068e316f5bcdfb9fa18

    SHA1

    2b6169f71860685189abef7c46a271b43a6af36b

    SHA256

    b5e561a9e6aa55cdde55a182aa753b726dd9ce299d1734824ea4ef4f0a1775a8

    SHA512

    0f03c69813b366ee352c5fc0209fe4a7dc257230f82afdda75d97d7676ff1abf30bc09cb900ce28916e9ee07e5b9f850c4f3ec803c0d23cd572ffee928d0418d

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.2MB

    MD5

    a266e0ae1001da0023f9664afbcaee99

    SHA1

    f943c180e5221a5943039c21b21f394dd99cbe14

    SHA256

    819b9a02a788445ad6c4d8f38e05abe911e289e71e4d2c2e37923c9f66f576cf

    SHA512

    525b8473b17732ba94942df63b0e43b26ee0157b137a1a39f52034b04ce686097e92ec8d9ea422acf02edc4385863c0179a6af73af01dfcfc1cb6d7c9dad1e7c

  • \Users\Admin\AppData\Local\Temp\jre-windows.exe

    Filesize

    64.4MB

    MD5

    af1d24091758f1e02d51dc5f5297c932

    SHA1

    dc3f98dded6c1f1e363db6752c512e01ac9433f3

    SHA256

    e52a8d0337bae656b01cb76c03975ac3d75ac4984c028ba2a6531396dea6dddd

    SHA512

    8d4264a6b17f7bbfd533b11ec30d7754a960a9f2fbef10c9977b620051c5538d8eb6080ea78e070904c7c52a6ce998736fad2037f6389ad4c5c0ce3f1d09e756

  • memory/1736-2365-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1736-2367-0x0000000002620000-0x0000000003620000-memory.dmp

    Filesize

    16.0MB

  • memory/1748-2351-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2084-2343-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2084-2331-0x0000000002820000-0x0000000003820000-memory.dmp

    Filesize

    16.0MB

  • memory/2548-715-0x0000000003480000-0x0000000003869000-memory.dmp

    Filesize

    3.9MB

  • memory/2548-14-0x0000000003480000-0x0000000003869000-memory.dmp

    Filesize

    3.9MB

  • memory/2548-18-0x0000000003480000-0x0000000003869000-memory.dmp

    Filesize

    3.9MB

  • memory/2548-21-0x0000000003480000-0x0000000003869000-memory.dmp

    Filesize

    3.9MB

  • memory/2616-775-0x0000000003220000-0x0000000003609000-memory.dmp

    Filesize

    3.9MB

  • memory/2616-785-0x0000000003220000-0x0000000003609000-memory.dmp

    Filesize

    3.9MB

  • memory/2616-784-0x0000000003220000-0x0000000003609000-memory.dmp

    Filesize

    3.9MB

  • memory/2616-795-0x0000000003220000-0x0000000003609000-memory.dmp

    Filesize

    3.9MB

  • memory/2628-2168-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2628-2167-0x00000000027A0000-0x00000000037A0000-memory.dmp

    Filesize

    16.0MB

  • memory/2660-788-0x0000000000CE0000-0x00000000010C9000-memory.dmp

    Filesize

    3.9MB

  • memory/2660-852-0x0000000000CE0000-0x00000000010C9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-853-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-603-0x0000000000830000-0x0000000000833000-memory.dmp

    Filesize

    12KB

  • memory/2856-602-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/2856-684-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-1439-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/2856-1938-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-1438-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-1436-0x0000000003150000-0x0000000003160000-memory.dmp

    Filesize

    64KB

  • memory/2856-19-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-685-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/2856-1396-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-2326-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-716-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-717-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-742-0x0000000003150000-0x0000000003160000-memory.dmp

    Filesize

    64KB

  • memory/2856-2360-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/2856-718-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/2856-731-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB

  • memory/2856-2368-0x00000000008E0000-0x0000000000CC9000-memory.dmp

    Filesize

    3.9MB