Resubmissions

10/06/2024, 17:29

240610-v2s7pathjd9

10/06/2024, 09:05

240610-k2gtjsfe797

10/06/2024, 09:04

240610-k12sbsfe73

10/06/2024, 09:04

240610-k116ssfe72

10/06/2024, 08:54

240610-kt8x3afd888

10/06/2024, 08:48

240610-kqv7ssef5z1

10/06/2024, 08:44

240610-knas3sfc627

10/06/2024, 08:42

240610-kl9vdsfc45

10/06/2024, 08:00

240610-jvym2seh468

Analysis

  • max time kernel
    523s
  • max time network
    548s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 17:29

General

  • Target
    TLauncher-Installer-1.4.5.exe
  • Size 22.8MB
  • Sample240610-v2s7pathjd
  • SHA256 a49a364b7394a70e5bac73917bd825b703aa9f11b66848069379b01a595ca307
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Renames multiple (58) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 48 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.5.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.5.exe" "__IRCT:3" "__IRTSS:23874292" "__IRSID:S-1-5-21-330940541-141609230-1670313778-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1064
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer Phishing Filter
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3796 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3852
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\jre-8u51-windows-x64.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\jre-8u51-windows-x64.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2000
        • C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
          -cp "C:\Program Files\Java\jre1.8.0_51\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
          4⤵
          • Executes dropped EXE
          PID:3620
        • C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
          -cp "C:\Program Files\Java\jre1.8.0_51\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
          4⤵
          • Executes dropped EXE
          PID:2648
        • C:\Windows\system32\msiexec.exe
          "C:\Windows\system32\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\AU\au.msi" ALLUSERS=1 /qn
          4⤵
            PID:2420
          • C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
            "C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -r jre 1.8.0_51-b16
            4⤵
            • Executes dropped EXE
            PID:888
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Program Files\Java\jre1.8.0_51\installer.exe
        "C:\Program Files\Java\jre1.8.0_51\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_51\\" REPAIRMODE=0
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Registers COM server for autorun
        • Installs/modifies Browser Helper Object
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
          "bspatch.exe" baseimagefam8 newimage diff
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2856
        • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\deploy.pack" "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3940
        • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\javaws.pack" "C:\Program Files\Java\jre1.8.0_51\lib\javaws.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4012
        • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\plugin.pack" "C:\Program Files\Java\jre1.8.0_51\lib\plugin.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2836
        • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\rt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\rt.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1480
        • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\charsets.pack" "C:\Program Files\Java\jre1.8.0_51\lib\charsets.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2732
        • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\jsse.pack" "C:\Program Files\Java\jre1.8.0_51\lib\jsse.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          PID:4080
        • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          PID:2432
        • C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\unpack200.exe" -r "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.pack" "C:\Program Files\Java\jre1.8.0_51\lib\ext\jfxrt.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2600
        • C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -Xshare:dump
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          PID:2544
        • C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe" -wait -fix -permissions -silent
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:308
          • C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
            "C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -classpath "C:\Program Files\Java\jre1.8.0_51\lib\deploy.jar" com.sun.deploy.panel.JreLocator
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2952
          • C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe
            "C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_51" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXIALURqYXZhLnNlY3VyaXR5LnBvbGljeT1maWxlOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcc2VjdXJpdHlcamF2YXdzLnBvbGljeQAtRHRydXN0UHJveHk9dHJ1ZQAtWHZlcmlmeTpyZW1vdGUALURqbmxweC5ob21lPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcamF2YXdzLmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcYmluXGphdmF3LmV4ZQ== -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1940
        • C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe
          "C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe" -wait -fix -shortcut -silent
          3⤵
          • Executes dropped EXE
          PID:3080
          • C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe
            "C:\Program Files\Java\jre1.8.0_51\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_51" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXIALURqYXZhLnNlY3VyaXR5LnBvbGljeT1maWxlOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcc2VjdXJpdHlcamF2YXdzLnBvbGljeQAtRHRydXN0UHJveHk9dHJ1ZQAtWHZlcmlmeTpyZW1vdGUALURqbmxweC5ob21lPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF81MVxsaWJcamF2YXdzLmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzUxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNTFcYmluXGphdmF3LmV4ZQ== -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:3108
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding AD424612B6FCC076A8DC2403C11B5EA1
        2⤵
          PID:3476
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\SysWOW64\cmd.exe" /c del "C:\Program Files\Java\jre1.8.0_51\installer.exe"
            3⤵
              PID:3508
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding F31772AE9F5385547D43CAA3DCB285D9
            2⤵
              PID:4008
          • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
            "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
            1⤵
            • Executes dropped EXE
            PID:4012
            • C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
              "C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2688
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            1⤵
              PID:3636
            • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
              "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
              1⤵
              • Executes dropped EXE
              PID:1196
              • C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
                "C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1596
                • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exe
                  C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exe -Xmx1024m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\fluent-hc-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.8.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\hamcrest-core-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore-4.4.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junit-4.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.2914.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.72.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-server-API-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\url-cache-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.923.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.923
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks processor information in registry
                  • Suspicious use of SetWindowsHookEx
                  PID:3628
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /C chcp 437 & wmic CPU get NAME
                    4⤵
                      PID:1992
                      • C:\Windows\system32\chcp.com
                        chcp 437
                        5⤵
                          PID:2728
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic CPU get NAME
                          5⤵
                            PID:1580
                        • C:\Windows\system32\cmd.exe
                          cmd.exe /C chcp 437 & set processor
                          4⤵
                            PID:2320
                            • C:\Windows\system32\chcp.com
                              chcp 437
                              5⤵
                                PID:2284
                            • C:\Windows\system32\cmd.exe
                              cmd.exe /C chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                              4⤵
                                PID:108
                                • C:\Windows\system32\chcp.com
                                  chcp 437
                                  5⤵
                                    PID:268
                                  • C:\Windows\system32\dxdiag.exe
                                    dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                    5⤵
                                      PID:2924
                                      • C:\Windows\SysWOW64\dxdiag.exe
                                        "C:\Windows\SysWOW64\dxdiag.exe" /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                        6⤵
                                        • Drops file in Windows directory
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3932
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /C chcp 437 & wmic qfe get HotFixID
                                    4⤵
                                      PID:2592
                                      • C:\Windows\system32\chcp.com
                                        chcp 437
                                        5⤵
                                          PID:2380
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic qfe get HotFixID
                                          5⤵
                                            PID:4044
                                        • C:\Windows\system32\cmd.exe
                                          cmd.exe /C start "Open path" "C:\Users\Admin\AppData\Roaming\.minecraft\"
                                          4⤵
                                            PID:1508
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x16c
                                      1⤵
                                        PID:2348
                                      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:2020
                                        • C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe
                                          "C:\Program Files\Java\jre1.8.0_51\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1508
                                          • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exe
                                            C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exe -Xmx1024m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\fluent-hc-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.8.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\hamcrest-core-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore-4.4.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junit-4.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.2914.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.72.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-server-API-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\url-cache-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.923.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.923
                                            3⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks processor information in registry
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2768
                                            • C:\Windows\system32\cmd.exe
                                              cmd.exe /C chcp 437 & wmic CPU get NAME
                                              4⤵
                                                PID:2552
                                                • C:\Windows\system32\chcp.com
                                                  chcp 437
                                                  5⤵
                                                    PID:3580
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic CPU get NAME
                                                    5⤵
                                                      PID:2300
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd.exe /C chcp 437 & set processor
                                                    4⤵
                                                      PID:2136
                                                      • C:\Windows\system32\chcp.com
                                                        chcp 437
                                                        5⤵
                                                          PID:812
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd.exe /C chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                                        4⤵
                                                          PID:1968
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 437
                                                            5⤵
                                                              PID:3916
                                                            • C:\Windows\system32\dxdiag.exe
                                                              dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                                              5⤵
                                                                PID:940
                                                                • C:\Windows\SysWOW64\dxdiag.exe
                                                                  "C:\Windows\SysWOW64\dxdiag.exe" /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                                                  6⤵
                                                                  • Drops file in Windows directory
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1268
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd.exe /C chcp 437 & wmic qfe get HotFixID
                                                              4⤵
                                                                PID:1560
                                                                • C:\Windows\system32\chcp.com
                                                                  chcp 437
                                                                  5⤵
                                                                    PID:3160
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic qfe get HotFixID
                                                                    5⤵
                                                                      PID:2328

                                                            Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  f776849.rbs

                                                                  • Path C:\Config.Msi\f776849.rbs
                                                                  • Size 788KB
                                                                  • SHA256 e4c5e3e026beb7c3ced3d708dc8914991028059f2a58b5bc8be134d81b41a16d
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  f77684f.rbs

                                                                  • Path C:\Config.Msi\f77684f.rbs
                                                                  • Size 8KB
                                                                  • SHA256 db5ae7e977279c99a87f08b945aae4c8e56528f34892664a255a10e3de4a3f72
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  npdeployJava1.dll

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npdeployJava1.dll
                                                                  • Size 1.1MB
                                                                  • SHA256 b3c10bf5498457a76bba3b413d0c54b03a4915e5df72576f976e1ad6d2450012
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  javacpl.exe

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\bin\javacpl.exe
                                                                  • Size 75KB
                                                                  • SHA256 bb80d933bf5c60ee911dc22fcc7d715e4461bc72fd2061da1c74d270c1f73528
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  javaws.exe

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\bin\javaws.exe
                                                                  • Size 314KB
                                                                  • SHA256 60f2898c91ef0f253b61d8325d2d22b2baba1a4a4e1b67d47a40ffac511e95a5
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  charsets.pack

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\lib\charsets.pack
                                                                  • Size 1.0MB
                                                                  • SHA256 91517ff5c74438654956aae554f2951bf508f561b288661433894e517960c2ac
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  deploy.pack

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\lib\deploy.pack
                                                                  • Size 1.8MB
                                                                  • SHA256 80ba80d2a6c20deef6e2f3973337e15e22eec30508899ae998bf191ba725db26
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  localedata.pack

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\lib\ext\localedata.pack
                                                                  • Size 1.3MB
                                                                  • SHA256 7cdc489fa093e924649e82f4eb9689bc1bc0d28e20e37a0a94060efd5428c2db
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  javaws.pack

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\lib\javaws.pack
                                                                  • Size 211KB
                                                                  • SHA256 0a95ab97c85e534b72a369b3ee75200f8075cb14e6f226196b18fd43e6ba42f5
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jsse.pack

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\lib\jsse.pack
                                                                  • Size 150KB
                                                                  • SHA256 5552e52e39c0e7ac423d6939eec367a0c15b4ca699a3a1954f2b191d48a034e6
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  plugin.pack

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\lib\plugin.pack
                                                                  • Size 482KB
                                                                  • SHA256 9948b1c18d71a790e7b5a82d773fea95d25ab67109843a3f3888f3f0ac9d1135
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  rt.pack

                                                                  • Path C:\Program Files\Java\jre1.8.0_51\lib\rt.pack
                                                                  • Size 13.1MB
                                                                  • SHA256 93c1e08034b68e12d78005c2950145595327477c17c1f716248d3e16313b4eec
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  bspatch.exe

                                                                  • Path C:\ProgramData\Oracle\Java\installcache_x64\bspatch.exe
                                                                  • Size 34KB
                                                                  • SHA256 32a4664e367a5c6bc7316d2213e60086d2813c21db3d407350e4aca61c1b16a1
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  diff

                                                                  • Path C:\ProgramData\Oracle\Java\installcache_x64\diff
                                                                  • Size 9.1MB
                                                                  • SHA256 3b3657c83e4f588f0e759cd46e99309cece2ebb54af2c377f9dc087ec764fda8
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  40C68D5626484A90937F0752C8B950AB

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB
                                                                  • Size 834B
                                                                  • SHA256 1dc8a0fcbe260b77adfe5ad9aaac543239b2a0d9f4e1f3c2657beee4376ffee4
                                                                  • MD5 SHA1 SHA512

                                                                  94308059B57B3142E455B38A6EB92015

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                  • Size 70KB
                                                                  • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                                                  • Size 471B
                                                                  • SHA256 a264172c1f386ad788d6723365584799cd5775f339d06599dcc52e971e0cb3ce
                                                                  • MD5 SHA1 SHA512

                                                                  C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
                                                                  • Size 5B
                                                                  • SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
                                                                  • MD5 SHA1 SHA512

                                                                  ECF3006D44DA211141391220EE5049F4

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ECF3006D44DA211141391220EE5049F4
                                                                  • Size 92KB
                                                                  • SHA256 e23f43f3067952ee6c6c970bde26cca1f37294b8a6cc6dc0ea4ebb1b5b8cf346
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  40C68D5626484A90937F0752C8B950AB

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
                                                                  • Size 180B
                                                                  • SHA256 b9dea28198387a263c40eb1d467ec5917344c94dd5bce00fca61e9dc22aea411
                                                                  • MD5 SHA1 SHA512

                                                                  94308059B57B3142E455B38A6EB92015

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                  • Size 342B
                                                                  • SHA256 7dc4ab159838a06a1e7c15e1d69c74b142423c6d9f5f6443b9145c2e7620c277
                                                                  • MD5 SHA1 SHA512

                                                                  94308059B57B3142E455B38A6EB92015

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                  • Size 342B
                                                                  • SHA256 ec702c5d391e3d6d483148370dde33d06616ab6f916b54475ac768f731d4c3a1
                                                                  • MD5 SHA1 SHA512

                                                                  94308059B57B3142E455B38A6EB92015

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                  • Size 342B
                                                                  • SHA256 94ad5547af2efc99cc519126f06be4fb1c31f74a72a32eec1fd3dc1a5facd461
                                                                  • MD5 SHA1 SHA512

                                                                  B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                                                  • Size 400B
                                                                  • SHA256 a8c9e46b1205d4d4626560e58b628957745402ccf4235f814246bba4a6526f0a
                                                                  • MD5 SHA1 SHA512

                                                                  C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
                                                                  • Size 398B
                                                                  • SHA256 be5c1b16a1547ec1e0e565d5d706c605b8e797ebdca212b97847c6a7d4ef2af0
                                                                  • MD5 SHA1 SHA512

                                                                  ECF3006D44DA211141391220EE5049F4

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ECF3006D44DA211141391220EE5049F4
                                                                  • Size 170B
                                                                  • SHA256 22dc79083025cdff9eee66239bcb344b99f54a77f5ae006b1be80a53077b6d15
                                                                  • MD5 SHA1 SHA512

                                                                  deployment.properties

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
                                                                  • Size 1KB
                                                                  • SHA256 b48b48223e6ce41831fe130d812ecd1d2cb53fd3725ec708f641c3a48f733d52
                                                                  • MD5 SHA1 SHA512

                                                                  deployment.properties

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
                                                                  • Size 1KB
                                                                  • SHA256 074274c5271228228cc86e7171000375d7e67d0012f046f7008b19b55456a0ae
                                                                  • MD5 SHA1 SHA512

                                                                  jre1.8.0_51.msi

                                                                  • Path C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.8.0_51_x64\jre1.8.0_51.msi
                                                                  • Size 38.7MB
                                                                  • SHA256 d4bdc230eaebefe5a9aa3d9127d12ac09d050bf51771f0c78a6a9d79a1f9dbf2
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jre-8u51-windows-x64.exe.m03364a.partial

                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\jre-8u51-windows-x64.exe.m03364a.partial
                                                                  • Size 41.2MB
                                                                  • SHA256 3895872bc4cdfb7693c227a435cf6740f968e4fa6ce0f7449e6a074e3e3a0f01
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +JXF11964771992965469662.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+JXF11964771992965469662.tmp
                                                                  • Size 424KB
                                                                  • SHA256 83ff53f599acefc11f5cf63fd0516d4db72aacf7f0125a5f79c9ff222cbf9dd7
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +JXF15000126566412855036.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+JXF15000126566412855036.tmp
                                                                  • Size 132KB
                                                                  • SHA256 9287925cae90ac480804094ff0876832065e2db116470da1f524d79ed9c18b70
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +JXF15138349993838354513.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+JXF15138349993838354513.tmp
                                                                  • Size 113KB
                                                                  • SHA256 8fb821bc49ab6aaa58e915763e92e9e4cc445af3d47309dd738e8e4b7a8271b9
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +JXF1886981626366346616.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+JXF1886981626366346616.tmp
                                                                  • Size 191KB
                                                                  • SHA256 9384b96c3c71d777fe20da8ffec067a4a50802f1ef42a1f3543d2b8059a45add
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +JXF3268463321247011723.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+JXF3268463321247011723.tmp
                                                                  • Size 141KB
                                                                  • SHA256 b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +JXF4092389819160742174.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+JXF4092389819160742174.tmp
                                                                  • Size 169KB
                                                                  • SHA256 02bfb7853a60b1ad2fb0f60fb1ab567d6bc83d043433c3c407b941600435529c
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +JXF6290887510716585795.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+JXF6290887510716585795.tmp
                                                                  • Size 477KB
                                                                  • SHA256 a4ece920f221b78d43b550d615c5934db162b64a331ffa663a85199e74ef2e6b
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +JXF7070515496744756431.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+JXF7070515496744756431.tmp
                                                                  • Size 51KB
                                                                  • SHA256 0bf95b2c365784e76d65857ebcb64630b383ad6c9051b71014d2f32021c0e945
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +~JF14377104994239087637.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+~JF14377104994239087637.tmp
                                                                  • Size 257KB
                                                                  • SHA256 45d5a0ad112e15e1d356d76428419c960d7f71545a0b61a32a1f4e0e9ba60c9e
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +~JF14865243766578716496.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+~JF14865243766578716496.tmp
                                                                  • Size 134KB
                                                                  • SHA256 d0c8f44a774b8490ceee29889cdabc72381fa35fb621619a78fd28211d90241c
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  +~JF17012045041329230870.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\+~JF17012045041329230870.tmp
                                                                  • Size 256KB
                                                                  • SHA256 fce548284667e4ae378441fbe726b0d6a25ba159b8d58b9ec4d8a88dedf55ea1
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  TarBB4C.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\TarBB4C.tmp
                                                                  • Size 181KB
                                                                  • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  200.ico

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
                                                                  • Size 116KB
                                                                  • SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  BrowserInstaller.exe

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
                                                                  • Size 1.6MB
                                                                  • SHA256 4007ca82da52600902ad2e269445e0ae15701187d111ba7f59546c7dfe1fc3dc
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRIMG1.BMP

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
                                                                  • Size 12KB
                                                                  • SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRIMG15.PNG

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG
                                                                  • Size 43KB
                                                                  • SHA256 4d573e91bf0c8cb83127ee7d0f8bd94344dd0d9d80f5212355d405c301a8fb41
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRIMG16.PNG

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG16.PNG
                                                                  • Size 644B
                                                                  • SHA256 ec78b5098bc883fc6c96f46821de3ea9ca11d05faab67b8b560b1dd8aca584c8
                                                                  • MD5 SHA1 SHA512

                                                                  IRIMG18.PNG

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG18.PNG
                                                                  • Size 40KB
                                                                  • SHA256 05b954ed90eb42c480056bcd5101d49a3be83fafb9db0dae8226ba1616d5e402
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRIMG2.BMP

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
                                                                  • Size 12KB
                                                                  • SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRIMG3.BMP

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
                                                                  • Size 12KB
                                                                  • SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRIMG9.PNG

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG
                                                                  • Size 438B
                                                                  • SHA256 6f86d8c78b9da18aed4d1df50cf13fde56754e7d2398c6ccdc44504c4a8a824e
                                                                  • MD5 SHA1 SHA512

                                                                  lua5.1.dll

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                                                  • Size 325KB
                                                                  • SHA256 fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  imageio10853881194483354654.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\imageio10853881194483354654.tmp
                                                                  • Size 127B
                                                                  • SHA256 9d79cb50f6c13050feb806b39af184a37e271581cc7a0b173cc1bbb363bb3a6e
                                                                  • MD5 SHA1 SHA512

                                                                  imageio14624459276654458297.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\imageio14624459276654458297.tmp
                                                                  • Size 9KB
                                                                  • SHA256 762af181612f6b5d5be92aaea0a700aa5c9549fab596a76b9ea610c905742608
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  imageio16458340323207015124.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\imageio16458340323207015124.tmp
                                                                  • Size 1KB
                                                                  • SHA256 c02a9f6b8c168606da91c9003ec51e3681a386277fed6914b6ac5508b319c79f
                                                                  • MD5 SHA1 SHA512

                                                                  imageio2154879339171923136.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\imageio2154879339171923136.tmp
                                                                  • Size 5KB
                                                                  • SHA256 ab54464948dec30d9d13e624bd5e5d0d59ef641b9efdab4eb869fb255a54e357
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  imageio4750309019216298219.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\imageio4750309019216298219.tmp
                                                                  • Size 239B
                                                                  • SHA256 7e20b79a691e10fcd0d78f70723384a4a8d574310adc507d6babbe87ee4f9af5
                                                                  • MD5 SHA1 SHA512

                                                                  imageio8756788127338649062.tmp

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\imageio8756788127338649062.tmp
                                                                  • Size 231B
                                                                  • SHA256 3aa536e4a0eaf52249c31ad4c033cf59af476d71682d0a14656059220f6fd217
                                                                  • MD5 SHA1 SHA512

                                                                  jusched.log

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
                                                                  • Size 9KB
                                                                  • SHA256 1cde7e57c36144349519293f926547e2a7bbd9ceec8d4f4e07219b4abee2bbc5
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jusched.log

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
                                                                  • Size 18KB
                                                                  • SHA256 bf0cc67352bdf027b97dfa8b208e546ae29e33f27f28bfa0a4d06cc8b49331b6
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  ~DF4DC9B224FC8C5A58.TMP

                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~DF4DC9B224FC8C5A58.TMP
                                                                  • Size 16KB
                                                                  • SHA256 2d2a6dec86851191076d8f94b18180a87c40cc10e397b08cf1ee22efa5e22d49
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  TLauncher.exe

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                                                  • Size 9.1MB
                                                                  • SHA256 717f80429e16e7c467a8472dfb0404e22fdf2d67ecd94018b6536dc9d995bff6
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  TlauncherProfiles.json

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\TlauncherProfiles.json
                                                                  • Size 439B
                                                                  • SHA256 ae217040f90cad645180a8cf7223c80f2e9b76cf09a093bc7e82ae161277f6a8
                                                                  • MD5 SHA1 SHA512

                                                                  00e06362a31ad7094e452c5bcea837b061825cb0.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\00\00e06362a31ad7094e452c5bcea837b061825cb0.tlauncherdownload
                                                                  • Size 7KB
                                                                  • SHA256 79196d31b6d4fff4b8cf981ecde1d906aef60e229e7d7157aec7f96bbe246697
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  35f0b3c9c462a6c21ec213fbda2437a0e6427883.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\35\35f0b3c9c462a6c21ec213fbda2437a0e6427883.tlauncherdownload
                                                                  • Size 4KB
                                                                  • SHA256 dc0551c4d6b5eed7065c22ad944e0f056d7ba2d847d22d01d8fb876a7f18c841
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  3cf3e8d3aab0a3092f6c6bf681ff156bc9653859.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\3c\3cf3e8d3aab0a3092f6c6bf681ff156bc9653859.tlauncherdownload
                                                                  • Size 6KB
                                                                  • SHA256 0b8cd1e6db3a92fe03934249934ca739a38509d517388d26e3ab2c10cbc1d7dc
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  8ed3945df8b9264c6451c153357475482d9f2066.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\8e\8ed3945df8b9264c6451c153357475482d9f2066.tlauncherdownload
                                                                  • Size 37KB
                                                                  • SHA256 7e28982f102969a0695f414f927609f3f79cec348f74dcdbe60bd9b0dd9f56b7
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  bc85d96a99e84a234cbe23841f87e84e71198be3.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\bc\bc85d96a99e84a234cbe23841f87e84e71198be3.tlauncherdownload
                                                                  • Size 10KB
                                                                  • SHA256 e91a2ace7d09d3bce417c5694308bc63243541ec23dce15d004432f32f5fdec8
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  c2e4001d9ae8fc1f066a914170faad4c45a84e1e.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\c2\c2e4001d9ae8fc1f066a914170faad4c45a84e1e.tlauncherdownload
                                                                  • Size 7KB
                                                                  • SHA256 876d6c695624352260cf125664d889891104aed72021e95b6b2fb330930d5878
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  c46c7d2a84749bfcbcf576aea0d66fd3deccba31.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\c4\c46c7d2a84749bfcbcf576aea0d66fd3deccba31.tlauncherdownload
                                                                  • Size 6KB
                                                                  • SHA256 1154ea9daaffcc5a96220732b8be5ffedfaf90341dd1d9ac98e91b172070fc96
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  net.properties

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\net.properties
                                                                  • Size 6KB
                                                                  • SHA256 5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  default_local.policy

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\default_local.policy
                                                                  • Size 647B
                                                                  • SHA256 2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441
                                                                  • MD5 SHA1 SHA512

                                                                  exempt_local.policy

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\exempt_local.policy
                                                                  • Size 566B
                                                                  • SHA256 8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9
                                                                  • MD5 SHA1 SHA512

                                                                  LICENSE

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\LICENSE
                                                                  • Size 18KB
                                                                  • SHA256 4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  ASSEMBLY_EXCEPTION.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\ASSEMBLY_EXCEPTION.tlauncherdownload
                                                                  • Size 43B
                                                                  • SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
                                                                  • MD5 SHA1 SHA512

                                                                  LICENSE.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\LICENSE.tlauncherdownload
                                                                  • Size 32B
                                                                  • SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
                                                                  • MD5 SHA1 SHA512

                                                                  COPYRIGHT

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\COPYRIGHT
                                                                  • Size 3KB
                                                                  • SHA256 89471aea3957922df21c7088d2687c4e43f5ff14e635e7d971083dde540b45e3
                                                                  • MD5 SHA1 SHA512

                                                                  LICENSE

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\LICENSE
                                                                  • Size 40B
                                                                  • SHA256 23f9a5c12fa839650595a32872b7360b9e030c7213580fb27dd9185538a5828c
                                                                  • MD5 SHA1 SHA512

                                                                  README.txt

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\README.txt
                                                                  • Size 46B
                                                                  • SHA256 963095cf8db76fb8071fd19a3110718a42f2ab42b27a3adfd9ec58981c3e88d2
                                                                  • MD5 SHA1 SHA512

                                                                  THIRDPARTYLICENSEREADME-JAVAFX.txt

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                                                  • Size 107KB
                                                                  • SHA256 38995534df44e0526f8c8c8d479c778a4b34627cfd69f19213cfbe019a7261ba
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  JavaAccessBridge-64.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\JavaAccessBridge-64.dll
                                                                  • Size 139KB
                                                                  • SHA256 dc3f53a86259d60e82d675ef593a322832a3d9561ff3e0a1cf9c222443252683
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  WindowsAccessBridge-64.dll.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\WindowsAccessBridge-64.dll.tlauncherdownload
                                                                  • Size 108KB
                                                                  • SHA256 69cd12bc4ec5bd7f0e506542b5d47f503f91f2236adbd39e6e191445060cf1e1
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  awt.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\awt.dll
                                                                  • Size 1.4MB
                                                                  • SHA256 ac612d2bc779ccb51cef132cb0a060695ab124f5ab9a94dc29f7692d91509233
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  bci.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\bci.dll
                                                                  • Size 16KB
                                                                  • SHA256 f4f50a215bc327c5f016b55bd57223e242498d0008256a42a0d399d4a7e71f3c
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  dcpr.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\dcpr.dll
                                                                  • Size 156KB
                                                                  • SHA256 9053f78ccf014cad648f65653a433c79390bfd9bc78ed902b1e11f122f9fb34f
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  decora_sse.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\decora_sse.dll
                                                                  • Size 84KB
                                                                  • SHA256 d7a921706d51e59f57a2f7ae89a887f79c9523a8da355a99a6ff7b4c58b5d1ff
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  deployJava1.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\dtplugin\deployJava1.dll
                                                                  • Size 989KB
                                                                  • SHA256 8b90bd96ee62daf37a1bb4b803bee0755c894944e4a41f810e3b74e8a0a3802a
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  eula.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\eula.dll
                                                                  • Size 133KB
                                                                  • SHA256 ce253c68a41d3567034f486d7bc9fad9d4c92edb99e91d551a7123bcc0e5a0e7
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  fontmanager.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\fontmanager.dll
                                                                  • Size 267KB
                                                                  • SHA256 ebc7d009c0bee5a45efa60b0e74c6926fb57e583d3c4e8614442dbaa14f9a874
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  fxplugins.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\fxplugins.dll
                                                                  • Size 183KB
                                                                  • SHA256 bcd0598cc4d26f93e072be401b47663985733a1e9913d6f5d87395bab4a58e93
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  glass.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\glass.dll
                                                                  • Size 250KB
                                                                  • SHA256 0d69c26ce8b1abac19cb9b226e79455f1edbca235a3384cd3a671f158f209e2d
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  instrument.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\instrument.dll
                                                                  • Size 120KB
                                                                  • SHA256 2e9bfb362b1bbcc079bc138fa0bd255f5a623538bd97ef94aaf7d168c0e3471d
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  j2pcsc.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\j2pcsc.dll
                                                                  • Size 18KB
                                                                  • SHA256 bd8d9aced5f039dc09fb6962bdd5a023d86a580ebce3bc71f06915754c33ed79
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  j2pkcs11.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\j2pkcs11.dll
                                                                  • Size 62KB
                                                                  • SHA256 3a698fadaa6376dcb05b8f5e1d2bd5088842ca2fe48781ce2fa4b1f51f197aba
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jaas_nt.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\jaas_nt.dll
                                                                  • Size 20KB
                                                                  • SHA256 c1a880cb336c0cb1e39213a58f58726f419e54dc0990326b0074813c16aef8d4
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jabswitch.exe

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\jabswitch.exe
                                                                  • Size 33KB
                                                                  • SHA256 4219fdd8ea118be869a497a0f777488af516ff087d34b76bed3868d6e8f457c4
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  java-rmi.exe

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\java-rmi.exe
                                                                  • Size 15KB
                                                                  • SHA256 0ca356ea7a0f04094b2d8e2e35748386dcef67a7c216457f89ac8231626ad550
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  javacpl.cpl

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\javacpl.cpl
                                                                  • Size 166KB
                                                                  • SHA256 195957a4ec7b249c714a4b99d2c01b50ef33a1a1c98a7e6a9ae6bc6361079794
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  javafx_font.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\javafx_font.dll
                                                                  • Size 73KB
                                                                  • SHA256 23e7c7d52933f9a3856f28070e283ad536976ce0cbf06600175ab1eb86c9d15b
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  javafx_font_t2k.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\javafx_font_t2k.dll
                                                                  • Size 526KB
                                                                  • SHA256 7cb155cd02afe8020ea958841bbff831d6dcecd465e91ee766500620521fb9d2
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  javafx_iio.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\javafx_iio.dll
                                                                  • Size 133KB
                                                                  • SHA256 57454c33bc533fa038635eaeb5e7d2ee7e7c9090884485d146810960e47be11e
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  javaw.exe.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\javaw.exe.tlauncherdownload
                                                                  • Size 202KB
                                                                  • SHA256 32546ecf1236769d2d777331f90282fb97589bec75da11c8e727d61d3d4c988a
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jfr.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\jfr.dll
                                                                  • Size 26KB
                                                                  • SHA256 f92a630f80bdee6760ec822777fff2f02107fdfe6775adacf1df0249207a3f27
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jfxmedia.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\jfxmedia.dll
                                                                  • Size 135KB
                                                                  • SHA256 a6d925c88809e24d85cb86023cca259fbef81387bb6625de53741286c589672d
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jjs.exe

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\jjs.exe
                                                                  • Size 15KB
                                                                  • SHA256 326d3b02e3edddc9b51a11c3b62bfb79dd60441cc4faa2afbaa60877b4e9de21
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jli.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\jli.dll
                                                                  • Size 170KB
                                                                  • SHA256 d35e289838fb91c55107c76d8224e4c561ac0d37627b19775ae289f551387272
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jp2iexp.dll.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\jp2iexp.dll.tlauncherdownload
                                                                  • Size 283KB
                                                                  • SHA256 db84ba217329dc2131b4082e6b589f29c099a116f7bff49db27ca22aa529cb9e
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  jsoundds.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\jsoundds.dll
                                                                  • Size 30KB
                                                                  • SHA256 9708de28bdf8098527b6c029ea448bc0989e47ad8dbba1b0580f5737645295bc
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  kcms.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\kcms.dll
                                                                  • Size 215KB
                                                                  • SHA256 0588e40307a498df5bbd0596212ed264a179415663bf51e7114dd3772ba30f85
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  keytool.exe

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\keytool.exe
                                                                  • Size 15KB
                                                                  • SHA256 f374d5c3d59bb4d0967c355c0a6a8e723072481925ea3d8b536694affed58ff7
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  net.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\net.dll
                                                                  • Size 92KB
                                                                  • SHA256 6f230ca8eea5f6ed768db850563d4038ae12d9c78ec28ee2eb33184bbcc0ade2
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  nio.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\nio.dll
                                                                  • Size 58KB
                                                                  • SHA256 7f1a54f4f22d0acf09c2f157187a3f4dd2dc53a60edf78941a33bf40bf0fd504
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  prism_common.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\prism_common.dll
                                                                  • Size 56KB
                                                                  • SHA256 8460c620d7f9023bde0671377a0b92af5396f799d955840c3bf7d8d1a52d5197
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  prism_d3d.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\prism_d3d.dll
                                                                  • Size 162KB
                                                                  • SHA256 40dc50b9538c07eaf51f8d96b25b9d2bb07022d06c38fc29ca62294a5e0f9644
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  prism_es2.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\prism_es2.dll
                                                                  • Size 47KB
                                                                  • SHA256 72b349e181e7650cbfc108d2135ce598a689e2711db98de57d2e89a9f0f10284
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  servertool.exe

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\servertool.exe
                                                                  • Size 16KB
                                                                  • SHA256 6450298e910f2cbecacda298db7f5ab1f79fb301db5e8a93f4f46c0266086b99
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  splashscreen.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\splashscreen.dll
                                                                  • Size 205KB
                                                                  • SHA256 bc4f9e01334e4ed1c2883af3030aefce4808cea3d2f406df7f505d645094007a
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  ssv.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\ssv.dll
                                                                  • Size 538KB
                                                                  • SHA256 50b68306c7438ba089690b16533e1ce44f92ff73237597defbdd41de231622cc
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  verify.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\verify.dll
                                                                  • Size 48KB
                                                                  • SHA256 238f96dc1effcb719a9efe8472c34aa880e2cff4af94e26b8a48b5c00695d688
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  w2k_lsa_auth.dll

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\bin\w2k_lsa_auth.dll
                                                                  • Size 23KB
                                                                  • SHA256 c435649e8b088686d08c5fef31167067a3dac6b168e0e4a0a31dc4dae2bccfeb
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  classlist

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\classlist
                                                                  • Size 78KB
                                                                  • SHA256 406b68d923e9ce01f19194bca03eaaf9fc0efce6590713b6d066485cd94d1339
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  CIEXYZ.pf

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\cmm\CIEXYZ.pf
                                                                  • Size 50KB
                                                                  • SHA256 207d748a76c10e5fa10ec7d0494e31ab72f2bacab591371f2e9653961321fe9c
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  GRAY.pf

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\cmm\GRAY.pf
                                                                  • Size 632B
                                                                  • SHA256 081caac386d968add4c2d722776e259380dcf78a306e14cc790b040ab876d424
                                                                  • MD5 SHA1 SHA512

                                                                  ffjcext.zip

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\deploy\ffjcext.zip
                                                                  • Size 13KB
                                                                  • SHA256 4b59033c9c8b45b276d0802bff94c611cef4c620c9e1cb1cf2927783b3da5bd7
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  messages.properties

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\deploy\messages.properties
                                                                  • Size 2KB
                                                                  • SHA256 926ccadaec649f621590d1aa5e915481016564e7ab28390c8d68bdaaf4785f1f
                                                                  • MD5 SHA1 SHA512

                                                                  messages_de.properties

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\deploy\messages_de.properties
                                                                  • Size 3KB
                                                                  • SHA256 c9399a33bb9c75345130b99d1d7ce886d9148f1936543587848c47b8540da640
                                                                  • MD5 SHA1 SHA512

                                                                  messages_sv.properties

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\deploy\messages_sv.properties
                                                                  • Size 3KB
                                                                  • SHA256 5ccee63720fcac2a136cf1fa90cbac05040f89ffe8c082c2d067247bfcd76b87
                                                                  • MD5 SHA1 SHA512

                                                                  messages_zh_CN.properties

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\deploy\messages_zh_CN.properties
                                                                  • Size 3KB
                                                                  • SHA256 a1752a0175f490f61e0aad46dc6887c19711f078309062d5260e164ac844f61a
                                                                  • MD5 SHA1 SHA512

                                                                  messages_zh_HK.properties.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\deploy\messages_zh_HK.properties.tlauncherdownload
                                                                  • Size 3KB
                                                                  • SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
                                                                  • MD5 SHA1 SHA512

                                                                  jaccess.jar

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\jre-legacy\windows\jre-legacy\lib\ext\jaccess.jar
                                                                  • Size 43KB
                                                                  • SHA256 fa110300329b45911946df1a48111878dacfa897bac1f0fad954d19670be5be9
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  One Block MC 2.1.json

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\One Block MC 2.1\One Block MC 2.1.json
                                                                  • Size 47KB
                                                                  • SHA256 cc8e945976966bb569f11429972b3002a380b2bdc5dc490b00e9f3376b90a7a9
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  TLauncherAdditional.json

                                                                  • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\One Block MC 2.1\TLauncherAdditional.json
                                                                  • Size 35KB
                                                                  • SHA256 d1afa787682fb738d3e0d05bea9375d0364098a550b785ac6253a3e7fed34440
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRIMG1.PNG

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNG
                                                                  • Size 45KB
                                                                  • SHA256 0c280eb11d5c15cc34bde953c9fc3b6a61454b3bfa457910a2b19843eca68618
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRIMG10.PNG

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNG
                                                                  • Size 206B
                                                                  • SHA256 d28d35dd7eac3d02d501365b6e264a63bafc58e9620a89d05d320de6571cc785
                                                                  • MD5 SHA1 SHA512

                                                                  IRIMG14.PNG

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG14.PNG
                                                                  • Size 41KB
                                                                  • SHA256 c55b2ad6bd86ef8be2608ad383949ae82237cd47a7a06a7d6cba3f39500aee71
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRIMG3.PNG

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNG
                                                                  • Size 475B
                                                                  • SHA256 969184f6dfeecb188617dd49aed73de00d2776c5bce56b7dc3e8580398afa914
                                                                  • MD5 SHA1 SHA512

                                                                  IRIMG4.PNG

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
                                                                  • Size 368B
                                                                  • SHA256 33ccb0cc6b7af88b812a560309848a722d0030e964c6f3c6151feb216ac20413
                                                                  • MD5 SHA1 SHA512

                                                                  uninstall.xml

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                  • Size 21KB
                                                                  • SHA256 2fbef53c49eeb57053f98e6f54b1e571639e207bfb3a61498deb58e306ddf782
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  uninstall.xml

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                  • Size 3KB
                                                                  • SHA256 0a9a92ed5192329bfb43c57592477c3b959481f44580b4f9bd1fc446be8de580
                                                                  • MD5 SHA1 SHA512

                                                                  uninstall.xml

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                  • Size 3KB
                                                                  • SHA256 1e9118250421d6186d6ff34c860ab11aa4d74dc8d9075d5dce1bdeef45b279a8
                                                                  • MD5 SHA1 SHA512

                                                                  uninstall.xml

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                                                  • Size 4KB
                                                                  • SHA256 ba35392690e89c444028e303229751d5f7e11ee5a5a49103039082cce28c7559
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  say2.ogg.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\repo\resources\sound3\mob\silverfish\say2.ogg.tlauncherdownload
                                                                  • Size 9KB
                                                                  • SHA256 1b41758b85004e8868dcd702f988263bc9b1bea1a345a889ac67b244c5ee5668
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  step3.ogg.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\repo\resources\sound3\mob\silverfish\step3.ogg.tlauncherdownload
                                                                  • Size 9KB
                                                                  • SHA256 9ef93dde57e47710ba7cfc268df4606942ee386710d6b166dd13d21489274acb
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  hurt2.ogg.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\repo\resources\sound3\mob\wither\hurt2.ogg.tlauncherdownload
                                                                  • Size 16KB
                                                                  • SHA256 002768710073c2f0db1fcd56ddaea3c5db789464859a59de20658f17b967d061
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  spawn.ogg.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\repo\resources\sound3\mob\wither\spawn.ogg.tlauncherdownload
                                                                  • Size 148KB
                                                                  • SHA256 c18e5e35b6c6e588bb13346203de9a7c3acf677a5aa101def5b9434ad1d989c5
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  metal3.ogg.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\repo\resources\sound3\mob\zombie\metal3.ogg.tlauncherdownload
                                                                  • Size 8KB
                                                                  • SHA256 1d05c0fdc85d83a1541c298f3bac23136605994e48ec5dcb12d57d1411a279d8
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  wait.mus.tlauncherdownload

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\repo\resources\streaming\wait.mus.tlauncherdownload
                                                                  • Size 31KB
                                                                  • SHA256 82daaeaa3180f31207a21b130e7be8166e4e0b20e721c7d8c4e9f9294cc4dfe4
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  dependencies.json

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\2.923\dependencies.json
                                                                  • Size 17KB
                                                                  • SHA256 a5584b00241e6aa455dce9c0d584d61f8350a7bc07a4137e9289e23f46878721
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  resources.json

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\2.923\resources.json
                                                                  • Size 17KB
                                                                  • SHA256 b0a6157bb0f4da765f93d13ca167017144c5eb15955015b0b42f7d7c0b70599d
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  appConfig.json

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
                                                                  • Size 3KB
                                                                  • SHA256 f725e50dc4377a28b06589b028cd3cff58845d5ed882b22b17129c4413f8b9b3
                                                                  • MD5 SHA1 SHA512

                                                                  javaConfig.json

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.fastrepo.org\tlauncher-sources\prod\release\tlauncher\javaConfig.json
                                                                  • Size 3KB
                                                                  • SHA256 10d0f3646be0a7d73942d7bdd1e55c4b8df0c34cad7ad15a9dc23b2932155007
                                                                  • MD5 SHA1 SHA512

                                                                  COPYRIGHT

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\COPYRIGHT
                                                                  • Size 35B
                                                                  • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
                                                                  • MD5 SHA1 SHA512

                                                                  LICENSE

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\LICENSE
                                                                  • Size 33B
                                                                  • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                                                  • MD5 SHA1 SHA512

                                                                  ADDITIONAL_LICENSE_INFO

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO
                                                                  • Size 51B
                                                                  • SHA256 0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4
                                                                  • MD5 SHA1 SHA512

                                                                  ASSEMBLY_EXCEPTION

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION
                                                                  • Size 46B
                                                                  • SHA256 a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0
                                                                  • MD5 SHA1 SHA512

                                                                  LICENSE

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\LICENSE
                                                                  • Size 35B
                                                                  • SHA256 01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105
                                                                  • MD5 SHA1 SHA512

                                                                  tlauncher-2.0.properties

                                                                  • Path C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties
                                                                  • Size 1KB
                                                                  • SHA256 8d29db212b6f0c15817c538f0c484692587ce811d2986ff1ebe36c5f278d0330
                                                                  • MD5 SHA1 SHA512

                                                                  NLN0ZHZH.txt

                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NLN0ZHZH.txt
                                                                  • Size 512B
                                                                  • SHA256 0b12bbbb284bcee411a0e0f603e01ded622104f715fdf3dbbe1e15cbf05819e1
                                                                  • MD5 SHA1 SHA512

                                                                  f776850.msi

                                                                  • Path C:\Windows\Installer\f776850.msi
                                                                  • Size 660KB
                                                                  • SHA256 b15d3a450b7b3e5ce3194ab9e518796cc5f164c3e28762ffe36966990dcd2fe8
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  msvcr100.dll

                                                                  • Path \Program Files\Java\jre1.8.0_51\bin\msvcr100.dll
                                                                  • Size 809KB
                                                                  • SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  unpack200.exe

                                                                  • Path \Program Files\Java\jre1.8.0_51\bin\unpack200.exe
                                                                  • Size 192KB
                                                                  • SHA256 cc8d67216b1e04d7a41bf62f9c1088cd65a3d21796c5a562851e841b3afa28cf
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  IRZip.lmd

                                                                  • Path \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                                                  • Size 1.7MB
                                                                  • SHA256 89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  Wow64.lmd

                                                                  • Path \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                                                  • Size 97KB
                                                                  • SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  irsetup.exe

                                                                  • Path \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                                                  • Size 1.2MB
                                                                  • SHA256 6682c060e9b5b003430bed3346e4715607cbcd07e2d06584a0cd7cdae5872e45
                                                                  • MD5 SHA1 SHA512 SSDEEP

                                                                  memory/1064-1978-0x00000000004A0000-0x00000000004A3000-memory.dmp

                                                                  memory/1064-635-0x0000000001370000-0x0000000001759000-memory.dmp

                                                                  memory/1064-1977-0x0000000001370000-0x0000000001759000-memory.dmp

                                                                  memory/1064-621-0x0000000010000000-0x0000000010051000-memory.dmp

                                                                  memory/1064-636-0x0000000010000000-0x0000000010051000-memory.dmp

                                                                  memory/1064-1199-0x0000000001370000-0x0000000001759000-memory.dmp

                                                                  memory/1064-1182-0x0000000001370000-0x0000000001759000-memory.dmp

                                                                  memory/1064-622-0x00000000004A0000-0x00000000004A3000-memory.dmp

                                                                  memory/1064-1187-0x0000000010000000-0x0000000010051000-memory.dmp

                                                                  memory/1268-8595-0x0000000000E50000-0x0000000000EAC000-memory.dmp

                                                                  memory/1268-8587-0x0000000000280000-0x000000000028A000-memory.dmp

                                                                  memory/1268-8598-0x0000000000E50000-0x0000000000EAC000-memory.dmp

                                                                  memory/1268-8597-0x0000000000E50000-0x0000000000EAC000-memory.dmp

                                                                  memory/1268-8604-0x0000000000350000-0x000000000037A000-memory.dmp

                                                                  memory/1268-8606-0x0000000000350000-0x000000000037A000-memory.dmp

                                                                  memory/1268-8596-0x0000000000E50000-0x0000000000EAC000-memory.dmp

                                                                  memory/1268-8590-0x0000000000280000-0x000000000028A000-memory.dmp

                                                                  memory/1268-8605-0x0000000000280000-0x000000000028A000-memory.dmp

                                                                  memory/1508-8482-0x0000000000350000-0x000000000035A000-memory.dmp

                                                                  memory/1508-8481-0x0000000000350000-0x000000000035A000-memory.dmp

                                                                  memory/1508-7893-0x0000000000350000-0x000000000035A000-memory.dmp

                                                                  memory/1508-7894-0x0000000000350000-0x000000000035A000-memory.dmp

                                                                  memory/1596-4517-0x0000000001D30000-0x0000000001D3A000-memory.dmp

                                                                  memory/1596-4850-0x0000000001D30000-0x0000000001D3A000-memory.dmp

                                                                  memory/1596-4851-0x0000000001D30000-0x0000000001D3A000-memory.dmp

                                                                  memory/1596-4518-0x0000000001D30000-0x0000000001D3A000-memory.dmp

                                                                  memory/1940-2616-0x0000000001C80000-0x0000000001C8A000-memory.dmp

                                                                  memory/1940-2673-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                  memory/1940-2669-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                  memory/1940-2654-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                  memory/1940-2642-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                  memory/1940-2615-0x0000000001C80000-0x0000000001C8A000-memory.dmp

                                                                  memory/2240-16-0x0000000002BC0000-0x0000000002FA9000-memory.dmp

                                                                  memory/2240-5-0x0000000002BC0000-0x0000000002FA9000-memory.dmp

                                                                  memory/2240-15-0x0000000002BC0000-0x0000000002FA9000-memory.dmp

                                                                  memory/2544-2531-0x0000000000120000-0x0000000000121000-memory.dmp

                                                                  memory/2648-2787-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                                  memory/2648-2785-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                                  memory/2688-2960-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                  memory/2688-2963-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                  memory/2688-2905-0x0000000000460000-0x000000000046A000-memory.dmp

                                                                  memory/2688-2951-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                  memory/2688-2908-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                  memory/2688-2923-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                  memory/2688-2950-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                  memory/2688-2970-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                  memory/2688-4477-0x0000000000460000-0x0000000000462000-memory.dmp

                                                                  memory/2688-3318-0x0000000000460000-0x000000000046A000-memory.dmp

                                                                  memory/2688-2906-0x0000000000460000-0x000000000046A000-memory.dmp

                                                                  memory/2688-3319-0x0000000000460000-0x000000000046A000-memory.dmp

                                                                  memory/2688-2842-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                  memory/2688-2841-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                  memory/2768-8071-0x0000000001D00000-0x0000000001D0A000-memory.dmp

                                                                  memory/2768-8151-0x000000001E660000-0x000000001E66A000-memory.dmp

                                                                  memory/2768-8593-0x000000001E660000-0x000000001E66A000-memory.dmp

                                                                  memory/2768-8591-0x000000001E660000-0x000000001E66A000-memory.dmp

                                                                  memory/2768-8592-0x000000001E660000-0x000000001E66A000-memory.dmp

                                                                  memory/2768-8589-0x0000000001D00000-0x0000000001D0A000-memory.dmp

                                                                  memory/2768-8588-0x0000000001D00000-0x0000000001D0A000-memory.dmp

                                                                  memory/2768-8153-0x000000001E660000-0x000000001E66A000-memory.dmp

                                                                  memory/2768-8152-0x000000001E660000-0x000000001E66A000-memory.dmp

                                                                  memory/2768-8070-0x0000000001D00000-0x0000000001D0A000-memory.dmp

                                                                  memory/2768-8594-0x000000001E660000-0x000000001E66A000-memory.dmp

                                                                  memory/2856-2261-0x00000000002C0000-0x00000000002D7000-memory.dmp

                                                                  memory/2856-2255-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                  memory/2856-2262-0x00000000002C0000-0x00000000002D7000-memory.dmp

                                                                  memory/2856-2266-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                  memory/2856-2267-0x00000000002C0000-0x00000000002CD000-memory.dmp

                                                                  memory/2856-2260-0x00000000002C0000-0x00000000002D7000-memory.dmp

                                                                  memory/2952-2611-0x0000000000310000-0x0000000000311000-memory.dmp

                                                                  memory/3108-2677-0x0000000000350000-0x000000000035A000-memory.dmp

                                                                  memory/3108-2720-0x0000000000110000-0x0000000000111000-memory.dmp

                                                                  memory/3108-2714-0x0000000000110000-0x0000000000111000-memory.dmp

                                                                  memory/3620-2768-0x0000000000110000-0x0000000000111000-memory.dmp

                                                                  memory/3620-2765-0x0000000000110000-0x0000000000111000-memory.dmp

                                                                  memory/3628-5166-0x000000001ECC0000-0x000000001ECCA000-memory.dmp

                                                                  memory/3628-5167-0x000000001ECC0000-0x000000001ECCA000-memory.dmp

                                                                  memory/3628-4732-0x000000001ECC0000-0x000000001ECCA000-memory.dmp

                                                                  memory/3628-5163-0x000000001ECC0000-0x000000001ECCA000-memory.dmp

                                                                  memory/3628-4733-0x000000001ECC0000-0x000000001ECCA000-memory.dmp

                                                                  memory/3628-4656-0x0000000002240000-0x000000000224A000-memory.dmp

                                                                  memory/3628-4657-0x0000000002240000-0x000000000224A000-memory.dmp

                                                                  memory/3772-1981-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                  memory/3932-5168-0x0000000002050000-0x00000000020AC000-memory.dmp

                                                                  memory/3932-5161-0x00000000007D0000-0x00000000007DA000-memory.dmp

                                                                  memory/3932-5169-0x0000000002050000-0x00000000020AC000-memory.dmp

                                                                  memory/3932-5176-0x0000000000BD0000-0x0000000000BFA000-memory.dmp

                                                                  memory/3932-5175-0x0000000000BD0000-0x0000000000BFA000-memory.dmp

                                                                  memory/3932-5162-0x00000000007D0000-0x00000000007DA000-memory.dmp

                                                                  memory/3932-5164-0x0000000002050000-0x00000000020AC000-memory.dmp

                                                                  memory/3932-5165-0x0000000002050000-0x00000000020AC000-memory.dmp

                                                                  memory/4012-2807-0x0000000000400000-0x0000000000417000-memory.dmp