0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227

Analysis

user interaction
yes
max time kernel
165s
max time network
171s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TLauncher-Installer-1.9.5.1.exe
Size 25.5MB
Sample260807-ts4rdszbpf
SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
MD5 de90bdf89be7e8f55b9ea1e9f0a88613
SHA1 ea25984a475c95ad41abae25885db7b24514a7af
SHA512 42f6cc77ea8cd43d167236e81e4164da7c8030605d7d1759494f41f5b9b5dcdbaec3b4d901f1925f13d915756b52ec22927e1dc304e89fb7f9342b84c475d188
SSDEEP 786432:ytpZzp8Q6W10rrKJBH5lFRqJkkt9O2B4Bi5e:ytpTTuPKJBZlC39ORb
TLSH
T1014733357AA29072D772363496996339F77EAD70AB3802D322903D3C7E716C15A7C21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
248	irsetup.exe
3984	BrowserInstaller.exe
2128	irsetup.exe
4308	TLauncher.exe

Loads dropped DLL 4 IoCs

pid	Process
248	irsetup.exe
248	irsetup.exe
248	irsetup.exe
2128	irsetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 3 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
6104	GameBarPresenceWriter.exe
4548	GameBarPresenceWriter.exe
1740	GameBarPresenceWriter.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5f5-5.dat	upx
behavioral2/memory/248-12-0x0000000000270000-0x0000000000871000-memory.dmp	upx
behavioral2/memory/248-539-0x0000000000270000-0x0000000000871000-memory.dmp	upx
behavioral2/memory/248-560-0x0000000000270000-0x0000000000871000-memory.dmp	upx
behavioral2/memory/248-573-0x0000000000270000-0x0000000000871000-memory.dmp	upx
behavioral2/memory/248-584-0x0000000000270000-0x0000000000871000-memory.dmp	upx
behavioral2/files/0x000a00000001c7fa-603.dat	upx
behavioral2/memory/2128-621-0x0000000000FB0000-0x00000000015A7000-memory.dmp	upx
behavioral2/memory/2128-637-0x0000000000FB0000-0x00000000015A7000-memory.dmp	upx
behavioral2/memory/248-655-0x0000000000270000-0x0000000000871000-memory.dmp	upx
behavioral2/memory/248-1270-0x0000000000270000-0x0000000000871000-memory.dmp	upx
behavioral2/memory/248-1283-0x0000000000270000-0x0000000000871000-memory.dmp	upx
behavioral2/memory/248-1301-0x0000000000270000-0x0000000000871000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher-Installer-1.9.5.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{2BDA9053-7D10-4188-824D-DC320BCF0A2D}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{C757C1A2-F335-426F-B788-107F216C253B}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2128	irsetup.exe
2128	irsetup.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
248	irsetup.exe
248	irsetup.exe
248	irsetup.exe
248	irsetup.exe
2128	irsetup.exe
2128	irsetup.exe
248	irsetup.exe
3480	javaw.exe
3480	javaw.exe
2584	OpenWith.exe
3480	javaw.exe
3480	javaw.exe
3196	OpenWith.exe
828	javaw.exe
828	javaw.exe
1292	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 248	204	TLauncher-Installer-1.9.5.1.exe	90
PID 248 wrote to memory of 3984	248	irsetup.exe	92
PID 3984 wrote to memory of 2128	3984	BrowserInstaller.exe	93
PID 248 wrote to memory of 4308	248	irsetup.exe	95
PID 4308 wrote to memory of 3480	4308	TLauncher.exe	96
PID 3480 wrote to memory of 828	3480	javaw.exe	103

C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:204
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe" "__IRCT:3" "__IRTSS:26673860" "__IRSID:S-1-5-21-4046655672-1449839301-2197395821-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-4046655672-1449839301-2197395821-1000"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2128
- - C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
        
        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=windows-1252 -jar C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        5⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:828

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:6104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4132

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2040

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:1740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 3d843bd4146bd9aa77c26898632b33599a1bcf32ed1ebca9921e700973d2be86
MD5 6c13751d53c808340ca03bc1646ff5a4
SHA1 312935208f0ecbb701c3834eb54f72e7ffd055b2
SHA512 088495635e4cdef787caf47615afc25e327d3fea5102fea458ef56f3182f1dcbe21cd13aa62d08323b9d04c9c5566a4fe8864e701b725ba95cf17fbebf03b679
MD5 SHA1 SHA512

Submit Download

200.ico

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Size 116KB
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
SSDEEP 1536:5HmLYAoZllsaebGVeTZ8Sz3HjpAAAAADYmaAAGg:UfoZll0bGVmjWh
TLSH
T1C6C330260E6D3150D3992D79BEEAE3384E764D90EC6D21A314ED782AF9376EC13ED440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
Size 3.7MB
SHA256 e20f18d8c5d3621a81d35fe43d759ddb148e35d1856a94fbe95dfbec93127a10
MD5 05db02530acae561d2e4b368ccd45f52
SHA1 050101d4689ee8012bcf7eff4cdbe15a3851ecc8
SHA512 8a3e37e6d5e73fdac7f4b974dd350011b83b410b2b26b140bb53f1c497d3fea857c9ecf03e931dba53908eeada1859d4f3797f47d187d84e651b1fa42f548b37
SSDEEP 98304:DLDSCHji8v64cym9lYQre8JVal0S8R4+h8GdspyRLndhyOu9w:DHfQbVTS8R4E8GduAT89w
TLSH
T15906F12A7A72C072C6323630969DA379E6BDB8705B35829317D01E3D2E715D2993C36F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
Size 12KB
SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
MD5 3adf5e8387c828f62f12d2dd59349d63
SHA1 bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA512 e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
SSDEEP 6:BlcgEMS0gjjjjjjjjjjjjjjjjjjjjjjjjjjj/naEMh:TcNwezg
TLSH
T192423A021F61C274F2CC0CA44D58244CEF10CA5B211B02C54C75073597C06D73EFB35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
Size 45KB
SHA256 a42ab4d62c5a5286202df15f9ad32b22396d5d12c7a4db8c5a2c98f90160ade1
MD5 b1c738ebb530ef3312b3d7209d2a8079
SHA1 9884f02de44291f3217c03b02089824b7b25b55a
SHA512 f79d826d716239deb6077717dd6880236eab7a4a6639bf5de678500e6d5488b5a70938988207b8554782878ff5472e23b577db288cf273007f8778ca08b8a9fa
SSDEEP 768:FU5FNyQXHLMQk/CIEB1TGAPytWZixXgqZrPvgzfF7OBhTNj9YGhaBcROHI4QkU:+5FNyQXHQ3/xq5bytpWk7vg7FeTNuGhl
TLSH
T14523F21ABF030526AF1A1B70B91D71EA14452289FCB789888F670817B1CF9E2F64DB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG10.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG10.PNG
Size 206B
SHA256 348e3f3544cca4c9ca2af323fa8b3453a70ea421c82b331681dc1d4ef74921f3
MD5 5ad7b05326e53ab9d91b36331c3f84ea
SHA1 bea6d94e541a2380b9506df97349aed1ebb1e04a
SHA512 51dc9a6c323207e628f7494cf83451687d9a5977368d761489b48c25174edc0dcac3cea2705389001220aef8896c03c8dcb878e963545dc3cdf51f59c982847a
TLSH
T1E8D022C29B42BC3CC10FD039EAAB1250D8BA044E16638A4CA06161262310FC4C2EAE83
MD5 SHA1 SHA512 TLSH

Submit Download

IRIMG13.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG13.PNG
Size 41KB
SHA256 1708790d5496b9cc325cc0249cfa272aac3c3738188fc41eef83e8592de247ff
MD5 d157aa0e365b8a0b4a72096792813fb8
SHA1 8ce762ca86b54b91c38b22027a4a36417c3919fd
SHA512 aedcf9706ddd901d4a5bb5096daefef5506007fc96351b44521bebbe70ecd1aa8caecf1cb76d9ff461c73b32a73f577f62330a19b764b0870c0b087828c449f5
SSDEEP 768:pJGBX+j3ksnMoMVCv2YMgvXVwHAt8fTzwqYGtIoz8V0bWa2NrrCwyF:p85c3XnMbc2tgvmgtITzGzY2NrrCJ
TLSH
T1B613F1E881CF028DD7A552440AFC62863FD2DA58B2551F1EDD8A36F93DF34646C8392D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG14.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG14.PNG
Size 43KB
SHA256 6528bb11becf79c17c77a9c6624b82074b9dd6d3e932852c8fe1da22a57854aa
MD5 c1380329e781c0a64b39b7441848c380
SHA1 f038908d637389cd56c2bcd524c1f98090b194c1
SHA512 51a9dcb8955cdb7b78d3ffbf8da8ecd866d46b325b0fe8c948a2ce81302ffb11ee933ee5de2850ec92950a5a5a1b7cfe0237a3817cf5ced7029ed9bfb2464f0f
SSDEEP 768:fKdTjAjz+7WyOYqVxkwGW/wh8P97nd6alQO/IrLXjTVgqjqC:fKdfy+76zVxm8PzYeIrzVgqjV
TLSH
T1C413F210C4CD9A6703CF5E12E46538A5B8E158C0FA2DC4AC38E6DE24552E7EF5F107D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG15.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG
Size 644B
SHA256 207bd7ad2eb7f48a2a1be1253363fa120ae79e25eacbd37d6b9be52d2128bfdd
MD5 803fe72088e9684779985bb4bc92c3c7
SHA1 427d3cbcd903a8ca0090914de9df0bb25f148776
SHA512 df33b0f72d3fa7da46ecb6f3d3b0df8cb3983d5c1ed04851e24bb3e6fc68eadbf01a1ffd5d3b98a5e9f13dfcdeb6a66e3624c66ab2ecccddd582de7569fff72b
TLSH
T164F068D615D15478C20781B480C502A3DCBA1A85DDD786445180B73317D1FCDD5C236D
MD5 SHA1 SHA512 TLSH

Submit Download

IRIMG17.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG17.PNG
Size 40KB
SHA256 06fad383e3506eb1be52877bee839b833de157a2601af1c443ef1244a92f5d8f
MD5 46cbccfdcee617bb76271de3c8293da3
SHA1 ccd7bd2af1cae294803facb927b6d172e5fe8a29
SHA512 e88c47376c6d8df4d8d351df14b7c88820dbfafae24ebfdc6d6ea07afab14c7ab8c1d0394e3fe3759eea7051f67ff3005651e4ae00a3c2f7c7a020fe48765423
SSDEEP 768:PYY9Me/k8H5G7Ee6KkwtLIAKI3z9MmzYPjvdz5bnuPusRWFBFHyAoK5:FlM8ZSEe6Kk2TT36dz56PDS7H0K5
TLSH
T17A130111E6DC90A27A965C083488703B95A330C95DF57F2F9813F69440EDB0F69FBB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG2.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
Size 12KB
SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
MD5 f35117734829b05cfceaa7e39b2b61fb
SHA1 342ae5f530dce669fedaca053bd15b47e755adc2
SHA512 1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
SSDEEP 3:y9lMll2/l0uqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdC:BlcI
TLSH
T128420404113000D5D1450175007471C5751547D5D004034C30114C14451047703CC044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG3.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
Size 12KB
SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
MD5 f5d6a81635291e408332cc01c565068f
SHA1 72fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA512 33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
SSDEEP 3:y9lMll2/l0ZVTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTn:BlcSj
TLSH
T1DA42040F110103C5D1C700350C57C1C4F51F45357004035C1011CC344D10457034C044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG3.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
Size 475B
SHA256 d339d7a5fcaff72292150f3c7db87a73caa396e23224b570e053c8bb96a3a897
MD5 a32b83463a6f7cc50e6be2c85ba53ac2
SHA1 e07c81d391d9acfa5a0ccabca0cffa4bc5c6aadb
SHA512 c32d1cd6fb8d50cf373ca96df9a150494015997424de2454aabf0c090192538e5c6a1e20e1ad7d2f520b628c3bfe5b47ef79c02e18bf044101d7c25217580df0
TLSH
T1D0F0D4E9578D456CC14F4535631B5063FCA239C69A6F57454C286D1B8B59FE84031F81
MD5 SHA1 SHA512 TLSH

Submit Download

IRIMG4.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.BMP
Size 451KB
SHA256 64da5bd044908b2c3a725c5a55edec1644be498f41ea05d42a6ae8cd797f1d80
MD5 c87f44be2c13b601e3c6c2d2fe07a60a
SHA1 3518ba686c692c016dc46cc03846932f87295496
SHA512 25fd25de9188dfc3286b2acdba323cf0e7334c650e7796ac9e7f19e8a40b565a606cafd5b00039c351ccdcf40642c73914c6174d37a206ac81ca1d0d4b64df3b
SSDEEP 768:vdG5BfFYTNBwfaV6EzmQR/FQCSY+OpVbSPIFJJN:zTcySY+OpcIv
TLSH
T171A4AA965E139503E27B037BED616E21A1EBCED9E61A65A7C1C33D90E8F36EF0524043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG4.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.PNG
Size 368B
SHA256 3207283d0abc0dd36c0991b40a738247394bbc92e5696eb790a5c888a9f28106
MD5 c864e0b6888f3aa5365c1b60c71db536
SHA1 f3b86b6dda72ba5e90e5a7f0afb4553f6b9c211e
SHA512 dddd8d83f80ca045bd6fcf697e3df717a56de7cdc3bfcb44d92b889f5fa570bc0671b3fac05233e459e1fd9f9c998afcd37bc766cba544e9b0d98546f37ec21d
TLSH
T1ECE0C0CF5B54AC28D9CFB976071B0590E5725D970C67C69831A0A4B91FACE489487282
MD5 SHA1 SHA512 TLSH

Submit Download

IRIMG9.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG
Size 438B
SHA256 d16a8eaf8f979e45bacbbd8ef14afe482d74e926dff2e87e569342874ba34145
MD5 d5515147e2fd43bfcb51088cba0a2d11
SHA1 24319ae988efd59fdd883b14642bca432cffb049
SHA512 a54fb5461ede951704a1fdfd3ba0118a3e525412f1e9c41cceae17730d28ea2a6d22f1926c4eff50fd4a5e6caa4972fa085af1cc22ef47973a15763f4280ceb7
TLSH
T1F3F023C62F547AA0C50F6632DE1D8546C12364C73CF9B359DC04DB313380FC6A0461E2
MD5 SHA1 SHA512 TLSH

Submit Download

IRZip.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Size 400KB
SHA256 3a6794c90d69383bd76098992cb512ae343cb2e1a3680dd4794e49895472b429
MD5 1698da32813956674734c753b55baa08
SHA1 cf4e3a707e59cd6c6bc5b7cca659d5dd2c080638
SHA512 eeb6ad23291f9bd37f20555ae8d557bf0e448e77433c3dbb859813cb70e80f9cd4d30219083aac23f99ed780ee510f31d78aedb44a548582e690eeed58245841
SSDEEP 12288:Gwji6+ZoE2oaXKOAilmVx+igEpONKiKjZTeGV+:ViJTbaXlAUnKiKjJeGV+
TLSH
T1D2948D01B6C0C0B2D1AD253124AAA3369A7E7D205735D7C3F79CFA7A5F311D1AA2934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wow64.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Size 252KB
SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
MD5 bfa121019a2dd9f7749f6bb72570319e
SHA1 fc48a96ad45e00815060bb366fe8f31c140ecb19
SHA512 cda75a55119104b23489b1048c810e066099b13e12aade7cfc757ba91de7b6754edff2da561741a16c92aa00d7e4ea0b53f77ebea6aaca059a74847a0f5d4059
SSDEEP 3072:52E6GukcxWtnwkwNBp0AUTjQzKgvyVx9QlllMS25RpaLSDk/wY:52EcxW2kwNBp5UTsKgaQllaMLl
TLSH
T15F444B0176C4C032D27B21354877D375AA7ABD618BB48287BBDCAA7B5F705C28A37316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.8MB
SHA256 96070b2d82b6bffd54719f9753909be5f5151edbd5b37b26f50dea2e995ea430
MD5 21618eb1ebe1b4033d833eb057c3d065
SHA1 40e80d4f0d0254bebf73ceabf28d3c471f894aea
SHA512 4765b54fe15bb127f4f80777004276212ffb5fe2bad1b887eed9fca5c50d2b336805de32913c41ba7f726445a21b591e6494363b52b5333e273f3254fc927c19
SSDEEP 49152:wo5xdLZj7eHEWcSkMqQjeDlSvKjoSCpWmp8728hLFhC:woDdGgbQyDlSih/FFhC
TLSH
T1D1853381E665C38BC57C483BA8FB5D556B29AFC27311C7D20BB9BD1FB8367922C48850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
Size 395KB
SHA256 eef58c3dae331da03872b973230aa56b40e34035035cca5b468eda0c40daa819
MD5 8d18dbd14d7c233b0d1f5943226c35b7
SHA1 57de3e8d8e1f0e39244b3528310e513c7f90c5fa
SHA512 39777b070c6ea791ee5cdc1c8ad50015e9d6f6f96b2d8e02f4a80f97a7fa2c438770d5015eca5d19106cfce624b6a247de04cb4ce6baad353acbb298f0fc6aaa
SSDEEP 12288:B3yJ6pmOZCR40mbwkOMMe6uDa6H5FrCp6pFVY:IaLbwKLDTH5+6pFVY
TLSH
T14084BE41F283C0B2E6A411B996B49F774D78745A5336D0FBABE018B59E203F1777A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Size 1.7MB
SHA256 ea04ee2883ca5dcb461ea894a4e2def7d0c89f11d9f06f3bae020f6a25e7b75d
MD5 fdc583888459954430cdb445138e8690
SHA1 1557c2343eebe793dad9d71af697db9c98f7224c
SHA512 4085953bdf51b93bbce4b2cdc1ae732de7a9a6e0b523fb794722fefef9d59be5624feb99f4f73cead9a4353d3f63c5434b21b65abcd0b3915c97d1d97747f7c4
SSDEEP 24576:Xgojt8rfJLbXIpyxOjNONgc2gI0pRR9djPOZYVFR9MRsixD6Oo1e4XHbtSwye:wUqrdspyxXn5Iy9Rdb92s27OgZ
TLSH
T1B1853323E5340AFBD86C2E3251BD2482AD7EFCF2F3690C4286557B1311ABB815A9D375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.3.dll
Size 395KB
SHA256 0e43d22649d6b2ecbac9915dc6498fe1f41777dd33147d962b30dad0d5e76ab3
MD5 4eed99fd77f4ff9c252f56e153f9c9ab
SHA1 995cecfe73f719c5135461402fdfb17d79721831
SHA512 df0b514491e48e0f6103c61833f24fd0822a5b7fbaf1df9f48263bb83b1d5e5157307d0f6b7fdf3281e32886d3d8201b4a378239d2cbd31584a7c200c2b69e03
SSDEEP 12288:l3yJ6pmOZCR40mbwkOMMe6uDa6H5FrCp6pu76:MaLbwKLDTH5+6pu76
TLSH
T1F084BE41F283C0B2E6A411B996B49F774D78745A5336D0FBABE018B59E203F1777A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuparguments.ini

Path C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
Size 765B
SHA256 06cd94dbe8d8e51aad54b7171e5a9ff53a17bb64099f167eb5e5be5c1c6eabbd
MD5 457bde2e0faeb2fc63b9831ed365b4db
SHA1 0ba63b3a4383379ce3ad7eb895af45ee41d024b1
SHA512 8cfd700ac7dc55fa589a685c8d4b3d9236f47959ceb83109778c24ddcb4fb451ca26b39a73db5fb8bfabce2f613dae7878f5ecf427298e9f3bd0dccc6c2ae647
TLSH
T1120100438E4122ABCCA55791953B2D928DC8F9DEB09708E49BD7043BDEA0C19BD88466
MD5 SHA1 SHA512 TLSH

Submit Download

TLauncher.exe

Path C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
Size 9.2MB
SHA256 8cdc16a8f34f99dc85273838350ae9a9a840de8c6dda3c045c5514520842dd78
MD5 6afe8456101c71193942943f9f8db1c4
SHA1 cc2dd5b0d2a531b27b3531d4ae7b77df2d385c52
SHA512 dae1d037610e663b8a0f034e345043303bd2a15b67d0a30be3d5b3c3230f6d82d39d2622b326bb84c3c838d2b4c296d9c3b95ae3289ab266ad31048c496ed61b
SSDEEP 196608:RshNVPPzMDzdatp5ahrePa+52Pk6ptJT:RshN6Dzov5C
TLSH
T189A6F15BFED8C069FA0794324162D067B82D4BC8D14BF19B15BC669A88B1C894F07BDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.xml

Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Size 21KB
SHA256 671f5a46f2b8b81a116492aacf340aa0f372bb4549652a5614d614ab076097f5
MD5 74c471f30f25983979ab45cfe348c111
SHA1 94a9eecc56d84454f43a30d2ab2b7303c5a83069
SHA512 b7ada8362ee7157f0dcd6d14a2364ea086c4e8e7b9042153deda5d4103f884714f8082fadd5b8de608c5431959c5776223cecdbb2bfc2e351d48bc8d077a043f
SSDEEP 96:kTftHJEjjzVFHQjJVFHQjOVFHQjYVFHKKFgLN83WJojSFvUep0/Sdj496/XMBWrG:eGVFH2VFH1VFHBVFHjsuop3pUJWKCyd
TLSH
T123A2EA3C81DCDF3EEC93B37B4666546E65B1890C3ED22C59D2E8944F548460CBAB39E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.xml

Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
Size 4KB
SHA256 a9bf205c6855ad4c89c1962647932302c7f74376fdd35710325a21e5edb91d55
MD5 0563da3b9bda5b2e497f816dbd2493ee
SHA1 283197c0a227c8b0871f800642dd8745812c80db
SHA512 ace1e538d4320d65d2f259b8b18dc411f07988229f4207db03afe632cb240fb96e65c485fe0c775b985d8779eb1f09ac4cf8a09fada8b08b86d3f02056606f3c
SSDEEP 96:kTf6JEjjzVFHQjJVFHQjOVFHQjYVFHKKFgLN83WJojSFvUep0/Sdj496/XMBWrAr:eZVFH2VFH1VFHBVFHl
TLSH
T10E91163884DCCF5EED62BB770272503EAAA085483EC73C58C6D9948F518945CBAB35E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.2026-08-07_17.log

Path C:\Users\Admin\AppData\Roaming\.tlauncher\logs\starter\log.2026-08-07_17.log
Size 2KB
SHA256 4b5c9f342d3dd86845aac572acaf14c5f3dc6314e60e770ffa79ac87937848fe
MD5 3d90a4049a6d9162e8366450f4565f89
SHA1 91972a05ddc7962852e6491c58160f73dd7e59a7
SHA512 f0e52293fee199cfa369789acaaa4202d2221f3124e377208f23cf41aa9e15e7593dba6f37d9d3a683043b74be121d80a6cd83521bba60709a58988f57a1366f
TLSH
T1155173AAE4D76027D181E78F623BB498EF22094007C0A9B131925E55A89C15FAC9F7BD
MD5 SHA1 SHA512 TLSH

Submit Download

dependencies.json

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9371\dependencies.json
Size 25KB
SHA256 234df7a7768bb58ddfc7d35eb0f44ab0b2c9400f4dc956fa51bfbf776bb3c86a
MD5 e4a183b75e931f0fbc9e5453d4803f83
SHA1 e705e70c7073db8d35903bd2b971c6f6b90bf01a
SHA512 4604f4c1f203af0fafdf5a6250d38ebdb73261c004f3d9804c5a46538bf5b2fb445d5beb5b57ef1eeb5806f770ed8b9d68f37766ef5b51244eaa6e5034451410
SSDEEP 192:KdQH98GaeUo6fO9ext0M8zSa9P3VEpuE+xy9aSXH3If2xjp8GMkhV8U75wzSrJ7X:HkUqW6InYnzgS7p
TLSH
T1C5C2CE61C5A06FB3442AA9F8CC6F81A35382694B4C5C3D597B4C004CDF2E58F15BAAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.json

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9371\resources.json
Size 17KB
SHA256 44c898c6684ab882a034f02cf8193c3777adea8bb009749c05697a00bf8ee2e4
MD5 5baa6743a3af863900efdad825311d11
SHA1 5739b79dcc38a5ea085f84b6327d2eac833e0671
SHA512 75f02a888452ca386208e7ad5cad499813a67a79ab91f63432ef9854fb382d08b9502d17ee992d9c547611f18c26e5fe882fbefc1d2f85a1ebe47af04ef7b64b
SSDEEP 192:ZBYMTImi7/cGRhVJpGNVoC8vLPhwGBhRaAldNGrv2BxoaEbFTnhPLElnzDxBNC8c:bjitAvgldKH
TLSH
T1F082CE26E0B06EB70045A9B54C5B4083A69A558B0D74BD15F32C02CCAFAE95F18F79FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appConfig.json

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
Size 4KB
SHA256 ae102a86f96ea31bcbe9e7110c7a8d6a067e02107aefa0dca3244c8ecc5cc86c
MD5 1e2bad725da4adf172c04311d9d19df1
SHA1 550361c7f05a5996f9cf4be89f73aab3073810b9
SHA512 627f77e297f1eee8fab400d6a6091bbbbab884576c1bd3cc5a5b5b52190ad97ff11d01b4cd87d292b1f3f67274f9bb3ebb7a987d40489d157921e7d69ff119ee
SSDEEP 96:IkcQphTOzcC3pjeER8+VS8TEZ/ZGcZJ2c7+5cJT12cx:I+phTOzcC3pjeER8+9gxEcmcC5cd12cx
TLSH
T15A91CB7BC1801EE5270317ADCCB989ABB592411B0D887838BB6D005C7F5F16F2DE459D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaConfig21.json

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig21.json
Size 3KB
SHA256 4e677c3608065a9a12f97bededc27fd440711f94288012207645df37f516d699
MD5 1c4e5f5f435bae981cfad5a1124e1140
SHA1 0eb17ad37343c07b31f5f75f829e10a161c25852
SHA512 82c25097e25649f82d4fe735d324639e12397df147185d53947a3ff204aa8d1c7ce5bf1bb994442aa2c5bb904110a14a53b0640b797bc665ba4a635b79595d57
TLSH
T18B710B0AD8511FEA250227FDC82D51E7B692404B8DA47C3CB76C610C9F2F2AD79E5ADC
MD5 SHA1 SHA512 TLSH

Submit Download

starter-core-1.268-v6.exe

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\update\lch\starter-core-1.268-v6.exe
Size 9.2MB
SHA256 f0cb809918c2bf85a8eef2bcbd35218e75426b4e5698ca1cca50acf3e5a714ce
MD5 945b2a20000dcf96c356b15a1ca00abc
SHA1 c770f518ac82dfa316c3293722db36db2e81ddb8
SHA512 c20f5a7f841eb5055f970746cabcfcfd932f67563ec280f19a53a2b7cae0a310531df414f25bb1e8a5a640150d814771ee54e18a42b55586d523f9cb250bc23c
SSDEEP 196608:FmdhNVEixzMDz7ntpRvb1tPa+52Pk6ptJTh:FmdhNii6DzTT5Cj
TLSH
T146A6F15BBED8D06AF607D4324162D067B82D4BC8D14BF19B15BC269A88B1C894F07BDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO
Size 51B
SHA256 0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
MD5 494903d6add168a732e73d7b0ba059a0
SHA1 f85c0fd9f8b04c4de25d85de56d4db11881e08ca
SHA512 b6e0968c9fd9464623bfa595bf47faf8f6bc1c55b09a415724c709ef8a3bcf8a954079cce1e0e6c91d34c607da2cecc2a6454d08c370a618fb9a4d7d9a078b24
TLSH
T11F90021DE52145811A54853159204DA4542081F68716582AE17D2141514094B64AECA0
MD5 SHA1 SHA512 TLSH

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION
Size 46B
SHA256 a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
MD5 c62a00c3520dc7970a526025a5977c34
SHA1 f81a2bcb42ccbf898d92f59a4dc4b63fef6c2848
SHA512 60907d1910b6999b8210b450c6695b7cc35a0c50c25d6569cf8bb975a5967ca4e53f0985bee474b20379df88bb0891068347ecf3e9c42900ed19a1dcbc2d56ec
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\legal\javafx.web\LICENSE
Size 35B
SHA256 01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
MD5 f815ea85f3b4676874e42320d4b8cfd7
SHA1 3a2ddf103552fefe391f67263b393509eee3e807
SHA512 ddf09f482536966ac17313179552a5efc1b230fa5f270ebde5df6adebf07ee911b9ef433dfbfcb4e5236922da390f44e355709ecaf390c741648dd2a17084950
MD5 SHA1 SHA512

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_9bc48744-1687-4154-8431-50ad0ec4c3a7

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4046655672-1449839301-2197395821-1000\83aa4cc77f591dfc2374580bbd95f6ba_9bc48744-1687-4154-8431-50ad0ec4c3a7
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

TLauncher.lnk

Path C:\Users\Public\Desktop\TLauncher.lnk
Size 1KB
SHA256 d6316ff70d31216d63512ea6124826b38ab48a16c99b1e3ba2cf79308b2c663a
MD5 6cc280b184d872b6ea37dcfd8ecb6965
SHA1 91f9392cd2674a7ae8255d3a13459f95acbf294e
SHA512 4d02d21988efcbd1775355c421af6dcfbf406d5c3765c5233c229404922df1ad24874d44eeb7e26cf5b2ed29bedf326683bb73731a0229716479fc51ddb0b001
TLSH
T13A41D02027DE2B85F3FB56BB17B71161A736FC606A15A21D1440A28A1572E059E14B32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/248-12-0x0000000000270000-0x0000000000871000-memory.dmp

Download

memory/248-573-0x0000000000270000-0x0000000000871000-memory.dmp

Download

memory/248-655-0x0000000000270000-0x0000000000871000-memory.dmp

Download

memory/248-1301-0x0000000000270000-0x0000000000871000-memory.dmp

Download

memory/248-539-0x0000000000270000-0x0000000000871000-memory.dmp

Download

memory/248-1283-0x0000000000270000-0x0000000000871000-memory.dmp

Download

memory/248-1270-0x0000000000270000-0x0000000000871000-memory.dmp

Download

memory/248-584-0x0000000000270000-0x0000000000871000-memory.dmp

Download

memory/248-560-0x0000000000270000-0x0000000000871000-memory.dmp

Download

memory/828-1793-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1869-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-2141-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-2114-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-2042-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-2018-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1981-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1971-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1936-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1910-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1872-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1865-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1830-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1826-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1819-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1814-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1646-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1647-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1811-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1810-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1693-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1707-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1721-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1720-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1731-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1736-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1741-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1776-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1783-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/828-1807-0x0000021A6D930000-0x0000021A6D931000-memory.dmp

Download

memory/2128-637-0x0000000000FB0000-0x00000000015A7000-memory.dmp

Download

memory/2128-621-0x0000000000FB0000-0x00000000015A7000-memory.dmp

Download

memory/3480-1414-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1308-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1633-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1415-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1631-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1627-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1391-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1382-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1372-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1365-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1630-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1440-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1413-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1419-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1507-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1551-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1545-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1509-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1557-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1492-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1434-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1354-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1587-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1432-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/3480-1426-0x000001E6CF000000-0x000001E6CF001000-memory.dmp

Download

memory/4308-1296-0x0000000000400000-0x0000000000420000-memory.dmp

Download