Analysis

  • max time kernel
    124s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-02-2023 22:06

General

  • Target

    TLauncher-2.871-Installer-1.0.6-global.exe

  • Size

    23.6MB

  • MD5

    7a4472a78d0651e11d20aa08e43cc045

  • SHA1

    aab1d5f80d7399ae2c1982201733be7681d100b1

  • SHA256

    318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

  • SHA512

    c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

  • SSDEEP

    393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-2891029575-1462575-1165213807-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4760
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-2891029575-1462575-1165213807-1000"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2476
          • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
            "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --silent --allusers=0
            5⤵
            • Executes dropped EXE
            PID:392
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x348,0x34c,0x350,0x324,0x354,0x7260e428,0x7260e438,0x7260e444
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2156
            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera-installer-bro.exe" --version
              6⤵
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4540
            • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
              "C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=392 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230202230910" --session-guid=b64821df-7e3a-40ef-a48d-651a73263640 --server-tracking-blob=NWVmMTc3MDk0ZDMxYjkzM2M2NDRkNjVlMzZmM2YwNDlmZDkyMGQwZDljZTcwN2NiYzQxY2YzOTRmMjY2ZTA3ZDp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU1TVEwmdXRtX2NhbXBhaWduPU9wZXJhRGVza3RvcCIsInRpbWVzdGFtcCI6IjE2NzUzNzU3NTEuODg2MyIsInVzZXJhZ2VudCI6IlNldHVwIEZhY3RvcnkgOS4wIiwidXRtIjp7ImNhbXBhaWduIjoiT3BlcmFEZXNrdG9wIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiTVNUTCJ9LCJ1dWlkIjoiOWFiNWM1ZTAtZjVkMC00MWMxLWJjNTAtZDNiNDBiM2ExMmIwIn0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B405000000000000
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2636
              • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe
                C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=95.0.4635.25 --initial-client-data=0x354,0x358,0x35c,0x31c,0x360,0x71cae428,0x71cae438,0x71cae444
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:4400
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:4244

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302022309100972156.dll

    Filesize

    4.6MB

    MD5

    914ec7fb3d69e977440248ef30323636

    SHA1

    2aa31e599769f34d0cb6e979947ca5728db9b009

    SHA256

    528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203

    SHA512

    ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302022309104874540.dll

    Filesize

    4.6MB

    MD5

    914ec7fb3d69e977440248ef30323636

    SHA1

    2aa31e599769f34d0cb6e979947ca5728db9b009

    SHA256

    528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203

    SHA512

    ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302022309111442636.dll

    Filesize

    4.6MB

    MD5

    914ec7fb3d69e977440248ef30323636

    SHA1

    2aa31e599769f34d0cb6e979947ca5728db9b009

    SHA256

    528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203

    SHA512

    ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2302022309114254400.dll

    Filesize

    4.6MB

    MD5

    914ec7fb3d69e977440248ef30323636

    SHA1

    2aa31e599769f34d0cb6e979947ca5728db9b009

    SHA256

    528117e7c698fbe7ad3036aef77f99ab8af74316def7a4ba60f738c40168c203

    SHA512

    ff62901ffe79bbc8ffe6cce3efc8f13e71f13a41772b8d0180614b6ba80d5b9db1094a97cf3d239057dca2efdd7b0adc217f3ddce5111267c50ec9d0d1125b3a

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    aa4de04ccc16b74a4c2301da8d621ec1

    SHA1

    d05c6d8200f6e6b1283df82d24d687adc47d9664

    SHA256

    e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

    SHA512

    28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

    Filesize

    1.8MB

    MD5

    aa4de04ccc16b74a4c2301da8d621ec1

    SHA1

    d05c6d8200f6e6b1283df82d24d687adc47d9664

    SHA256

    e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

    SHA512

    28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

    Filesize

    1.7MB

    MD5

    1bbf5dd0b6ca80e4c7c77495c3f33083

    SHA1

    e0520037e60eb641ec04d1e814394c9da0a6a862

    SHA256

    bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

    SHA512

    97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

    Filesize

    97KB

    MD5

    da1d0cd400e0b6ad6415fd4d90f69666

    SHA1

    de9083d2902906cacf57259cf581b1466400b799

    SHA256

    7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

    SHA512

    f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    7e08af319c9eb3297e09ca7bb8387de4

    SHA1

    4cf091f77a3eb9437ef33985e64bd10c1257284f

    SHA256

    6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

    SHA512

    bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    7e08af319c9eb3297e09ca7bb8387de4

    SHA1

    4cf091f77a3eb9437ef33985e64bd10c1257284f

    SHA256

    6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

    SHA512

    bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e801c5847f5f9d207db53aaaf5c6f3a2

    SHA1

    8e6818ce66555e2cca92e5c5f32551fb4a91645e

    SHA256

    196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

    SHA512

    303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

    Filesize

    1.3MB

    MD5

    e801c5847f5f9d207db53aaaf5c6f3a2

    SHA1

    8e6818ce66555e2cca92e5c5f32551fb4a91645e

    SHA256

    196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

    SHA512

    303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

    Filesize

    326KB

    MD5

    80d93d38badecdd2b134fe4699721223

    SHA1

    e829e58091bae93bc64e0c6f9f0bac999cfda23d

    SHA256

    c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

    SHA512

    9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    d5cf08f844f5639d607ef02a2d1111bc

    SHA1

    1591c0a8926441c97c59d9b2e196da0bf276f5ab

    SHA256

    1a2ac2b68f80908627504d6bfde98ffdd9da91a29fc46cde18d4213a926bbf99

    SHA512

    0ee610a7b23fbdabf0c7125544e2aad165b219f21f1b79fb6c7f0e4626f42f9e34c193cb73b5e39ed807b23101310ac6f10e91d94d04b9fd80d789f5a0fe6233

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    d5cf08f844f5639d607ef02a2d1111bc

    SHA1

    1591c0a8926441c97c59d9b2e196da0bf276f5ab

    SHA256

    1a2ac2b68f80908627504d6bfde98ffdd9da91a29fc46cde18d4213a926bbf99

    SHA512

    0ee610a7b23fbdabf0c7125544e2aad165b219f21f1b79fb6c7f0e4626f42f9e34c193cb73b5e39ed807b23101310ac6f10e91d94d04b9fd80d789f5a0fe6233

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    d5cf08f844f5639d607ef02a2d1111bc

    SHA1

    1591c0a8926441c97c59d9b2e196da0bf276f5ab

    SHA256

    1a2ac2b68f80908627504d6bfde98ffdd9da91a29fc46cde18d4213a926bbf99

    SHA512

    0ee610a7b23fbdabf0c7125544e2aad165b219f21f1b79fb6c7f0e4626f42f9e34c193cb73b5e39ed807b23101310ac6f10e91d94d04b9fd80d789f5a0fe6233

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    d5cf08f844f5639d607ef02a2d1111bc

    SHA1

    1591c0a8926441c97c59d9b2e196da0bf276f5ab

    SHA256

    1a2ac2b68f80908627504d6bfde98ffdd9da91a29fc46cde18d4213a926bbf99

    SHA512

    0ee610a7b23fbdabf0c7125544e2aad165b219f21f1b79fb6c7f0e4626f42f9e34c193cb73b5e39ed807b23101310ac6f10e91d94d04b9fd80d789f5a0fe6233

  • C:\Users\Admin\AppData\Local\Temp\opera-installer-bro.exe

    Filesize

    2.7MB

    MD5

    d5cf08f844f5639d607ef02a2d1111bc

    SHA1

    1591c0a8926441c97c59d9b2e196da0bf276f5ab

    SHA256

    1a2ac2b68f80908627504d6bfde98ffdd9da91a29fc46cde18d4213a926bbf99

    SHA512

    0ee610a7b23fbdabf0c7125544e2aad165b219f21f1b79fb6c7f0e4626f42f9e34c193cb73b5e39ed807b23101310ac6f10e91d94d04b9fd80d789f5a0fe6233

  • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

    Filesize

    643B

    MD5

    32872c34bd5150411ad0071795ecc4c7

    SHA1

    23d22975b7918dd8db098ad1bf0c36ed71ebb166

    SHA256

    681708cc3b67759687605271ce1bb45cf94d163bbeafd63e0f8e4059140bd997

    SHA512

    a71c19915d031f30972e4cee9cc6e147e2c3d269e3f48fa132c06eda45ac375f4eb5f30c8621889fc6b10a751ef31363af1c25ce5baf61b3334c48928f6ba06e

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

    Filesize

    5.2MB

    MD5

    58e22c0ee91280156cdaadacac7acddb

    SHA1

    189c552c94a9b0ae0208763bca77f2801debc224

    SHA256

    765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

    SHA512

    9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar

    Filesize

    4KB

    MD5

    04177054e180d09e3998808efa0401c7

    SHA1

    0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8

    SHA256

    0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08

    SHA512

    3f44a932d8c00cfeee2eb057bcd7c301a2d029063e0a916e1e20b3aec4877d19d67a2fd8aaf58fa2d5a00133d1602128a7f50912ffb6cabc7b0fdc7fbda3f8a1

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\github\junrar\junrar\0.7\junrar-0.7.jar

    Filesize

    151KB

    MD5

    75a215b9e921044cd2c88e73f6cb9745

    SHA1

    18cc717b85af0b12ba922abf415c2ff4716f8219

    SHA256

    7c764fa1af319b98ff452189ab31bb722ea74ed7a52b17b0c6282249c10a61fc

    SHA512

    1a44af2f3f8dbfbf38ad5f71ef11b32d5822d734f77af2cdea419fb6af845e894acb60bffbcebb4533068d86b55a22a8b0f74be20b204c2343bdb165d9c787f9

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\guava\guava\19.0\guava-19.0.jar

    Filesize

    2.2MB

    MD5

    43bfc49bdc7324f6daaa60c1ee9f3972

    SHA1

    6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9

    SHA256

    58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4

    SHA512

    834f2bf4a5b35edffde0263409649aeaf34ca9a742ba511a06bb9b01626f9e774d2d3c8ba91a7905929dc8cd5e6471de29f7d0ab10260ece2af709b7fdbe4bc3

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\extentions\guice-assistedinject\4.1.0\guice-assistedinject-4.1.0.jar

    Filesize

    41KB

    MD5

    65912196b6e91f2ceb933001c1fb5c94

    SHA1

    af799dd7e23e6fe8c988da12314582072b07edcb

    SHA256

    663728123fb9a6b79ea39ae289e5d56b4113e1b8e9413eb792f91e53a6dd5868

    SHA512

    60b15182130ddfd801dd0438058d641dd5ba9122f2d1e081eb63f5e2c12fff0271d9d47c58925be0be8267ed22ae893ea9d1b251faba17dc1d2552b5d93056de

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar

    Filesize

    658KB

    MD5

    41f66d1d4d250efebde3bbf8b2d55dfa

    SHA1

    eeb69005da379a10071aa4948c48d89250febb07

    SHA256

    9b9df27a5b8c7864112b4137fd92b36c3f1395bfe57be42fedf2f520ead1a93e

    SHA512

    109a1595668293b32376e885ad59e0e4c0e088ea00f58119f0f7d0d2055f03eb93a9f92d974b6dbd56ef721792ac03c889d9add3a2850aa7ccd732c2682d17ef

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\dnsjava\dnsjava\2.1.8\dnsjava-2.1.8.jar

    Filesize

    307KB

    MD5

    540f330717bca9d29c8762cf6daca443

    SHA1

    eed8a2cbf56cc60d07a189a429ead3067564193c

    SHA256

    52de1ff2a7556ac2cc4284abd7123bc3d6274210fc4e3b1d9ba90efad5f6a153

    SHA512

    a4bcb8bbb43906f42faf1802c504ccc9c616e49afd5dd7db77676d13aaed79a300979ffc2195b680a9c6d5f03466b611b6f1338d824099816aa224b234760f4b

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar

    Filesize

    2KB

    MD5

    289075e48b909e9e74e6c915b3631d2e

    SHA1

    6975da39a7040257bd51d21a231b76c915872d38

    SHA256

    91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff

    SHA512

    e126b7ccf3e42fd1984a0beef1004a7269a337c202e59e04e8e2af714280d2f2d8d2ba5e6f59481b8dcd34aaf35c966a688d0b48ec7e96f102c274dc0d3b381e

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\log4j\log4j\1.2.17\log4j-1.2.17.jar

    Filesize

    478KB

    MD5

    04a41f0a068986f0f73485cf507c0f40

    SHA1

    5af35056b4d257e4b64b9e8069c0746e8b08629f

    SHA256

    1d31696445697720527091754369082a6651bd49781b6005deb94e56753406f9

    SHA512

    3f12937a69ba60d0f5e86265168d6a0d069ce20d95b99a3ace463987655e7c63053f4d7e36e32f2b53f86992b888ca477bf81253ad04c721896b397f94ee57fc

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar

    Filesize

    64KB

    MD5

    39c6476e4de3d4f90ad4ca0ddca48ec2

    SHA1

    ee9e9eaa0a35360dcfeac129ff4923215fd65904

    SHA256

    26c5856e954b5f864db76f13b86919b59c6eecf9fd930b96baa8884626baf2f5

    SHA512

    fd04c19bce810a1548b2d2eaadb915cff2cbc81a81ec5258aafc1ba329100daedc49edad1fc7b254ab892996796124283d7004b5414f662c0efa3979add9ca5f

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\commons\commons-lang3\3.4\commons-lang3-3.4.jar

    Filesize

    424KB

    MD5

    8667a442ee77e509fbe8176b94726eb2

    SHA1

    5fe28b9518e58819180a43a850fbc0dd24b7c050

    SHA256

    734c8356420cc8e30c795d64fd1fcd5d44ea9d90342a2cc3262c5158fbc6d98b

    SHA512

    b1b556692341a240f8b81f8f71b8b5c0225ccf857ce1b185e7fe6d7a9bb2a4d77823496cd6e2697a20386e7f3ba02d476a0e4ff38071367beb3090104544922d

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar

    Filesize

    30KB

    MD5

    8f7e4f1a95a870ebee87ddacc425362c

    SHA1

    300bf1846737e34b9ea10faae257ca8fdcd0616f

    SHA256

    f883b6b027d5e05c53e48e4fe3548715c52dbd590ffa3f52d039574f1a4d0728

    SHA512

    98e30ed27d6ac078450efe5e236117445c93e05eb280399e056816c52643a3a33adce5e3a885ce8488186f38d05e0fb6c65dfcbaa509be8c6047ef2f0870d9b0

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\apache\logging\log4j\log4j-core\2.14.1\log4j-core-2.14.1.jar

    Filesize

    1.7MB

    MD5

    948dda787593340a7af1a18e328b7b7f

    SHA1

    9141212b8507ab50a45525b545b39d224614528b

    SHA256

    ade7402a70667a727635d5c4c29495f4ff96f061f12539763f6f123973b465b0

    SHA512

    6e41ff42f12deedb8da06cbed73d0a9a5389660b7ee058436f8fcb6b14a6ab3105faf8e3f2c007d38ccc85af1e704505b84be5a80d8e68a434aae82b54b85f70

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\picture-bundle\3.5\picture-bundle-3.5.jar

    Filesize

    2.1MB

    MD5

    c93265b9d8bbe2b8d07f34893e5945c4

    SHA1

    ad0a3c5e104b95f842998d39c6a50f38b7bf1d03

    SHA256

    7238f234112b746de9dd96d7cafe34436c3f43a9f4ebd5659a38e5ba1b11d277

    SHA512

    0cbc136d1034ea72729cbe70e4459d015a1e4afde087f2abacb0d90603e344f828736a4c9c35e2b29e169e015ba14ddd2073694dfb789b16616275d6b89a6383

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\skin-server-API\1.0\skin-server-API-1.0.jar

    Filesize

    14KB

    MD5

    13a8e72587ac6eacfb0986f75e51eb7c

    SHA1

    6c3daf89705427f73e6106d2d4d9619e99c5ecb5

    SHA256

    1fcffa073f722737431e2699b1f3ea48b92a3b825397d8f0d1464e4d4d15a014

    SHA512

    134735390415f60d0c42ff33a060bda508e273b35fc9aab271c20ff23f331b51cf3fa36443009e0987049f6bfb22c4098a1473e65ea0349e719fbf4b528f344e

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tlauncher\tlauncher-resource\1.4\tlauncher-resource-1.4.jar

    Filesize

    3.2MB

    MD5

    acbc8aa5ba5cdddf5f1e67befe8cc597

    SHA1

    63b4bf89744b532e65c1afa3294743d2b3798f2b

    SHA256

    1f46b3a163012f9729905633b5e5e03ce385066ae43138a564729c942f9ca6b9

    SHA512

    d974a032d9af451c0dd51fbc0d64840f3e03eb502f40e4ab60d6722913b8a48d44a75752fcff60656e4d19089570a894222959745af11bcdf93ea1544192fee3

  • C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\org\tukaani\xz\1.5\xz-1.5.jar

    Filesize

    97KB

    MD5

    51050e595b308c4aec8ac314f66e18bc

    SHA1

    9c64274b7dbb65288237216e3fae7877fd3f2bee

    SHA256

    86f30fa8775fa3a62cdb39d1ed78a6019164c1058864048d42cbee244e26e840

    SHA512

    c5c130bf22f24f61b57fc0c6243e7f961ca2a8928416e8bb288aec6650c1c1c06ace4383913cd1277fc6785beb9a74458807ea7e3d6b2e09189cfaf2fb9ab7e1

  • memory/392-173-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/2156-182-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/2476-175-0x0000000000D70000-0x0000000001158000-memory.dmp

    Filesize

    3.9MB

  • memory/2476-153-0x0000000000D70000-0x0000000001158000-memory.dmp

    Filesize

    3.9MB

  • memory/2636-185-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/4244-202-0x0000000002810000-0x0000000003810000-memory.dmp

    Filesize

    16.0MB

  • memory/4244-206-0x0000000002810000-0x0000000003810000-memory.dmp

    Filesize

    16.0MB

  • memory/4244-228-0x0000000002810000-0x0000000003810000-memory.dmp

    Filesize

    16.0MB

  • memory/4244-190-0x0000000002810000-0x0000000003810000-memory.dmp

    Filesize

    16.0MB

  • memory/4244-226-0x0000000002810000-0x0000000003810000-memory.dmp

    Filesize

    16.0MB

  • memory/4244-163-0x0000000002810000-0x0000000003810000-memory.dmp

    Filesize

    16.0MB

  • memory/4400-186-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/4540-177-0x0000000000400000-0x0000000000947000-memory.dmp

    Filesize

    5.3MB

  • memory/5016-137-0x0000000000050000-0x0000000000438000-memory.dmp

    Filesize

    3.9MB

  • memory/5016-143-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB

  • memory/5016-158-0x0000000000050000-0x0000000000438000-memory.dmp

    Filesize

    3.9MB

  • memory/5016-142-0x0000000000050000-0x0000000000438000-memory.dmp

    Filesize

    3.9MB

  • memory/5016-141-0x0000000006320000-0x0000000006323000-memory.dmp

    Filesize

    12KB

  • memory/5016-140-0x0000000010000000-0x0000000010051000-memory.dmp

    Filesize

    324KB