a7c997ba3c3e91c048f80f96f08754948428f6d3fe4001bab79c4ae09d06c5e0

Analysis

max time kernel
241s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LegacyLauncher_Installer_legacy.exe
Size

112.3MB
MD5

53eea8664d54198e1989301b12f795da
SHA1

00bddca8bba387a76d6f18fc942859acf9ff5a60
SHA256

a7c997ba3c3e91c048f80f96f08754948428f6d3fe4001bab79c4ae09d06c5e0
SHA512

e05bd2e369b19b818f715a14ceb2c35b2f8409e5524d347d3093ef82667675bf719af17ab77412156aa62748aa17572d622b163bb6d187d917282f49e56ff831
SSDEEP

3145728:kNS0yY1k/bQS8yJQZI3XeKBPKi2O3hE4AGzUVeQgnFV:koqcQ+3XHD2OxEfPQQgnFV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	java.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	java.exe

Executes dropped EXE 7 IoCs

pid	Process
4308	LegacyLauncher_Installer_legacy.tmp
240	TL.exe
2096	javaw.exe
1588	TL.exe
3700	javaw.exe
3748	java.exe
1596	java.exe

Loads dropped DLL 53 IoCs

pid	Process
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
2096	javaw.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3700	javaw.exe
3700	javaw.exe
3700	javaw.exe
3700	javaw.exe
3700	javaw.exe
3700	javaw.exe
3748	java.exe
3700	javaw.exe
3700	javaw.exe
3748	java.exe
3748	java.exe
3748	java.exe
3700	javaw.exe
3700	javaw.exe
3700	javaw.exe
1596	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
3748	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
3748	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
1596	java.exe
1596	java.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM32\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\system32\wbem\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\system32\wbem\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\system32\wbem\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.pdb	java.exe
File opened for modification	C:\Windows\SYSTEM32\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.pdb	java.exe
File opened for modification	C:\Windows\SYSTEM32\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\SYSTEM32\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\system32\wbem\ntdll.pdb	java.exe
File opened for modification	C:\Windows\system32\wbem\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\system32\wbem\ntdll.pdb	java.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\ntdll.pdb	java.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\ntdll.pdb	java.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\ntdll.pdb	java.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\ntdll.pdb	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	java.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4308	LegacyLauncher_Installer_legacy.tmp
4308	LegacyLauncher_Installer_legacy.tmp

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeBackupPrivilege	3748	java.exe
Token: SeBackupPrivilege	3748	java.exe
Token: SeSecurityPrivilege	3748	java.exe
Token: SeDebugPrivilege	3748	java.exe
Token: SeBackupPrivilege	1596	java.exe
Token: SeBackupPrivilege	1596	java.exe
Token: SeSecurityPrivilege	1596	java.exe
Token: SeDebugPrivilege	1596	java.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4308	LegacyLauncher_Installer_legacy.tmp

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3748	java.exe
1596	java.exe
1596	java.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4308	4032	LegacyLauncher_Installer_legacy.exe	94
PID 4032 wrote to memory of 4308	4032	LegacyLauncher_Installer_legacy.exe	94
PID 4032 wrote to memory of 4308	4032	LegacyLauncher_Installer_legacy.exe	94
PID 4308 wrote to memory of 240	4308	LegacyLauncher_Installer_legacy.tmp	99
PID 4308 wrote to memory of 240	4308	LegacyLauncher_Installer_legacy.tmp	99
PID 4308 wrote to memory of 240	4308	LegacyLauncher_Installer_legacy.tmp	99
PID 240 wrote to memory of 2096	240	TL.exe	100
PID 240 wrote to memory of 2096	240	TL.exe	100
PID 2096 wrote to memory of 3748	2096	javaw.exe	103
PID 2096 wrote to memory of 3748	2096	javaw.exe	103
PID 1588 wrote to memory of 3700	1588	TL.exe	104
PID 1588 wrote to memory of 3700	1588	TL.exe	104
PID 3700 wrote to memory of 1596	3700	javaw.exe	106
PID 3700 wrote to memory of 1596	3700	javaw.exe	106

C:\Users\Admin\AppData\Local\Temp\LegacyLauncher_Installer_legacy.exe
"C:\Users\Admin\AppData\Local\Temp\LegacyLauncher_Installer_legacy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\is-M1S9D.tmp\LegacyLauncher_Installer_legacy.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M1S9D.tmp\LegacyLauncher_Installer_legacy.tmp" /SL5="$202FE,115841256,1202688,C:\Users\Admin\AppData\Local\Temp\LegacyLauncher_Installer_legacy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\TL.exe
    "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\TL.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\javaw.exe" -Xmx128m -Dtlauncher.bootstrap.restartExec=TL.exe -jar "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:2096
    - - C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\java.exe
        
        C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\java.exe -Xmx128m -Dfile.encoding=UTF-8 -Dtlauncher.systemCharset=windows-1252 -Dtlauncher.logFolder=C:\Users\Admin\AppData\Roaming\.tlauncher\logs --add-exports java.desktop/sun.awt=javafx.swing -Dtlauncher.bootstrap.restartExec=TL.exe -classpath C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar ru.turikhay.tlauncher.bootstrap.Bootstrap --packageMode windows --targetJar launcher/launcher.jar --targetLibFolder launcher/libraries -- --settings tl.properties
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3748

C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\TL.exe
"C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\TL.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\javaw.exe
  "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\javaw.exe" -Xmx128m -Dtlauncher.bootstrap.restartExec=TL.exe -jar "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\java.exe
    C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\java.exe -Xmx128m -Dfile.encoding=UTF-8 -Dtlauncher.systemCharset=windows-1252 -Dtlauncher.logFolder=C:\Users\Admin\AppData\Roaming\.tlauncher\logs --add-exports java.desktop/sun.awt=javafx.swing -Dtlauncher.bootstrap.restartExec=TL.exe -classpath C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar ru.turikhay.tlauncher.bootstrap.Bootstrap --packageMode windows --targetJar launcher/launcher.jar --targetLibFolder launcher/libraries -- --settings tl.properties
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-7141014889000.dll

Filesize
9KB

MD5
697d496ac9f5aaab8ae025322358c61e

SHA1
2043eac8cdcc2e24b854af1eacd77a5f2a395a27

SHA256
a7273a4cf48ab3413f2c186cc95a3367a73ce99f8d45329383219d4cc27003aa

SHA512
b6702cd49a3af9f97f697565136f140692af9f8b271e672f2e91c920a23212b778583786f2377078117113647926338614a92c4a2423318b7a21ba2fe3a89838

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M1S9D.tmp\LegacyLauncher_Installer_legacy.tmp

Filesize
3.4MB

MD5
07b96c2d1823a0a548832c1062799d85

SHA1
65a35826b0e6d93700256fd8a4710cc039bd7b8d

SHA256
c5ba29e4c82fca9adfcd3a6b60b3bf786abe7178928f80cb60eca3564e35b3de

SHA512
abf2ba63976bd6622f3a1cda816c8f2267b59c079d6092ff60e7f52be893a993e3b457a174092c74056628e9694fa9efc8d823d14b4d658a9eb59c622d992f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna16362594253773807180.dll

Filesize
248KB

MD5
34d12b1e2af72d9bb267bbc8c0d53e4a

SHA1
d9ed8776645f6b4f52df16132450863c47ea92d7

SHA256
13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03

SHA512
c0a063477cf63a8b647ea721842968b506d70ea22c586a412707d7293b46c218b6a510f34b7dbedd3ed29a9d4b5dc5c6a1995403d65884b17348a9545e580a10

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\TL.exe

Filesize
399KB

MD5
96c64d11cf26ebd227ad754b62d480ae

SHA1
cb40090b892c34feb8ceb995a0d0b90ecfe54acf

SHA256
2b11f487e853e952dc677071202cbe25d6800ccaf3f93a3232c5eed715a1c033

SHA512
0be0c2b657ba8814112a9ea075e1ec6c6a0fb965c7308ba24e40b98ec90e9e60afbe09328c0f6c3aa27b54762bf880dfec4aee5f20d24c3b644288e0be311d5f

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\java.dll

Filesize
140KB

MD5
0fe24d48daeb2dbd44c5971545ff4387

SHA1
e43792d276ba212ad84cfbef6d6b5405fc4b76c0

SHA256
86b0f15814202f36fbcb4d220bb37445aec6c03d5473744ab4f567670c142adb

SHA512
e9fd5c87832063a040acc77043d88fae198b7d1d664142144b24954305b2191051bcdca1bd0ad067dc80ef3c9b4cb45f2fc9be1a2c4087407ce883c8c9fd96ca

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\java.dll

Filesize
64KB

MD5
1cd09efc50f8034c36d9058e57a3e74c

SHA1
7decdec30ec96710e5712cc2d0634b6c7a5763e3

SHA256
0959011632dc54f599b599cf522426ba6cf3898f518f7c339b58ae4b289419d4

SHA512
69d36141f724275328c29a28e9903040839801ee1964e32d61e86663bddd27be083d96548b294773f11ff97e6e1ab588abb1bdece6fd61bc2d71e349754658f0

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\java.exe

Filesize
46KB

MD5
6661f36687a2bbf86d9c1cebaec8037f

SHA1
42a23f1bec44465256738b9189870954abf31fe6

SHA256
88929241f30cbb0ba439bfab1cd82cf6d092f776e5c73a452f80ed465355adec

SHA512
92bc2f5364f8ab43b70fd344fd19dfd7045be7f6c445863263ab30e93020150fbfb3b291206ef3fdaa79e33818dfaca590c8ebc78978a98e80bcffc496cbae15

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\javaw.exe

Filesize
46KB

MD5
d5b6b6976511114000dfaea05c8a9c8a

SHA1
122df7bfbc5b058242e0c18fee9d9bc6489d512c

SHA256
3850d4f443b2a97014a1dcb94db893f0b3396201a8573aa4c4b967ff61528ac6

SHA512
cebaee71e2813670534c18a8363a127c6f8ca759b86262d3e69f6d2ee180ed0fc34bfcde63bf1fd3e91088f09c5950cac22be4cb5d875f2901a7b323ebe2f739

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\jimage.dll

Filesize
30KB

MD5
36eaca4b8c0e14921e79a47f91f3a3b3

SHA1
ffdf367e09a2d365de26527b53bf04758b7bfd76

SHA256
8e8903cc2231f28e682df62ec7623fabfa6a2112bcd14cee6f79e6924239b75f

SHA512
32d20959585aea57554f74baa36ea0dd54d47aa9f055cea39182267d70034d99a2d7aa3e8935dcdb2ea32c6b03c0485132404cd9717593e16f7a0ae5b7bda748

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\jli.dll

Filesize
83KB

MD5
e9c6f790d97a491dc6dba58605d0a48f

SHA1
8d39cf612880ab33b4c247997649e12035783c2f

SHA256
d6eae7c72044fdd83eea7ae2c36dfa163b6093df19e360f980980334b14ff934

SHA512
a47c38871f08d47ac4b0e59f8a01dc9865dc730afceb66337f046a28a0e90c34700cffe00dc85be2294713fb507d3d89ab0142797beb490b6394575cde1b2091

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\jsvml.dll

Filesize
847KB

MD5
4eda79660a4a3b38c23dfd5e123c2e76

SHA1
14815b9257142b19530e9a170f6b86e9d7830a01

SHA256
4d08e64796f7b0ecc270952a8bd356c285d0e3645809de5e68e3857a6506ee41

SHA512
04803dfdaea74b891f21bb302e7a126e536eb9f036a6e0ac21a6e3f247bac6e2351e3392f81022e2c19735bb5fb65d2fc0c83800790284fea70ea00687007321

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\jsvml.dll

Filesize
64KB

MD5
0e9deacb338fe1664f6a94bac51f2fcf

SHA1
575f2a09fbbf547fb025b0a87696a6475b80180a

SHA256
9212701e600cf20b5d57bf6f1a6bb0ef2b2c327d42db40db882dd522e2ecd1c4

SHA512
a81eba62b23102f5721e74e9de830091c0352a813cffce07312d9ddbed89ddcdb4c79058726e4cd8b346721bc9e3bac35b11bda4c1f6c388d067ec25b5b1f0fd

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\msvcp140.dll

Filesize
552KB

MD5
cb75d6437418afe1a7b52acf75730ff1

SHA1
54c2da9552671b161cc87eb50fbdb86319b00f56

SHA256
7c4ce9d6bfcd6d9db4eef4e75ecdcf5a8e5320106e80f1eca617439fa43f33e8

SHA512
f58abb740a30467e2d8aedd7eed357da020fdc7d966e245890d102a52e96fea296e122c1d2bc112423fc64b6f5e70b7df3f3eb7de1bf5c2f5f0eb3644f1e06d6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\net.dll

Filesize
92KB

MD5
087ab68f6e8896b64ad3d268d4910c9e

SHA1
959c75107f682e6b161d134e158c462f79729e21

SHA256
02c6f0713ae7b898ea27fa39d3344fcfb777aca5dc71d51bcac8e772f6ffb6e2

SHA512
a8ff006078e2cf232b49ba7d6f65b686494a32b3fb5f365a91ea27a7fcd22e9bcad697162cb52659dc6adc171b169df4f5a35b4dc9cc171792ef2a4251c47f86

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\nio.dll

Filesize
75KB

MD5
4ce8193d98e378dce8adc994cd919d5b

SHA1
4752bd35373cafce4edde8d7028ce6d858367c0a

SHA256
2fcfd19a49bd03f3b1eb60ced72568e5e48d13b3a7b4cd1806caaad8ce17cd34

SHA512
d87e61a18759a4c2b6debc05d6978fededa8ecb02d6f3ee8ac2258c253142d0ba3ddaab350340136146d474fd0d6f463369b2dade709f07675548c31ca44fdf6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\server\classes.jsa

Filesize
128KB

MD5
b86d28ae4f90ab3538f8c7ffe3b64bb6

SHA1
33179f794ea6b56b1ea508d1b5cea52f4d680587

SHA256
4f4f3d894c4245ac35483ff5ac9237f4e7b8019f8cf2debadd05fe586210f52d

SHA512
4399942c475edc37206066b550750bfb2e17bb794cd344d5b8ae46e33f9b1e20be60954ab883aa6a5f56f64eba20b65a02f314b72d7e0a943e400dc30ff6b586

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\server\jvm.dll

Filesize
2.6MB

MD5
1150aef0411548a00d5b4727da9c34c8

SHA1
4941849bc935eb2980ce950867e042f48b86c5e0

SHA256
9229630446a132fc683edde3b70cc1bc26fcde9784ec6b4c00e6e14364a1853b

SHA512
be0ae6b700a7b1daf3dcb09de5c88dfe72051d004940fab09a720cd726302acf32abf4718b19a9a3254af5aea51746647d4dceaeae3a40225cfdd4ce6d1a4127

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\server\jvm.dll

Filesize
2.4MB

MD5
5fa539c50cb130de80a869819f99ba6d

SHA1
0052ccd71c92bd140f10a72eed2be33c8d07b268

SHA256
77693658c3dc0790a0f8d9279f6a2813474039b509dfc3914234903508fb607c

SHA512
79728b77cd5ba3c896a849797aaa0a2d5679a5b9c2cd9349825d3b709ef675e1744814ca1349482465f1a3805e90d5077227a362b82078368b17383d6a89208a

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\server\jvm.dll

Filesize
1.7MB

MD5
7f8f890d53c505316c4fcee6c9686eb0

SHA1
6484a8ea38903ec2ab78007c649607a792c198cc

SHA256
6874f732584cad12c9cc87f507ad700e25dd1caf8ca7b43fd752f96356bd1f8d

SHA512
a434a0341bf9af05d4c0e1eeb93840ada1b4d0aabc9674ab934e328c6c3c1a0bd2f3e1877de104aa7bcfb1e8ebcc4f998a84fece2bed63dbb00a491bbb22a98b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\server\jvm.dll

Filesize
1.6MB

MD5
04a53850e374e2a51fc4957ca911bf96

SHA1
37f4d92cc44a6916f206ef14e6f6febf4c02634b

SHA256
4038d748a02c67f048e42969f88525ba4a0b887a53117c6b08b7c5518f9ab124

SHA512
0fc3b11adf93c502b6dbc0aa6b7cab6f519c01f4b8d0ea554fbef0df488f52c56908ae9a62b6002f51d6ab6ab30cea6be7eef5a4cb294af91763ed56d6d7b5c7

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\vcruntime140.dll

Filesize
94KB

MD5
a87575e7cf8967e481241f13940ee4f7

SHA1
879098b8a353a39e16c79e6479195d43ce98629e

SHA256
ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

SHA512
e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\vcruntime140_1.dll

Filesize
36KB

MD5
37c372da4b1adb96dc995ecb7e68e465

SHA1
6c1b6cb92ff76c40c77f86ea9a917a5f854397e2

SHA256
1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf

SHA512
926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\bin\zip.dll

Filesize
82KB

MD5
183fac113c734fdb636e40403b3d2f98

SHA1
5cbb8fa03d69c4558443ede1542b93f41260c4a2

SHA256
b275b290d6f29e02cd32500eac256303aa1273bc3ef2a83c0a9344b9bb2d223c

SHA512
7cd8ab77f6e4df0e10f3bc74fbcd286c02f42481189d8bf84275918d041f5f9b3bfb0f708c704ddbdacd2b76e160bdead169056c4a83ce0e8401a7d8702b7ec7

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\conf\security\java.security

Filesize
56KB

MD5
00cf40959861f61f17b90c6b6002a9a1

SHA1
982e48466428e1f49c1a5941c73afdacefd1d22e

SHA256
38166a975348862d693d95de8d676cf19cecccc45af4a1896c73c45f7bd966ef

SHA512
bad90152685279d896a4063d76dec5befe14831d3dd3260929b9a639505e898fa996b52aab3821a51c6c9aa09d956a23a8bdd870377a10e75c9399629cab5779

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\legal\java.compiler\is-ADCEV.tmp

Filesize
49B

MD5
19c9d1d2aad61ce9cb8fb7f20ef1ca98

SHA1
2db86ab706d9b73feeb51a904be03b63bee92baf

SHA256
ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9

SHA512
7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\legal\java.compiler\is-OJB18.tmp

Filesize
44B

MD5
7caf4cdbb99569deb047c20f1aad47c4

SHA1
24e7497426d27fe3c17774242883ccbed8f54b4d

SHA256
b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a

SHA512
a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\legal\java.compiler\is-TPAUS.tmp

Filesize
33B

MD5
16989bab922811e28b64ac30449a5d05

SHA1
51ab20e8c19ee570bf6c496ec7346b7cf17bd04a

SHA256
86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192

SHA512
86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\lib\jvm.cfg

Filesize
29B

MD5
7ce21bdcfa333c231d74a77394206302

SHA1
c5a940d2dee8e7bfc01a87d585ddca420d37e226

SHA256
aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0

SHA512
8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\lib\modules

Filesize
512KB

MD5
d256700a5fbc0ee10c772d6a26c48e8c

SHA1
4c8ac7b30596e1a9eb23b6cdddaea5d708971426

SHA256
94f071d8d5579db65c4dd4f9dc27392416d486cee54ed901f8877b781a09464e

SHA512
17fd01d739dbdf49e20f9838d60aa00faf4eab9c3772ceefb6a235d0f9ca3687816f36ca58855f3b471b5153a74ad98c384ffb06443ab4329df96413beb351e6

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\lib\security\cacerts

Filesize
169KB

MD5
e6777014990779f07517e069c0630eb3

SHA1
d4653d23161c506338473c2864f2f9d405350b5b

SHA256
c67664fa718b6d2df0d7385d7e9f703ac3acf8d0786175eb29d08d50bcbcd5bc

SHA512
ebaede2d7ab548e8b54953480a68b40901b3a92caca601c11037bf8cb1f79010cb6e5aeb06bb4105585c20180d35bc6403c437d386c1ee19ece5447042815ccf

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar

Filesize
2.7MB

MD5
2b17a57a09a2310931e118deac0f8141

SHA1
5ae15de80d8663622199225a63c3ebb5ea71d1f7

SHA256
9700793eeec0b5d7ac49cdcda83befa070bead1054c21e014e625747bb6b469e

SHA512
783ce9f9b77633de8a07c926aabc3842006eec1079a3a786c9bf07ed87d8d89dbb24191596cb50b94a54fb3df8f11afc0a0155d8b919d220217c71addd0b9385

Download Submit
C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\tl.args

Filesize
125B

MD5
ced792b61824f55e8e70a22214b55d19

SHA1
5270aea99be95b59c339450c451e1b2148b88599

SHA256
05fa49f9ffe7a22d1e3443fd8cc993e62b7f20a976162ce69d306ff9581f1d87

SHA512
9c9bd55f7a63bbae85c4c662ff2e2480d094c5f00ee3ca50c5c0d80cac5e7692aed35c1d90e6d4f5d88e537728773acf8aedb3db3747374418bb748939a354bb

Download Submit
memory/240-863-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1588-915-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1596-1041-0x000001D105E70000-0x000001D106E70000-memory.dmp

Filesize
16.0MB

Download
memory/1596-1035-0x000001D105E70000-0x000001D106E70000-memory.dmp

Filesize
16.0MB

Download
memory/1596-1032-0x000001D105E70000-0x000001D106E70000-memory.dmp

Filesize
16.0MB

Download
memory/1596-1014-0x000001D105E70000-0x000001D106E70000-memory.dmp

Filesize
16.0MB

Download
memory/2096-935-0x000002582DF50000-0x000002582E1C0000-memory.dmp

Filesize
2.4MB

Download
memory/2096-893-0x0000025826490000-0x0000025827490000-memory.dmp

Filesize
16.0MB

Download
memory/2096-929-0x0000025826A20000-0x0000025826C90000-memory.dmp

Filesize
2.4MB

Download
memory/3700-983-0x000002A29C790000-0x000002A29CA00000-memory.dmp

Filesize
2.4MB

Download
memory/3700-980-0x000002A294CD0000-0x000002A294F40000-memory.dmp

Filesize
2.4MB

Download
memory/3700-982-0x000002A295260000-0x000002A2954D0000-memory.dmp

Filesize
2.4MB

Download
memory/3748-995-0x0000022EDCBA0000-0x0000022EDDBA0000-memory.dmp

Filesize
16.0MB

Download
memory/3748-942-0x0000022EDCBA0000-0x0000022EDDBA0000-memory.dmp

Filesize
16.0MB

Download
memory/3748-979-0x0000022EDCBA0000-0x0000022EDDBA0000-memory.dmp

Filesize
16.0MB

Download
memory/4032-2-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/4032-0-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/4032-9-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/4032-882-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/4032-7-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/4308-864-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/4308-8-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/4308-13-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/4308-326-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/4308-15-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/4308-840-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/4308-16-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/4308-18-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/4308-10-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download