Analysis

  • max time kernel
    1708s
  • max time network
    1652s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 11:40

General

  • Target

    KLSetup.exe

  • Size

    8.2MB

  • MD5

    7a6436629a7b09b2213589bc671d3432

  • SHA1

    c27069f89a57acea72a1346949406eb7f94cfa52

  • SHA256

    bdcd9f5eec736e493ead3ad3a6ea517e4ec3a6525819f6e3761af02828089d5f

  • SHA512

    71d60f2d4dcf1d92cf5be5eefdab7584ea4bdd9c4bea545bf47749a5b6ad7a4145e3306587447e2a243cfac24f3242a09a20309155a99a7440ec130154457f12

  • SSDEEP

    98304:pEo5z/yF0ULxVuZ6xfqGeUVSO6HVyW2iI30Ge2JW9GU5M0xZE:pt5zqF0KqlXV/luWUU666

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KLSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\KLSetup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe
      "C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe" -XX:+UseG1GC -Dfile.encoding=UTF-8 -jar "C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2752
  • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe" -version
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:1056
  • C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe" -version
      2⤵
      • Executes dropped EXE
      PID:2012
    • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe" -XX:+UseG1GC -Dfile.encoding=UTF-8 -jar "C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe"
      2⤵
      • Executes dropped EXE
      PID:932
  • C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe" -version
      2⤵
      • Executes dropped EXE
      PID:2252
    • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe" -XX:+UseG1GC -Dfile.encoding=UTF-8 -jar "C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2000

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe

          Filesize

          40KB

          MD5

          d367acd65d39ed84b2089e27587c61de

          SHA1

          2fb0a095717265a2810227c115d0d8ce1e796d39

          SHA256

          6110b7b8bcbca4a84215562f7c1d1955296c831fc694e5cee373dd4d7e30c7c3

          SHA512

          16aeec439a97cf8c7e7952264b5e1c45c9d1f84079e65d042364da404e8280b3093edb38e399a1b8b25f3517f20dcc367ba8fa5d44e81c7ab81919b58e75969e

        • C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe

          Filesize

          64KB

          MD5

          338d10e8294e227732954e95dc01bc87

          SHA1

          c3d79992be6ecdd0153026e8a85935a3434a548c

          SHA256

          ccee12dbea00d9a8b2c8334056e0e2decbe1089424eca935c82137e695caf536

          SHA512

          8bfb9f930687885e7937f12ee8a82da0599395b9e69423ca2feb35b146713788c2438a029998af616ae74b0ddd017064d1c0102268e14c2fedb91fa9b9f25c16

        • C:\Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe

          Filesize

          57KB

          MD5

          584b41d30a1d3e6c619dc1787d5dc034

          SHA1

          8a0afbe56e68974a51ea2eaed46c522ff3334f46

          SHA256

          a63ec8b60be9b4feb087c3db52ade93706477bc6de2a3923461dd3bd869d5458

          SHA512

          56a17977bcf00be613aed0a7c2ff0c06fe6a55368cd4366255a4d2d7de5c34fa75ca390255e9b0b70f242486f0bb681493f36fde5ae2db6c669dc7efff6ca24d

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-core-file-l1-2-0.dll

          Filesize

          20KB

          MD5

          b5060343583e6be3b3de33ccd40398e0

          SHA1

          5b33b8db5d6cfb0e8a5bb7f209df2c6191b02edb

          SHA256

          27878021c6d48fb669f1822821b5934f5a2904740bebb340b6849e7635490cb7

          SHA512

          86610edc05aa1b756c87160f9eefe9365e3f712c5bed18c8feca3cae12aef07ccc44c45c4be19dc8f9d337a6f6709b260c89019a5efcfe9fa0847d85ab64d282

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-core-file-l2-1-0.dll

          Filesize

          20KB

          MD5

          2e8995e2320e313545c3ddb5c71dc232

          SHA1

          45d079a704bec060a15f8eba3eab22ac5cf756c6

          SHA256

          c55eb043454ac2d460f86ea26f934ecb16bdb1d05294c168193a05090bf1c56c

          SHA512

          19adcc5dd98f30b4eebefe344e1939c93c284c802043ea3ac22654cf2e23692f868a00a482c9be1b1e88089a5031fa81a3f1165175224309828bd28ee12f2d49

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-core-localization-l1-2-0.dll

          Filesize

          3KB

          MD5

          7ab323d5ba0a7aebd4e1a1f32c48a67b

          SHA1

          bcaa969cdd4e586cce1504c28f6069067eab2853

          SHA256

          29d438a101e0d02539e1fa74795fcd34b33e889406b0e00e820ce95a9c71201e

          SHA512

          434c340e489be61f57b79aca9327fc5b7c11b23044f55ffbb3ee32a5c56ee495f14ee2386606763ec784f2e07f047c5a3467e6b1445ea13e54d88b57c067a49e

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-core-timezone-l1-1-0.dll

          Filesize

          8KB

          MD5

          32114ecd3254cedf4277f55bc7923ec2

          SHA1

          96718055008af980694da3ad9322611c1a517141

          SHA256

          8b0e285c8f8644feecafc43547f4237a40d387f22c0a982e9a1711192aab2546

          SHA512

          3eeedbae7fa2844db4de7c368b57e67a53777a256745480a6c8dcae26d371969f256ccb0b25b193616ae33420cc8f1884520b082f33c32c1fb2a2339416b9f6a

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-locale-l1-1-0.dll

          Filesize

          19KB

          MD5

          67ca19586f0a5533d311dc49d592bf91

          SHA1

          ee0ddaf936bfea9471b013f3d7c2941e5bb5f3b3

          SHA256

          592687332abcff5e2f80d765882a796e4b4b8326a85eb53723d12470e3da5b79

          SHA512

          0ef4d582306570830b2487b5a2e96fcb455c46f7025cb8bfc91af45ea0ccf8443b15e65352f2476dc75c30acf94f60bd97d5bd5e1805725b4cc3ee86129d8930

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-string-l1-1-0.dll

          Filesize

          26KB

          MD5

          aacade02d7aaf6b5eff26a0e3a11c42d

          SHA1

          93b8077b535b38fdb0b7c020d24ba280adbe80c3

          SHA256

          e71d517e6b7039437e3fc449d8ad12eeeca0d5c8ed1c500555344fd90ddc3207

          SHA512

          e02fcbcb70100f67e65903d8b1a7e6314cabfb0b14797bd6e1c92b7bcb3994a54133e35d16da0a29576145b2783221330591526f856b79a25c0575fc923985a6

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-time-l1-1-0.dll

          Filesize

          1KB

          MD5

          b32b2fa413bc1b70be8c8abecf87f13c

          SHA1

          96c15c33574a37518753cf931607473931a4df5a

          SHA256

          61243cdf2d4c8df4459db7f3bdea0f490f6e197672432a535a93eef88125fdce

          SHA512

          f5c5f7b0a70a51221fd7db5b4363698f9f473654f2ad4899eef864ca44d0b642634b87a9fa9f8268258126f425a8aa169788acbb073920be6eeb17ca136a6ab0

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-utility-l1-1-0.dll

          Filesize

          20KB

          MD5

          9b622ca5388b6400705c8f21550bae8e

          SHA1

          eb599555448bf98cdeabc2f8b10cfe9bd2181d9f

          SHA256

          af1e1b84f066ba05da20847bffd874d80a810b5407f8c6647b3ff9e8f7d37863

          SHA512

          9872f54ac744cf537826277f1c0a3fd00c5aa51f353692c1929be7bc2e3836e1a52cab2c467ba675d4052ac3116f5622755c3db8be389c179f7d460391105545

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\java.dll

          Filesize

          29KB

          MD5

          64e906eb8f6400973487253f213462fb

          SHA1

          d691bd7cce35fb217a5164d91bfd8ecd3435afc5

          SHA256

          59571132d3232c622fc710837c5ab8f25a6c713c802f0f68ada96cf237da808b

          SHA512

          24066d0d626a1ba497d80dd66595e8bbf7cacec382fb00fe7b72620bca2bf2f5a04ef7b1c91203ae077fa4454955382d8e5942b6f01a365b3a9b76b9bebf6ffd

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe

          Filesize

          31KB

          MD5

          85004d9da0dfe8e4954884df26708f9f

          SHA1

          1b8fde1c2d3a96c9140021f8f344110c87533201

          SHA256

          9c872098706be3f1dadd76465368504fe6a830114d9a8eb9d82509f72faf6368

          SHA512

          2256f34d312bcb897c43cde32c8ec9f2633f6cebfe703a0dd17257992206d45e7af09bda8ab5235993bb15da813c57ebec9e66233fbeca5df42a13c92628ac5c

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe

          Filesize

          106KB

          MD5

          8f2fd3f452177a3aab7466ec8169b950

          SHA1

          8bc23a32725335dec35546c4383151c72fac233e

          SHA256

          b9dd692da347a602fc30a782e1647ba7df9484ba0f7e3643b5b12be3b3521f29

          SHA512

          90308a3fc78db0f1239ca1d14c9eed1a2949952f88d0a419622a6e13ff5f4fc641b34f2984200a038fb169daeb49b1ea70beaa02aca8eb04ca0c4921bd080faa

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\server\jvm.dll

          Filesize

          74KB

          MD5

          c466b6a32d81752a692255c2ea864f1e

          SHA1

          a134f104f7054f41db2b2c1c8bed49679b881283

          SHA256

          7218abf49ab562a55f1bf4588c9393f0a527ad652b8da2bac66843ed9000404b

          SHA512

          3e1008e73f3090b43a9c3d306b13450d6cb9d2eb1bc6197939989c2c8ce40635c73e4511372fa6175eef62aa401076ea6e2bc376cb731bcdea62bf2f4b312db9

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\ucrtbase.DLL

          Filesize

          37KB

          MD5

          90de7538ff89d143d0b6785742b1467d

          SHA1

          3a0bbc3d789d6d5422a7ed5e277e7a0b43b89828

          SHA256

          c16c9236ad8037f449bb7f2fd2667d9f3f18e513999923c728f317bb4cf9ea6d

          SHA512

          eba256b728133d133a67d3e589ca893449183d4a637e0992c65d24ba5dc29bbd583f5e00a19488b2fb8849655524726310457116a0501c9bfc6d79fca4021b42

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\vcruntime140.dll

          Filesize

          53KB

          MD5

          68a43f4e8fc5ed962d9599b2f141f629

          SHA1

          b328bc4790522a77f0c92ee680989b2dc1f16060

          SHA256

          46ad8a17a568332455718859fe15729d5984882f6b7844df41ca14ffee9ea463

          SHA512

          510803a865471ebc6151cbd1936fb5b491d9a6cf66eb5f44e8351014281748b127a4eda410e3f913c45417982227fa8feb33fbe199290ff65a94366ee160b9fb

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\zip.dll

          Filesize

          8KB

          MD5

          b9b10efe5b0fa4af12cab22201011547

          SHA1

          44c48893596b8d51afc19aef1243dbc6e93ea8e1

          SHA256

          1c08cc324572087e979af071d04eba987a23fd13083e62742ace6a1a06860b3c

          SHA512

          b1bfe83a8e83496d262f20c5744ae6bc0d6a5e520cf026e25568492f47af2bc05552f6d5c4806f55fb9473bc8e5e4aaace825ddf8b48a671ecfa86236383bcad

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\amd64\jvm.cfg

          Filesize

          1KB

          MD5

          c60e77ff5f3887c743971e73e6f0e0b1

          SHA1

          9b0cfd38ec5b7bd5bd1c364dee2e1b452a063c02

          SHA256

          23f728cc2bf14e62d454190ea0139f159031b5bd9c3f141ca9237c4c5c96ec1d

          SHA512

          07aca3de1a03a3b64b691fd41e35e6596760baf24c4f24e86fca87d2acf3a4814b17cd9751adc2dcd0689848f3d582fb3ee01d413e3a61d1d98397d72fe545e9

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\charsets.jar

          Filesize

          7KB

          MD5

          ce748dc00a7ea66653722fb6fcc743a1

          SHA1

          dffb22c0bf727e16782ea0c8ea7cd50808bdeb47

          SHA256

          d118fbae5bde88f8fa195f4f97b6f82695d39afd9e3454439e992adb6d487057

          SHA512

          28fd4ef2342c6beb3345c4abdcc88cffb15859c519e7fb9d5ba08f4827db6377872ed7fc76bb746ae847d9ac7adb31aa19df62bfbff78c6c4bb5c576620baa33

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\ext\meta-index

          Filesize

          1KB

          MD5

          071ae8c0fced64e14493dcc7e2c2aa13

          SHA1

          87809e4bbf0a671573f4887704452fe78fc7a51c

          SHA256

          10f12969e5200b2a91612d5d6c83391793c4b8bb8391697cf6d5e912e226970c

          SHA512

          29d28417b9a69878884c38d78b8dff0af8c1eb3f7948facf54f8f77ef6836e9e03c51214b65532527d10b8a5eab5b1a10bfc025b99a8455c9af9b6fd03739f4b

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\images\cursors\win32_CopyNoDrop32x32.gif

          Filesize

          153B

          MD5

          1e9d8f133a442da6b0c74d49bc84a341

          SHA1

          259edc45b4569427e8319895a444f4295d54348f

          SHA256

          1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

          SHA512

          63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\jce.jar

          Filesize

          22KB

          MD5

          9062cf5021553b94059a31c35553bcab

          SHA1

          0fcf9a3a343aa88b04c6abf920ff16a2c7095c41

          SHA256

          5eda8de8f49b57301e7c0c53354432cf816baf4bd515f405a6f7a1934b5aa26d

          SHA512

          4bde041d1077e7c62bd46008faf67ac5ce57adcde2bb4156ae5d0ea12fef708ec5e0f023cb0f92da0ebaa0f60ca0b4355401cc6fb8e854d8a8f667e85765d5a5

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\jfr.jar

          Filesize

          29KB

          MD5

          24db2bc6698110d4845bde92d9aa9642

          SHA1

          91930acb1e77d81c7f1eef156f5ecb2c4876a7c5

          SHA256

          d5b38461bf3affb28f63e6a155c8e7ff7d77a26fec4869f99548d52d12831783

          SHA512

          73ab296dad70e5f7016f724e53b8483260800d83be1ca52f5a19e654d41be5c29a9bd1eb9f0ce072d7fd24c65b5c9c03be371bcfe03cc3a7279a64e3b4ef3b60

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\jsse.jar

          Filesize

          1KB

          MD5

          0445d883756c4b0ecc32b8fd32a5f2af

          SHA1

          d061f5acfaa645d82074095349e99dd760f7bda9

          SHA256

          2ca71b77c20af8d330cc1d186a5f2aca9593676196853b2f2d2ec1c53ab32502

          SHA512

          5ddb4b734b5bafdeeaee1dbef13a0ab8e79209aaacfe6852409ff98da26a18f549c392612074907691c0b14fe6516d3728c0a85acddf1c1297a189d473966144

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\meta-index

          Filesize

          1KB

          MD5

          eb491085541b72f5daad0cf2ef4c0535

          SHA1

          4f1f506c007f77624165e1731b46ed3554b94563

          SHA256

          42cf5c6a06d65e9ae30d0137824a275de085d8452e8d40991ab2f9b19014514a

          SHA512

          d49bb9b51b5dc24ce1fc135cc99e312303e54c3b4a43dead05a95809227868b4fef64fd98d831ea98cd170e71eb352140cab28542d7c1932b774c247aabfef9b

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\resources.jar

          Filesize

          18KB

          MD5

          17d3aea1e2cb767378db64e2384f45a4

          SHA1

          d7bf2d5baa949127f9aef09ac515df7a02e61481

          SHA256

          6f38d1fe75eb5b03c6f84322b3bfa044d1f000c7e8590fd1418ae125b2c9d49a

          SHA512

          c995fef032da7a7ea4a5576d3abb8cffb28ec4faa8d8e3d9287bafba53683ce3a502c78f64df32e65c77d0bb7a2c7adc2d51b9aef531bdaa07202d35da66053b

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\rt.jar

          Filesize

          7KB

          MD5

          369cc5bd5e07b59f19187c6a307d7416

          SHA1

          0069aa733d3cd6b2616dc23aa84e33daf44c7da2

          SHA256

          639b10008c516fe4f53705e2366494703b4e5f09a3182bd429a02bdefa42d9a3

          SHA512

          daef10b9a8ca9b76e77680a411220dfb3c329a52c017b2912f2b55ba90f0c88e661d5bfde779adbb3f5ac8ccb7ee07a94b3cca95eb0f58d8f7a2cd57a3958136

        • C:\Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\lib\security\policy\unlimited\US_export_policy.jar

          Filesize

          622B

          MD5

          5aa573a5e3d4c8bb18ee8b4abad69b7a

          SHA1

          f1cb2c17cd03d5a810c2f9f76387ced631516f98

          SHA256

          2c7f85a3f9ba39edd5badd3e300c99abbb0ac0592d4b04c5312038032acbea60

          SHA512

          459b94d1f7c2d8385df837b5b196b2b209dbf25949b033b407e72cd3ea984b0918f11e6d4bb70b979165b4508ad8e5e3ae55dbef740f04ee0b00e5247c838e9a

        • \Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe

          Filesize

          93KB

          MD5

          a10f07cf7f5656ea36f496ae9bbe7ffd

          SHA1

          251280d96c83798ca5edb82a64faefb33dd55b96

          SHA256

          785f05152b039213257a3de7637b5bceaad46cf5db528a93bd1ab1ea0c9615ef

          SHA512

          5002b378b9af20b1d020d0d6f155401326ce653f2a0f43c349dd4f64012f5387495ad4971ab2df622719b27bcf7e1ea7e526ed044bbb31807ab7277864b1cd7c

        • \Users\Admin\AppData\Roaming\.minecraft\KLauncher.exe

          Filesize

          82KB

          MD5

          25e26ed921dbe881eb075c74dec60c61

          SHA1

          0d3f976832218d3ca73a343fa71d090b02423154

          SHA256

          24c461b7e55ced2e58e3e849378b12a4130e993186486493ef729c601e255173

          SHA512

          3efd0be99d50194b788fe070b8774f01eb9ee71e23089c19b21d12834ed1e56f14b137032a3528e8f6bf5703cab086c34176fae706ac9828b3f4bd3f88a3724e

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-core-file-l1-2-0.dll

          Filesize

          13KB

          MD5

          b1837bdb7f20eda0f5caea20b8795688

          SHA1

          0b453719ba5014fee6492a8455580f820fdc58f5

          SHA256

          1480934af8e6060907bb698b454f73a77e711dc4973f66f1058ba2914868e805

          SHA512

          7b8cf1a0cf35ca02981f48298fc3ee53c3d47ed9b7e609b34d4dce95f9c0d6d6f452e910d7ede77c1daabf55f80f3bdc558476a940326667a539356545c9d6f9

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-core-file-l2-1-0.dll

          Filesize

          16KB

          MD5

          8ee530c2b06f35ca608ecc44abb3619e

          SHA1

          ec432249d5123a3a26b572ef359e6160b1b0bf29

          SHA256

          6c0a5cdaf27fe2e82cbaa257725f6397da2fbb78c9df37f273a6bd2352d8e6f5

          SHA512

          6eae36069798c1ad50c3f2ceb770acfeabaed2d638e2d128a1b6ee38b7e7434964dd40cb917164137ee86e2d4834cbeb949aecb0a96f18e169a6b1c2c995423f

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-core-localization-l1-2-0.dll

          Filesize

          22KB

          MD5

          54d2f426bc91ecf321908d133b069b20

          SHA1

          78892ea2873091f016daa87d2c0070b6c917131f

          SHA256

          646b28a20208be68439d73efa21be59e12ed0a5fe9e63e5d3057ca7b84bc6641

          SHA512

          6b1b095d5e3cc3d5909ebda4846568234b9bc43784919731dd906b6fa62aa1fdf723ac0d18bca75d74616e2c54c82d1402cc8529d75cb1d7744f91622ac4ec06

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-core-processthreads-l1-1-1.dll

          Filesize

          20KB

          MD5

          d1b3cc23127884d9eff1940f5b98e7aa

          SHA1

          d1b108e9fce8fba1c648afaad458050165502878

          SHA256

          51a73fbfa2afe5e45962031618ec347aaa0857b11f3cf273f4c218354bfe70cb

          SHA512

          ee5e0d546190e8ba9884ab887d11bb18fc71d3878983b544cd9ab80b6dd18ad65e66fe49fe0f4b92cbc51992fb1c39de091cf789159625341a03f4911b968fa2

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-core-timezone-l1-1-0.dll

          Filesize

          20KB

          MD5

          36165a5050672b7b0e04cb1f3d7b1b8f

          SHA1

          ef17c4622f41ef217a16078e8135acd4e2cf9443

          SHA256

          d7ab47157bff1b2347e7ae945517b4fc256425939ba7b6288ff85a51931568a7

          SHA512

          da360ff716bb66dd1adb5d86866b4b81b08a6fe86362fded05430f833a96934ccdada1b3081b55766a4a30c16d0d62aa1715b8839ea5c405a40d9911715dae68

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-convert-l1-1-0.dll

          Filesize

          24KB

          MD5

          0485c463cd8d2ae1cbd42df6f0591246

          SHA1

          ea634140905078e8f687a031ae919cff23c27e6f

          SHA256

          983f4d4c7b7330e7f5f091080c1e81905575ebccd97e11dff8a064979ec8d9b8

          SHA512

          ddf947a1b86c3826859570a3e1d59e4ec4564cfcf25c84841383a4b5f5ad6c2fe618078416aed201fb744d5fbd6c39dab7c1e964dd5e148da018a825fcc0044a

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-environment-l1-1-0.dll

          Filesize

          20KB

          MD5

          e48a1860000fd2bd61566e76093984f5

          SHA1

          aa3f233fb19c9e7c88d4307bade2a6eef6518a8a

          SHA256

          67bbb287b2e9057bf8b412ad2faa266321ac28c6e6ba5f22169e2517a3ead248

          SHA512

          46b384c45d2fe2b70a5ac8ee087ba55828a62ccab876a21a3abd531d4de5ec7be21ff34b2284e0231b6cf0869eba09599c3b403db84448f20bd0fff88c1956d5

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-filesystem-l1-1-0.dll

          Filesize

          22KB

          MD5

          1193f810519fbc07beb3ffbad3247fc4

          SHA1

          db099628a19b2d34e89028c2e16bc89df28ed78f

          SHA256

          ab2158fe6b354fb429f57f374ca25105b44e97edcbdc1b752650d895dadd6fd1

          SHA512

          3222a10c3be5098aca0211015efe75cfbcd408fd28315acedd016d8f77513f81e207536b072001525965635da39c4aae8ef9f6ad367f5d695de67b1614179353

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-heap-l1-1-0.dll

          Filesize

          21KB

          MD5

          a22f9a4cbd701209842b204895fedf37

          SHA1

          72fa50160baf1f2ea2adcff58f3f90a77a59d949

          SHA256

          2ee3d52640d84ac4f7f7ddfe748f51baa6fd0d492286c781251222420e85ca97

          SHA512

          903755d4fa6651669295a10e66be8ea223cd8d5ad60ebe06188d8b779fef7e964d0aa26dc5479f14aab655562d3c1ef76b86790fb97f991eaf52da0f70e40529

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-locale-l1-1-0.dll

          Filesize

          20KB

          MD5

          ba17b278fff2c18e34e47562ddde8166

          SHA1

          bed762d11b98737fcf1d1713d77345ec4780a8c2

          SHA256

          c36f5c0ac5d91a8417866dd4d8c670c2192ba83364693e7438282fb8678c3d1e

          SHA512

          72516b81606ccf836549c053325368e93264fdebc7092e42e3df849a16ccefa81b7156ae5609e227faa7c9c1bf9d68b2ac349791a839f4575728f350dd048f27

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-math-l1-1-0.dll

          Filesize

          28KB

          MD5

          c4cac2d609bb5e0da9017ebb535634ce

          SHA1

          51a264ce4545a2f0d9f2908771e01e001b4e763e

          SHA256

          7c3336c3a50bf3b4c5492c0d085519c040878243e9f7d3ea9f6a2e35c8f1f374

          SHA512

          3b55bdbc5132d05ab53852605afe6ed49f4b3decdde8b11f19a621a78a37d98c7aeaaa8c10bf4565b9b50162816305fa5192ee31950a96dc08ae46bfc6af4ffe

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-runtime-l1-1-0.dll

          Filesize

          24KB

          MD5

          dbd23405e7baa8e1ac763fa506021122

          SHA1

          c50ae9cc82c842d50c4317034792d034ac7eb5be

          SHA256

          57fe2bab2acb1184a468e45cebe7609a2986d5220bb2d82592b9ca6e22384f89

          SHA512

          dafea32e44224b40dcc9ca96fd977a7c14128ca1dd0a6144844537d52ba25bcec83c2fa94a665a7497be9e079e7fc71298b950e3a8a0c03c4a5c8172f11063b9

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-stdio-l1-1-0.dll

          Filesize

          26KB

          MD5

          5df2410c0afd30c9a11de50de4798089

          SHA1

          4112c5493009a1d01090ccae810500c765dc6d54

          SHA256

          e6a1ef1f7c1957c50a3d9c1d70c0f7b0d8badc7f279cd056eb179dc256bfefda

          SHA512

          8ecb79078d05d5b2a432f511953985b3253d5d43d87709a5795709ee8dbca63c5f1166ed94d8984c13f2ea06adfa7d6b82c6735c23c6e64f2f37a257066864e6

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-string-l1-1-0.dll

          Filesize

          9KB

          MD5

          ce0ab982a2f079f5f855ecf37f26806f

          SHA1

          cf5a7574b9ba522f3736a92c10b18dd87a72d046

          SHA256

          c8545678dd3617ee2852f54823909d0aa01e18fa018dac0caa680d540eede6ec

          SHA512

          e36f049a99adf37e7636a18edbefa9783b054b4090e7f54f71da916853c7a849d6d7b63f788c5b4cb9d91b875e81f43f78f32311a0cd5a5b5399495b9960fee5

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-time-l1-1-0.dll

          Filesize

          22KB

          MD5

          0d9afb006f46478008c180b9da5465ac

          SHA1

          3be2f543bbc8d9f1639d0ed798c5856359a9f29b

          SHA256

          c3a70153e1d0ecd1cbf95de033bfef5cfecabe7a8274cafe272cc2c14865cd8c

          SHA512

          4bd76efcb2432994d10884c302aee6cadbc2d594bbbd4e654c1e8547a1efd76fd92e4879b8120dfacb5e8a77826009f72faa5727b1aa559ed3fc86d0ce3ed029

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\api-ms-win-crt-utility-l1-1-0.dll

          Filesize

          6KB

          MD5

          b93cf5525b47d726ffbfa9b3ab5ab184

          SHA1

          c3213726e30bfe1b87c66e506c324f5b5cb1435c

          SHA256

          ea3d75dbdbbd2efa120db50ea9e2bfad5abff0503ce1d3869a206cd10c134357

          SHA512

          6e53e1bd71ba7f23d23c1646ee0950cfeb26e1ae887ddb235124f4862408f481bd8b544344ff1b574f4797239b6a2fb50f6bfb981d24bfdd5e6c87de7ac39121

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\java.dll

          Filesize

          115KB

          MD5

          7853ac6df8810442df08376d2be8511f

          SHA1

          6b87a07741d1b590ee8056bd8494ff66a760a1b1

          SHA256

          51b8cc75f438ba632ab096e257b82492c6d5bc005af5c1803af2dc281d6c461a

          SHA512

          68886b92bf5b0766fce751e7f76708dfd7c910249e526c9895e6a6357f2b87741cde062456fb38eda0b62aaa94a865666f6bb672f6ca28b2ffc785f19cc35f2c

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\java.dll

          Filesize

          34KB

          MD5

          0c332b1d426f065d6314ce62a3aa1fe8

          SHA1

          5d639a96dae2981e68ae464283ad4895d77bdf43

          SHA256

          654a5412f6a8ed28150be28954724a235e34c03bec1210aa27f08c71da7a854c

          SHA512

          1fba8da69f0367fc38f59f905ea0aaae879002557d00e78f7880dbb13d8b162236f8cd55dee254f4a42355b9334d471b016442b4b1ea8af29fddc0b6d1864de8

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\java.dll

          Filesize

          27KB

          MD5

          554d3b111f785821ae1b0967bdbcc762

          SHA1

          e8352b218416eca3e627b824b0b5d57734023c79

          SHA256

          d210731317fb3a734d33be3b1d67475bdfc8d552b33ac1c15d2e95de249ed69c

          SHA512

          29100dec575d5d214e2e6be6fe45c11306995b9621708030c372b29dd918e0a3d7deaf142c7b0bba1d3e5bedab002605b2e749e020e82bcc4c7ae64e9aa8107c

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe

          Filesize

          120KB

          MD5

          afdd700425d87782b45b379f9da849c5

          SHA1

          cc2f6ba5927b6de5aca9f7083feb53e0f89c0c09

          SHA256

          affd35e2567ab8c20d13b35345ff90789c17b8018991da8daafb6c163bbf8d0f

          SHA512

          8d16227f8cfd6fcfcc573913e3ff4a36b333c86f84698dc33cf592ee25842febae714179cfae32636a321dfa92c5c804d5e068ed109a93e881e5791e308f57ba

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\javaw.exe

          Filesize

          56KB

          MD5

          6b803eaf02c28888532eec224305ad4f

          SHA1

          5b623f24fd81ca559d90e0302e86d4f80b0791ef

          SHA256

          0af59902cd9e54ec388ff0849dace1582f6c03b4b2559274921a0f572b9d5444

          SHA512

          16a4cd7c98b8f7eaa173cfb393a3c3532487689d51cba17a13b70e450e4ea5079e9d45bd729c89dc5b88f98e75161d285c37077614e70bfdd42d2065e0826bd3

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\msvcp140.dll

          Filesize

          23KB

          MD5

          dfacfcd4510da12a0981443732d1f885

          SHA1

          9752e03d7e98e6c8d48ed1a247f0950dcd06e673

          SHA256

          c636df8b836b849d7d601d5acd0fd777bdaf273d8352a0dbf7a7f4a9be1cac2c

          SHA512

          0e1bbde7f9645e2250e7583516edb79ab52c60965740483be877c36862f57199d57d641519ff3509a864d2d8a9ba31b63943a82f7722cad49f22d9c632a808ac

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\server\jvm.dll

          Filesize

          11KB

          MD5

          cefc8bc1adaf0a9c929cf5f0dbef7f6a

          SHA1

          31b0b3f96049b96e51c1aff01884507f139664b3

          SHA256

          6e97292eed678078e70c8d2e0fa586e3d7eb74c4b6900d08f86592fb9a16d78c

          SHA512

          8ee2da74f3fd1728f68b4d65a069a1827d48b010aaa388f094bb9fce6caa782d608df822a5d87c7eaae6807f43316549560ec04ab1361e4c42562c0eb0cc39a2

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\ucrtbase.dll

          Filesize

          44KB

          MD5

          84a8f6aa6784e121288b5253aa8ca604

          SHA1

          c46f1594985fafd74f42f2a493cd83fee847129e

          SHA256

          f6f5022c6f1f8a3cb1b2b8afe95bd4bc524726a93362c12eb0c718a68033eae5

          SHA512

          2e87c288a2e155ce57f9ac63e58189382a79e8cbb95d315b397481bb10a1e7c4f699f2fd16c0e06788c6a64c3082192d5420bb44cf10dc2aa52562c4aaf42a6f

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\vcruntime140.dll

          Filesize

          54KB

          MD5

          f22f873284e020967e9a55cdf61fde7f

          SHA1

          ef7ec2d56b056b87141d93f7b50037717ba445fd

          SHA256

          1156080bac7a1cefe287ad12962d5ce67cc45f80b5cdacb790c3e1220fecb9f2

          SHA512

          f229d0aa0e52587960fc73705040c0046f67e38d606b4d8579ee0df1e582077beb37ce7a54ea7ed9c0811c75b2ae5c50d28581b3441f0d7aa7886b61e612afb1

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\verify.dll

          Filesize

          8KB

          MD5

          9c1fa6a12b63247308e2c3a4c45e6841

          SHA1

          bec57a8052d199f72cb19ea4a0d8815b7e3427a3

          SHA256

          d90f92ec90592ae2510268646f63da2f143696f469930f2b65aef48c5d1bbf38

          SHA512

          269c98d2b1f388be98fb73df3f6a821e92a3ea139281f951e6faef4a1dfd5c5e0003ee3afc9a33e9ab34e945b83aa213729a5d30fae772664d91a80984a3d2d3

        • \Users\Admin\AppData\Roaming\.minecraft\java\jre1.8.0_251\bin\zip.dll

          Filesize

          1KB

          MD5

          9d8685f95ef02e6092e7917ca019bf8f

          SHA1

          a72e8fe480f60d00816c72783988f94fe3165e68

          SHA256

          6cd62ae3bb30f02a96065c23cdaf39eebbdc57677a7521f7fb10af92300fd068

          SHA512

          452b5a648bfb153d061a35300506c774e20710b398ca7b94bc232fac49ab7c4bf76404d3500aecb43865e6b99e43bc3f93b1a8673daa2e0f927ec5da938c97b6

        • memory/932-1001-0x0000000000150000-0x000000000015A000-memory.dmp

          Filesize

          40KB

        • memory/932-999-0x0000000000150000-0x000000000015A000-memory.dmp

          Filesize

          40KB

        • memory/932-1031-0x0000000000150000-0x000000000015A000-memory.dmp

          Filesize

          40KB

        • memory/932-1032-0x0000000000150000-0x000000000015A000-memory.dmp

          Filesize

          40KB

        • memory/932-1034-0x0000000000150000-0x000000000015A000-memory.dmp

          Filesize

          40KB

        • memory/1056-918-0x0000000000410000-0x0000000000411000-memory.dmp

          Filesize

          4KB

        • memory/1056-909-0x00000000021E0000-0x00000000031E0000-memory.dmp

          Filesize

          16.0MB

        • memory/1056-917-0x0000000000410000-0x0000000000411000-memory.dmp

          Filesize

          4KB

        • memory/2000-1063-0x0000000002240000-0x0000000003240000-memory.dmp

          Filesize

          16.0MB

        • memory/2000-1118-0x0000000002240000-0x0000000003240000-memory.dmp

          Filesize

          16.0MB

        • memory/2000-1078-0x0000000000140000-0x000000000014A000-memory.dmp

          Filesize

          40KB

        • memory/2000-1126-0x0000000002240000-0x0000000003240000-memory.dmp

          Filesize

          16.0MB

        • memory/2000-1145-0x0000000002240000-0x0000000003240000-memory.dmp

          Filesize

          16.0MB

        • memory/2000-1158-0x0000000000140000-0x000000000014A000-memory.dmp

          Filesize

          40KB

        • memory/2000-1202-0x0000000002240000-0x0000000003240000-memory.dmp

          Filesize

          16.0MB

        • memory/2000-1207-0x0000000002240000-0x0000000003240000-memory.dmp

          Filesize

          16.0MB

        • memory/2000-1227-0x0000000002240000-0x0000000003240000-memory.dmp

          Filesize

          16.0MB

        • memory/2000-1238-0x0000000002240000-0x0000000003240000-memory.dmp

          Filesize

          16.0MB

        • memory/2012-949-0x0000000002170000-0x0000000003170000-memory.dmp

          Filesize

          16.0MB

        • memory/2252-1054-0x00000000021B0000-0x00000000031B0000-memory.dmp

          Filesize

          16.0MB

        • memory/2252-1024-0x00000000021B0000-0x00000000031B0000-memory.dmp

          Filesize

          16.0MB

        • memory/2676-63-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-48-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-1-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-65-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-52-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-57-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-58-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-0-0x0000000000090000-0x0000000000091000-memory.dmp

          Filesize

          4KB

        • memory/2676-3-0x0000000000090000-0x0000000000091000-memory.dmp

          Filesize

          4KB

        • memory/2676-59-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-45-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-67-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-50-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-895-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-49-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-60-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-62-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-46-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-64-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-56-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2676-47-0x0000000001120000-0x0000000001965000-memory.dmp

          Filesize

          8.3MB

        • memory/2752-1023-0x0000000002300000-0x0000000003300000-memory.dmp

          Filesize

          16.0MB

        • memory/2752-1022-0x0000000000140000-0x000000000014A000-memory.dmp

          Filesize

          40KB

        • memory/2752-1021-0x0000000000140000-0x000000000014A000-memory.dmp

          Filesize

          40KB

        • memory/2752-1020-0x0000000000140000-0x000000000014A000-memory.dmp

          Filesize

          40KB

        • memory/2752-1019-0x0000000002300000-0x0000000003300000-memory.dmp

          Filesize

          16.0MB

        • memory/2752-978-0x0000000002300000-0x0000000003300000-memory.dmp

          Filesize

          16.0MB

        • memory/2752-943-0x0000000000140000-0x000000000014A000-memory.dmp

          Filesize

          40KB

        • memory/2752-939-0x0000000000140000-0x000000000014A000-memory.dmp

          Filesize

          40KB

        • memory/2752-936-0x0000000000140000-0x000000000014A000-memory.dmp

          Filesize

          40KB

        • memory/2752-933-0x0000000002300000-0x0000000003300000-memory.dmp

          Filesize

          16.0MB

        • memory/3040-919-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB