Technical Information
Modifies file system
Creates the following files
- %APPDATA%\.minecraft\launcher_log.txt
- %TEMP%\minecraftlauncher\pistonstaging\b851bb89b0f46bc58ab365353d1bec2e259b661c
- %TEMP%\minecraftlauncher\pistonstaging\561da5c0985cf6240c82b6598aac5317324ef4ab
- %TEMP%\minecraftlauncher\pistonstaging\4db52e0f04c36b45b747e1797dd034dd3ba2dcbd
- %TEMP%\minecraftlauncher\pistonstaging\1b254c81e220dd53acfb68ee6b9fbf201c852bea
- %TEMP%\minecraftlauncher\pistonstaging\cef5c170303ae40a435abc8f0b1a4e1a86a8802a
- %TEMP%\minecraftlauncher\pistonstaging\afb1f3959a7c101e3dc5afc8880546e595a2242a
- %TEMP%\minecraftlauncher\pistonstaging\c12949913b12b1bbe9c8c34b9f2e97de1fe8b8bb
- %TEMP%\minecraftlauncher\pistonstaging\ddfea3d4797a034a222b006c6b93a1e6708ad068
- %TEMP%\minecraftlauncher\pistonstaging\996a5993cde3b706381da42c2400af7f415fc05e
- %TEMP%\minecraftlauncher\pistonstaging\4f2a4a6761bab92ee891bf76d0e36d280c908865
- %TEMP%\minecraftlauncher\pistonstaging\5be1134b324a0fca1caf04c80638c41fa659ce3e
- %TEMP%\minecraftlauncher\pistonstaging\4e3e95eb58c5063dbc8428a96b53062274ae9d46
- %TEMP%\minecraftlauncher\pistonstaging\1f6102217ea30046ed63351158c67cb601d119de
- %TEMP%\minecraftlauncher\pistonstaging\5465227707ea9dab5f97bd7df419c23951b28d97
- %TEMP%\minecraftlauncher\pistonstaging\f5685e3d30fb99a7e4906f3c25fcfae6fbca5faf
- %TEMP%\minecraftlauncher\pistonstaging\b3836102853fe842b7b9f357ff16f510833b6d8a
- %TEMP%\minecraftlauncher\pistonstaging\5e11c44fc0ed6fb9f3e01ef0e01002d5dc53ac97
- %TEMP%\minecraftlauncher\pistonstaging\eb2f466eaeb8edae5226a0c4468b8c8c34acf7e7
- %TEMP%\minecraftlauncher\pistonstaging\bd94282b0f4c25c26810ef240dcedb26c19a6ed5
- %TEMP%\minecraftlauncher\pistonstaging\840faec29176b60f49acbf45748def8397420b33
- %TEMP%\minecraftlauncher\pistonstaging\deca5d51e99ba536c99a07b8e3a390de3da88167
- %TEMP%\minecraftlauncher\pistonstaging\876ad9ff00780cec40b253216308d6fa9a31c4c4
- %TEMP%\minecraftlauncher\pistonstaging\8d5738d39a00608d9bc345fc6a0ace5af5fd45f0
- %TEMP%\minecraftlauncher\pistonstaging\6ab8db29e72eb47dcf826dc277896b7453d0fdef
- %TEMP%\minecraftlauncher\pistonstaging\c9a4364b7baa14e4d4bf531bad91097bfddb7fdb
- %TEMP%\minecraftlauncher\pistonstaging\db1caeddc9cecd0eff6823a25e3e9281e6a7f028
- %TEMP%\minecraftlauncher\pistonstaging\b8f516b78ef43a32cfeddaf6c4983cd28b640283
- %TEMP%\minecraftlauncher\pistonstaging\7a44b900fd78c043aba8e475c6a8ab49693a80e8
- %TEMP%\minecraftlauncher\pistonstaging\8733026bd6892956d5127d696d2042b3acb4041b
- %TEMP%\minecraftlauncher\pistonstaging\ca30fc95eb376d2bbddd869cd37eac31f93da9f2
- %TEMP%\minecraftlauncher\pistonstaging\85d6c50caecbc908d056492cee96e27a89c87793
- %TEMP%\minecraftlauncher\pistonstaging\407f39d258d61687ec53f03ffa302473860a0683
- %TEMP%\minecraftlauncher\pistonstaging\d8c12fcf56003933f57965a698c487dfc1ba1e10
- %TEMP%\minecraftlauncher\pistonstaging\b8e45c22773136f526afbe090acafdada0b49845
- %TEMP%\minecraftlauncher\pistonstaging\7bc3bba49da801289412d0222cb7b36f2556385f
- %TEMP%\minecraftlauncher\pistonstaging\e6d1b16777a6fc13e194c753a583619cc86d5f68
- %TEMP%\minecraftlauncher\pistonstaging\4ae7c81d1c840d66055ddb18fc095d507363ecb1
- %TEMP%\minecraftlauncher\pistonstaging\78f2e4caca29980b1b4c0dd86dd34b3786315d7f
- %TEMP%\minecraftlauncher\pistonstaging\fff075e2854c19fc8f1f0e88c93142d33d0840ae
- %TEMP%\minecraftlauncher\pistonstaging\264d6b2d14843f76d2af9fcfca9a7decc4a4c8d6
- %TEMP%\minecraftlauncher\pistonstaging\12eea93d4b31c1f2c709d2eb1861f5dab991bf89
- %TEMP%\minecraftlauncher\pistonstaging\36877948bd2ecdc9ae97dcd5eb9997c1d9ae45f4
- %WINDIR%\temp\tar1db0.tmp
- %WINDIR%\temp\cab1bab.tmp
- %APPDATA%\.minecraft\updatelog.txt
- <Current directory>\tools\nativeupdater.exe
- %TEMP%\minecraftlauncher\pistonstaging\d75a0594f6c7b264dd83da4666a69687cb905d9c
- <Full path to file>.tmp
- %WINDIR%\temp\cabf1ab.tmp
- %WINDIR%\temp\tardc6d.tmp
- %WINDIR%\temp\cabdc6c.tmp
- %WINDIR%\temp\tardac5.tmp
- %WINDIR%\temp\cabdac4.tmp
- %WINDIR%\temp\tarc43d.tmp
- %WINDIR%\temp\cabc43c.tmp
- %WINDIR%\temp\tarf1ac.tmp
- %TEMP%\minecraftlauncher\pistonstaging\c04152869dcfc8e16c6386888cc69c52f7097bfd
- %TEMP%\minecraftlauncher\pistonstaging\c2a62547aef6e829aaefae315b70050887485834
- %TEMP%\minecraftlauncher\pistonstaging\98be17e1d324790a5b206e1ea1cc4e64fbe21240
- %TEMP%\minecraftlauncher\pistonstaging\6c9cfd647fae47276f786068509cc5c250eb7044
- %TEMP%\minecraftlauncher\pistonstaging\0589b8aa346fb2011380fb87c510cb7cfa8250ef
- %TEMP%\minecraftlauncher\pistonstaging\bf4581543e97b39bcbe98a20e763e7eaf1f66610
- %TEMP%\minecraftlauncher\pistonstaging\81d213a961990d4d8c18f65c8170b1fcd0a046b2
- %TEMP%\minecraftlauncher\pistonstaging\af39c13f70bc9c0aa775c44eb1632d49e620d463
- %TEMP%\minecraftlauncher\pistonstaging\7dfc7c68058a6eb5cf728c09a19b23e2087322d6
- %TEMP%\minecraftlauncher\pistonstaging\319726763f9df0faa54fe37d82076ee99840fd2a
- %TEMP%\minecraftlauncher\pistonstaging\c74f6e412b85974e6452119385c955166c3a4616
- %TEMP%\minecraftlauncher\pistonstaging\6780b49a53d2fd138eddda89ff648ac6069003f7
- %TEMP%\minecraftlauncher\pistonstaging\6f94fb61351496c569605f90cfbfc65f202527b6
- %TEMP%\minecraftlauncher\pistonstaging\dbb91a14563712ee6d7b6361ead29ef43c89fe80
- %TEMP%\minecraftlauncher\pistonstaging\cb63ad72bc3c7ec261b542a5991492148ef3f65d
- %TEMP%\minecraftlauncher\pistonstaging\bfece2935ed71c3ab20da9c01694c5fe42d63b48
- %TEMP%\minecraftlauncher\pistonstaging\e5888691c9d67c3a1e6840bff34b29cd13ac006e
- %TEMP%\minecraftlauncher\pistonstaging\104c685ed52f626b2835429782db87f08dc39cf7
- %TEMP%\minecraftlauncher\pistonstaging\dbb494c8cb44a88fd072909062270558be73b39e
- %TEMP%\minecraftlauncher\pistonstaging\23610f1bd1e81a2ec308026c270adffbd2407344
- %TEMP%\minecraftlauncher\pistonstaging\b0a3c6c9ab60e2eb2bd68c10de5490978fed8321
- %TEMP%\minecraftlauncher\pistonstaging\bdb9130ddfd3efb1a26afcdfa869b30ac0069197
- %TEMP%\minecraftlauncher\pistonstaging\ab2588b9448c7bdd989b83915d10053eb678e543
Deletes the following files
- %WINDIR%\temp\cabc43c.tmp
- %WINDIR%\temp\tarc43d.tmp
- %WINDIR%\temp\cabdac4.tmp
- %WINDIR%\temp\tardac5.tmp
- %WINDIR%\temp\cabdc6c.tmp
- %WINDIR%\temp\tardc6d.tmp
- %WINDIR%\temp\cabf1ab.tmp
- %WINDIR%\temp\tarf1ac.tmp
- %WINDIR%\temp\cab1bab.tmp
- %WINDIR%\temp\tar1db0.tmp
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to <Full path to file>.backup
Deletes itself.
Network activity
Connects to
- 'la####er.mojang.com':443
TCP
HTTP GET requests
- http://x.##2.us/x.cer
- http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
- http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
- http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
UDP
- DNS ASK la#####rmeta.mojang.com
- DNS ASK x.##2.us
- DNS ASK la####er.mojang.com
- DNS ASK se##ry.io
- DNS ASK o.##2.us
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK oc##.####ca1.amazontrust.com
Miscellaneous
Creates and executes the following
- '<Current directory>\tools\nativeupdater.exe' <File name>.exe <File name>.exe.tmp --nativeLauncherVersion 771 --nativeLauncherVersion 771
- '<Full path to file>' --nativeLauncherVersion 771 --nativeLauncherVersion 771
