Overview

overview

8

Static

static

1

TLauncher-....8.exe

windows7-x64

8

TLauncher-....8.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 20:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-Installer-1.4.8.exe

  • Size

    24.1MB

  • MD5

    ff77de2eb5a4366f68735e22ce263d3c

  • SHA1

    8758fe1d1ab6359e3011a41e35529185f75a0b99

  • SHA256

    d896da5d7f9f64d5375d41081a29f93dce7bf14c1974c9cde8979ee7a98b522f

  • SHA512

    30ef806a6dd951ae33e05e40f99577675bc4dfab0a8fe6d239ebbb46e026899484e140af36e41959ea29886e54d49022cbe5c7e4dcdaffcdab67ae85f7976e60

  • SSDEEP

    786432:WKqHyU7V5bJmM9irrKJBH5lFRqH0fYk/pUJ8a:WKay+sMQPKJBZlCUfYSpUJ8

Score
8/10
adwarediscoverypersistenceprivilege_escalationstealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 28 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.8.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.8.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.8.exe" "__IRCT:3" "__IRTSS:25232442" "__IRSID:S-1-5-21-3450744190-3404161390-554719085-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1252
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1679762 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1709878" "__IRSID:S-1-5-21-3450744190-3404161390-554719085-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:1736
      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
        "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Users\Admin\AppData\Local\Temp\jds259467305.tmp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jds259467305.tmp\jre-windows.exe" "STATIC=1"
          4⤵
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:300
          • C:\Program Files\Java\jre-1.8\bin\javaw.exe
            -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
            5⤵
            • Executes dropped EXE
            PID:2688
          • C:\Program Files\Java\jre-1.8\bin\javaw.exe
            -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
            5⤵
            • Executes dropped EXE
            PID:372
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:236
        • C:\Program Files\Java\jre-1.8\bin\javaw.exe
          "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3984
          • C:\Windows\system32\icacls.exe
            C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
            5⤵
            • Modifies file permissions
            PID:2472
          • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exe
            C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exe -Xmx1024m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\fluent-hc-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.8.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\hamcrest-core-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore-4.4.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junit-4.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.2914.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.72.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-server-API-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\url-cache-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.924.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.924
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Network Configuration Discovery: Internet Connection Discovery
            • System Time Discovery
            • Checks processor information in registry
            • Suspicious use of SetWindowsHookEx
            PID:3084
            • C:\Windows\system32\cmd.exe
              cmd.exe /C chcp 437 & wmic CPU get NAME
              6⤵
                PID:3172
                • C:\Windows\system32\chcp.com
                  chcp 437
                  7⤵
                    PID:1916
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic CPU get NAME
                    7⤵
                      PID:472
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /C chcp 437 & set processor
                    6⤵
                      PID:2388
                      • C:\Windows\system32\chcp.com
                        chcp 437
                        7⤵
                          PID:304
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /C chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                        6⤵
                          PID:736
                          • C:\Windows\system32\chcp.com
                            chcp 437
                            7⤵
                              PID:2592
                            • C:\Windows\system32\dxdiag.exe
                              dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                              7⤵
                                PID:300
                                • C:\Windows\SysWOW64\dxdiag.exe
                                  "C:\Windows\SysWOW64\dxdiag.exe" /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                  8⤵
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1524
                            • C:\Windows\system32\cmd.exe
                              cmd.exe /C chcp 437 & wmic qfe get HotFixID
                              6⤵
                                PID:3308
                                • C:\Windows\system32\chcp.com
                                  chcp 437
                                  7⤵
                                    PID:3288
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic qfe get HotFixID
                                    7⤵
                                      PID:3256
                        • C:\Windows\system32\msiexec.exe
                          C:\Windows\system32\msiexec.exe /V
                          1⤵
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • Blocklisted process makes network request
                          • Enumerates connected drives
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1692
                          • C:\Windows\system32\MsiExec.exe
                            C:\Windows\system32\MsiExec.exe -Embedding 89A5D05912535C34CFDD0FD943D07D15
                            2⤵
                            • Loads dropped DLL
                            PID:2680
                          • C:\Program Files\Java\jre-1.8\installer.exe
                            "C:\Program Files\Java\jre-1.8\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre-1.8\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={71024AE4-039E-4CA4-87B4-2F64180401F0}
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Installs/modifies Browser Helper Object
                            • Drops file in System32 directory
                            • Modifies Internet Explorer settings
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:1968
                            • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                              "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops file in Program Files directory
                              PID:2152
                            • C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
                              "C:\Program Files\Java\jre-1.8\bin\ssvagent.exe" -doHKCUSSVSetup
                              3⤵
                              • Executes dropped EXE
                              • Modifies registry class
                              PID:2616
                            • C:\Program Files\Java\jre-1.8\bin\javaws.exe
                              "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -permissions -silent
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:2740
                              • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
                                "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
                                4⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:2384
                            • C:\Program Files\Java\jre-1.8\bin\javaws.exe
                              "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -shortcut -silent
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:2044
                              • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
                                "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
                                4⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:2160
                          • C:\Windows\system32\MsiExec.exe
                            C:\Windows\system32\MsiExec.exe -Embedding 91C5D7A1A7E1F338A44952A4ADE9C017 M Global\MSI0000
                            2⤵
                              PID:1500
                            • C:\Windows\syswow64\MsiExec.exe
                              C:\Windows\syswow64\MsiExec.exe -Embedding 3147C11DDB17B7C4FD855F3F0EF84DD9
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:328
                            • C:\Windows\syswow64\MsiExec.exe
                              C:\Windows\syswow64\MsiExec.exe -Embedding 27274D291BDFB2249EAAF11BB171746E M Global\MSI0000
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2420
                          • C:\Windows\system32\AUDIODG.EXE
                            C:\Windows\system32\AUDIODG.EXE 0x5ac
                            1⤵
                              PID:3364

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Browser Extensions

                                  1
                                  T1176

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Component Object Model Hijacking

                                  1
                                  T1546.015

                                  Defense Evasion

                                  File and Directory Permissions Modification

                                  1
                                  T1222

                                  Modify Registry

                                  4
                                  T1112

                                  Subvert Trust Controls

                                  1
                                  T1553

                                  Install Root Certificate

                                  1
                                  T1553.004

                                  Credential Access

                                  Discovery

                                  Peripheral Device Discovery

                                  1
                                  T1120

                                  Query Registry

                                  4
                                  T1012

                                  Software Discovery

                                  1
                                  T1518

                                  Security Software Discovery

                                  1
                                  T1518.001

                                  System Information Discovery

                                  4
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  System Network Configuration Discovery

                                  1
                                  T1016

                                  Internet Connection Discovery

                                  1
                                  T1016.001

                                  System Time Discovery

                                  1
                                  T1124

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Config.Msi\f773ad3.rbs
                                    Filesize

                                    962KB

                                    MD5

                                    f4a932987a75533064aaf4be7e527079

                                    SHA1

                                    6050f56237389d10d004d2989ce2848b25392179

                                    SHA256

                                    ce93c13802f77a06894f6ca45cbdce1565bf05a404ece32927d7ee4ab555c2ec

                                    SHA512

                                    8c44a90a20e66cf540c1642565a616f328385b9f07a8cc104a37c0c17a308d4588a3498362f9f1b44c89eb2f89fab8609b1cf9536ee89a1924c60f3258d46926

                                    Download Submit

                                  • C:\Config.Msi\f773ad9.rbs
                                    Filesize

                                    7KB

                                    MD5

                                    e89483a790f831fe5514d8c80be2cd97

                                    SHA1

                                    a64b1ad31a1445dd856c4da949a591cf0d447e7d

                                    SHA256

                                    b092c4747ea73d41708bdb204b9cd9231ec242f69695af9e01325d8639181562

                                    SHA512

                                    23e3e12e2909eed98279aa55f54f2d7297c2b5815eb30b29d43a3d24cb83980ec0bece8cf2e056024d5f665ccb77405006b4bb6b0a12c1337393328a015d13f5

                                    Download Submit

                                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk
                                    Filesize

                                    197B

                                    MD5

                                    b5e1de7d05841796c6d96dfe5b8b338c

                                    SHA1

                                    c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547

                                    SHA256

                                    062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d

                                    SHA512

                                    963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d

                                    Download Submit

                                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
                                    Filesize

                                    177B

                                    MD5

                                    6684bd30905590fb5053b97bfce355bc

                                    SHA1

                                    41f6b2b3d719bc36743037ae2896c3d5674e8af7

                                    SHA256

                                    aa4868d35b6b3390752a5e34ab8e5cba90217e920b8fb8a0f8e46edc1cc95a20

                                    SHA512

                                    1748ab352ba2af943a9cd60724c4c34b46f3c1e6112df0c373fa9ba8cb956eb548049a0ac0f4dccff6b5f243ff2d6d210661f0c77b9e1e3d241a404b86d54644

                                    Download Submit

                                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url
                                    Filesize

                                    173B

                                    MD5

                                    625bd85c8b8661c2d42626fc892ee663

                                    SHA1

                                    86c29abb8b229f2d982df62119a23976a15996d9

                                    SHA256

                                    63c2e3467e162e24664b3de62d8eeb6a290a8ffcdf315d90e6ca14248bc0a13a

                                    SHA512

                                    07708de888204e698f72d8a8778ed504e0fe4d159191efb48b815852e3997b50a27ba0bc8d9586c6fb4844166f38f5f9026a89bbbc3627e78121373982656f12

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C
                                    Filesize

                                    579B

                                    MD5

                                    f55da450a5fb287e1e0f0dcc965756ca

                                    SHA1

                                    7e04de896a3e666d00e687d33ffad93be83d349e

                                    SHA256

                                    31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

                                    SHA512

                                    19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                    Filesize

                                    471B

                                    MD5

                                    0b6b182da46940ba2dcc40a27ee778ee

                                    SHA1

                                    20970ba4d9f7dfa57a6892a951d26e30729435b1

                                    SHA256

                                    7b0e584830fcce28db4131989d3ef03c9b28ee2d4a3cf97f83f7dee7b41ad712

                                    SHA512

                                    e2b4feecd312ad9485938a7d7484aec0703a539c29319251f675e597d17278a540be201723e7e3fdb76ae26042c1015032a20790c0184e64e7e9327e3620c8d8

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C
                                    Filesize

                                    252B

                                    MD5

                                    cfe55d2d0d8cfcd920bff54f2e464542

                                    SHA1

                                    0736c36a618fbd744c7919599a32faccf9b9101e

                                    SHA256

                                    836863f5255a12bdd40e1d06cff4460666ee7edbe458e681864d0dee7bfd59f6

                                    SHA512

                                    b4fa5e56886de7b00053fac419b8befd05c4332290b33e9c48e0ecbbd54e04116eabf33e7fe160c63850ea710aecdc81449d3f259882942b4fbf9ebd344196a2

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                    Filesize

                                    304B

                                    MD5

                                    2e156cf323bd886d457d590989ab5033

                                    SHA1

                                    802d6323ab8a38c58f8444784f173c4828f146c8

                                    SHA256

                                    340ebd83dba73c67858a2fc5105a844217c671a14bd86362e0ef580b60a0f160

                                    SHA512

                                    c6526ebd67cd524192fa6263a5b512da0cd70fc7c3a14343397635edb1710037badca93ceb64b1461ebc6cba675d34674f7692adb43b59c59db12656b78c7cee

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                    Filesize

                                    304B

                                    MD5

                                    92723137e4b658f96307d7dd38c17ead

                                    SHA1

                                    b5c50c8bf5558f23d7ee0149839b6ce5113b803c

                                    SHA256

                                    59568a4b1f29d00c0af7dd2c3f583e40daa4304bf1bccd420c6823d11b8cd57a

                                    SHA512

                                    a7670e2991e00be699309e6a8712e3e2d7c5a6712a9e42d21f1277dd58e8780f0599e9724aa9270051daa8e2a9e58225f594e7451dcce3b71d5933f29d39f961

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                    Filesize

                                    304B

                                    MD5

                                    8b88514e5f7c9303a644592d8fd7f7cb

                                    SHA1

                                    3ed6df1e6540161bf27a3832bfb41421457cdfa1

                                    SHA256

                                    b86343553bc281e07f331b98aa22d248cf82f25badad0309af2bce197104c547

                                    SHA512

                                    24897797a4c4d734ffb5dbb8d0bad537f2b27810a5fdefb17f5a53f9aa3c7d7676086f7738c311010bb6b43b5ce6449ec5d97261bf9f5f42875ccd8b5af7f020

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                    Filesize

                                    400B

                                    MD5

                                    28ad6fc159c4d6855f9d50a52a41ab4a

                                    SHA1

                                    f2d837aac0816fbfc2e4a3c72e06eb9e72cd57de

                                    SHA256

                                    2d9be30dd571233ce3a7f1b89487845b95ba9a18f2ab93c6b6b51c5545357a26

                                    SHA512

                                    0bde9e2b7f20ca20f231fde1ecce7f184cf6dc7210311bde6cda2bee3f39a8f919ecc39fb25f35e4555178bbe4c643f4b9fd6fab3c57e4572cd1199627b56f4c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2LF9I1AK\l10n[1]
                                    Filesize

                                    4KB

                                    MD5

                                    1fd5111b757493a27e697d57b351bb56

                                    SHA1

                                    9ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711

                                    SHA256

                                    85bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f

                                    SHA512

                                    80f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2LF9I1AK\masthead_fill[1]
                                    Filesize

                                    1KB

                                    MD5

                                    91a7b390315635f033459904671c196d

                                    SHA1

                                    b996e96492a01e1b26eb62c17212e19f22b865f3

                                    SHA256

                                    155d2a08198237a22ed23dbb6babbd87a0d4f96ffdc73e0119ab14e5dd3b7e00

                                    SHA512

                                    b3c8b6f86ecf45408ac6b6387ee2c1545115ba79771714c4dd4bbe98f41f7034eae0257ec43c880c2ee88c44e8fc48c775c5bb4fd48666a9a27a8f8ac6bcfdcb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MP1SLKR\host[1]
                                    Filesize

                                    1KB

                                    MD5

                                    a752a4469ac0d91dd2cb1b766ba157de

                                    SHA1

                                    724ae6b6d6063306cc53b6ad07be6f88eaffbab3

                                    SHA256

                                    1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3

                                    SHA512

                                    abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MP1SLKR\layout[1]
                                    Filesize

                                    2KB

                                    MD5

                                    cc86b13a186fa96dfc6480a8024d2275

                                    SHA1

                                    d892a7f06dc12a0f2996cc094e0730fe14caf51a

                                    SHA256

                                    fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058

                                    SHA512

                                    0e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MP1SLKR\masthead_left[1]
                                    Filesize

                                    4KB

                                    MD5

                                    b663555027df2f807752987f002e52e7

                                    SHA1

                                    aef83d89f9c712a1cbf6f1cd98869822b73d08a6

                                    SHA256

                                    0ce32c034dfb7a635a7f6e8152666def16d860b6c631369013a0f34af9d17879

                                    SHA512

                                    b104ed3327fed172501c5aa990357b44e3b31bb75373fb8a4ea6470ee6a72e345c9dc4bcf46a1983c81adb567979e6e8e6517d943eb204c3f7fac559cd17c451

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4UQ4J2DQ\common[1]
                                    Filesize

                                    1KB

                                    MD5

                                    f5bb484d82e7842a602337e34d11a8f6

                                    SHA1

                                    09ea1dee4b7c969771e97991c8f5826de637716f

                                    SHA256

                                    219108bfef63f97562c4532681b03675c9e698c5ae495205853dbcbfd93faf1a

                                    SHA512

                                    a23cc05b94842e1f3a53c2ea8a0b78061649e0a97fcd51c8673b2bcb6de80162c841e9fdde212d3dfd453933df2362dcb237fe629f802bafaa144e33ca78b978

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\69P6875H\rtutils[1]
                                    Filesize

                                    244B

                                    MD5

                                    c0a4cebb2c15be8262bf11de37606e07

                                    SHA1

                                    cafc2ccb797df31eecd3ae7abd396567de8e736d

                                    SHA256

                                    7da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1

                                    SHA512

                                    cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\69P6875H\runtime[1]
                                    Filesize

                                    42KB

                                    MD5

                                    5d4657b90d2e41960ebe061c1fd494b8

                                    SHA1

                                    71eca85088ccbd042cb861c98bccb4c7dec9d09d

                                    SHA256

                                    93a647b1f2cadcbdb0fe9c46b82b2b4baf7685167de05933811549145c584ee0

                                    SHA512

                                    237738c0a6cb25efe29effc9c3637245e3e2397207ed51e67bae5a1b54749f88e090de524f7868d964debbb29a920a68205ccbd2dfceed4a1f3cd72d08b16fa3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\+JXF12074155502833124199.tmp
                                    Filesize

                                    477KB

                                    MD5

                                    ec5d243a9958b3858b5a71fb9a690da7

                                    SHA1

                                    d80b02c91addef2ef58136d1a7df0189f453388c

                                    SHA256

                                    a4ece920f221b78d43b550d615c5934db162b64a331ffa663a85199e74ef2e6b

                                    SHA512

                                    479512c6076249a63a822d307b3d8c65d44d19abfadc597f0293fedf2c4fbac2ba6f60ca98d2c1dbb638ad09f3eb1419b6ef391fb098c7d1b62237bce9d79931

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\+JXF12631168623468796833.tmp
                                    Filesize

                                    132KB

                                    MD5

                                    afa7a91dadd77b23634a0fdf18c148f3

                                    SHA1

                                    6cbb57ba2355cf442e06899898ff5af55867103e

                                    SHA256

                                    9287925cae90ac480804094ff0876832065e2db116470da1f524d79ed9c18b70

                                    SHA512

                                    84d123b67505522c256f4ff79c3822eabe2d63036023896e9854298ff39e050bef7894f6320ccf950592015760354683c4dbd19aa203d433a04a5d6bb28e8115

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\+JXF12718200632553851384.tmp
                                    Filesize

                                    424KB

                                    MD5

                                    4c41e856744eb797e9936359a6509287

                                    SHA1

                                    0959e6f4dd535eb6fae388b6b9ac179dcf3afd76

                                    SHA256

                                    83ff53f599acefc11f5cf63fd0516d4db72aacf7f0125a5f79c9ff222cbf9dd7

                                    SHA512

                                    07ae284caa316315da74246c960198a7d549acf86f96cec550f41109fcd870a69ccac9818361657fb859e89d2bdc8398c7731c80d274d99a768102022a5f6e8b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\+JXF3525437894214157648.tmp
                                    Filesize

                                    141KB

                                    MD5

                                    54a91b0619ccf9373d525109268219dc

                                    SHA1

                                    1d1d41fcadc571decb6444211b7993b99ce926e2

                                    SHA256

                                    b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f

                                    SHA512

                                    7f79ff3b42a672371814f42814aa5646328b1a314691d30ce09ffdc7a322adcb1af66625274f7fac024ca2f22a42b625001735711c430faef6e077e1f1d24887

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\Cab70B0.tmp
                                    Filesize

                                    70KB

                                    MD5

                                    49aebf8cbd62d92ac215b2923fb1b9f5

                                    SHA1

                                    1723be06719828dda65ad804298d0431f6aff976

                                    SHA256

                                    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                    SHA512

                                    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\Tar70C3.tmp
                                    Filesize

                                    181KB

                                    MD5

                                    4ea6026cf93ec6338144661bf1202cd1

                                    SHA1

                                    a1dec9044f750ad887935a01430bf49322fbdcb7

                                    SHA256

                                    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                    SHA512

                                    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
                                    Filesize

                                    116KB

                                    MD5

                                    e043a9cb014d641a56f50f9d9ac9a1b9

                                    SHA1

                                    61dc6aed3d0d1f3b8afe3d161410848c565247ed

                                    SHA256

                                    9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

                                    SHA512

                                    4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
                                    Filesize

                                    1.6MB

                                    MD5

                                    199e6e6533c509fb9c02a6971bd8abda

                                    SHA1

                                    b95e5ef6c4c5a15781e1046c9a86d7035f1df26d

                                    SHA256

                                    4257d06e14dd5851e8ac75cd4cbafe85db8baec17eaebd8f8a983b576cd889f8

                                    SHA512

                                    34d90fa78bd5c26782d16421e634caec852ca74b85154b2a3499bc85879fc183402a7743dd64f2532b27c791df6e9dd8113cc652dcb0cdf3beae656efe79c579

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
                                    Filesize

                                    12KB

                                    MD5

                                    3adf5e8387c828f62f12d2dd59349d63

                                    SHA1

                                    bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a

                                    SHA256

                                    1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0

                                    SHA512

                                    e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG
                                    Filesize

                                    43KB

                                    MD5

                                    92a58d4723329aef02eca2b8a6e93024

                                    SHA1

                                    dc8d96efd202343e40a12a1b51adcc8328b436fc

                                    SHA256

                                    7d75bce82c63370307200c2528783b8b6e460ad7f2386c82faf23e028896620b

                                    SHA512

                                    3a7824203b4a12d6257a4a54f8ffeebe11f81b964a6fbd373efa01dddb6d3b80f159dad385f454a5ebab257d0aa7621f19f367b2987407b9206859c159483104

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG16.PNG
                                    Filesize

                                    644B

                                    MD5

                                    1468502e3f45c3c0a2ffe773591382be

                                    SHA1

                                    be58257e0f5142e6410a22546cc1b6ac0ef0ebc5

                                    SHA256

                                    4845843e4d406900aee87be95ddf84a9272d6660d294f8166b6012657b7a5849

                                    SHA512

                                    2e7f3b52a75d961c39fca45f0a8d2868374f3a543419a4d15fea5b874553ae15052740aa93e04e1a5966c97b4d182ff5171e4237b4e283304af819ab771408d1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG18.PNG
                                    Filesize

                                    40KB

                                    MD5

                                    10435cc0577cbd746d1855b1d0941e2e

                                    SHA1

                                    61c54d525919dc92540157fb856253d22514a46f

                                    SHA256

                                    d67c14da63fbf4e571195999898f593becb59783f7b9360417d890c2edf3cbef

                                    SHA512

                                    35d1aa70cdc8f791d1f327bcd2b51d3a88448f338762fc87ff97459c7c1a5860127e8bc66ad9cf5f5f4fc9a5bf752b8749c88c86eee13817d24a5a615bc26ac6

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
                                    Filesize

                                    12KB

                                    MD5

                                    f35117734829b05cfceaa7e39b2b61fb

                                    SHA1

                                    342ae5f530dce669fedaca053bd15b47e755adc2

                                    SHA256

                                    9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3

                                    SHA512

                                    1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
                                    Filesize

                                    12KB

                                    MD5

                                    f5d6a81635291e408332cc01c565068f

                                    SHA1

                                    72fa5c8111e95cc7c5e97a09d1376f0619be111b

                                    SHA256

                                    4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26

                                    SHA512

                                    33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG49.BMP
                                    Filesize

                                    1.8MB

                                    MD5

                                    5c9fb63e5ba2c15c3755ebbef52cabd2

                                    SHA1

                                    79ce7b10a602140b89eafdec4f944accd92e3660

                                    SHA256

                                    54ee86cd55a42cfe3b00866cd08defee9a288da18baf824e3728f0d4a6f580e7

                                    SHA512

                                    262c50e018fd2053afb101b153511f89a77fbcfd280541d088bbfad19a9f3e54471508da8b56c90fe4c1f489b40f9a8f4de66eac7f6181b954102c6b50bdc584

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
                                    Filesize

                                    325KB

                                    MD5

                                    c333af59fa9f0b12d1cd9f6bba111e3a

                                    SHA1

                                    66ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0

                                    SHA256

                                    fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34

                                    SHA512

                                    2f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
                                    Filesize

                                    151KB

                                    MD5

                                    c2be5f72a6cb93af45f70fcd786149a6

                                    SHA1

                                    91a3250d829e7019c7b96dc2886f1d961169a87f

                                    SHA256

                                    f616ad0cc12e4c8c01b1af5dd208aae46a5fdb1b02e8a192dfe84283e1161ca6

                                    SHA512

                                    522b82e48fc4d6c94236f6598352ef198500ef83f2b8d890dd14901173b35d179c567e9540908a9bf145f2492043fa6848182634ee4c58956418884449f223bb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\jusched.log
                                    Filesize

                                    3KB

                                    MD5

                                    053cf2f185f396a5710a600edae3da6b

                                    SHA1

                                    459636efec8d4a980f5bea395f92a20ba37cff1a

                                    SHA256

                                    fd9ba3049763cc0dcb81853dc9f15064cacd9c602263997c79ab8fa357405a42

                                    SHA512

                                    f733107acd53fd3170d29e39bd5ea014535184b19da06a0bea03499d1adb51b93adc0d260eaf586ff9e4140d3d380cea1b4735853ae387699456e1fc3615f03e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\jusched.log
                                    Filesize

                                    4KB

                                    MD5

                                    8b79dadc7cd9ff5a7ca130b8f9fd0785

                                    SHA1

                                    837a48ab27c1505d6af57816cfe34e949d513f69

                                    SHA256

                                    729d942df375784047a10aad924f099932d6766ee72e284cad1ddc65b49a9fd2

                                    SHA512

                                    1a9264575096c293ee4cad6759b65823a697301dbe0883cb2742eaae431ed2ae8673ba2ced3f2c971a0ed12a5ccfb25f71ee2e09f87f02eac8cb358b6df87e44

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\jusched.log
                                    Filesize

                                    24KB

                                    MD5

                                    8a1888e2ec473fb4021520548a08cb6c

                                    SHA1

                                    1f8afd48cce34c7ff9e288355e835d8c1fa5bc77

                                    SHA256

                                    ae3052ba639514025f70e74f2080508ccec3136a48b52839911813edc7767733

                                    SHA512

                                    eea76cf9a9a2dbfa230b2a7d59d9514930730537a85ec633647e4e648fe2d911f204835a739e156490bd82821f329159dce4041eeef48456fa6ff12ba0b637eb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
                                    Filesize

                                    750B

                                    MD5

                                    81c2be7e4b041f381054348b4bb65051

                                    SHA1

                                    41bc29fd2b4592b506073471752bc7b8d430ac95

                                    SHA256

                                    d03a791411f127c3f698460a0e09d6ab4473925590078f95ea3ac8ca2dc0787e

                                    SHA512

                                    9a083bafa753c1326f8928995707fb20a764965ce398f740e2d26e408503740c4210987e4dd37328adf90e594d1ddb34e74a1fd355ae664f41d7bc8f93eb03db

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
                                    Filesize

                                    9.1MB

                                    MD5

                                    833512c89f1ab92c80131d415f89f442

                                    SHA1

                                    dd9953ddcc33278bb97502ffdc6e7462e8005680

                                    SHA256

                                    717f80429e16e7c467a8472dfb0404e22fdf2d67ecd94018b6536dc9d995bff6

                                    SHA512

                                    f23201251ea19b6122f60a788a027bd59aca1233b17b265709a51a2babc1eea1394a4400eadcc6792bb5f9843d73a95660f60f487779cbfc05766f53fa3ef3d1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\TlauncherProfiles.json
                                    Filesize

                                    427B

                                    MD5

                                    f3ab134b3761c520cae26c6db266e207

                                    SHA1

                                    66c1484c41ff8d2c41c5392395abedb8e9c2fc3b

                                    SHA256

                                    e0e30e2fe880321fbacb0b904dcff8db0dbb1c7ad43f62faee5ed37839944f6f

                                    SHA512

                                    673f7ecf612d468a7c167aa887706087204e97151d433cfc47c8783ef1a554ec56f44df686abf9bc981f58c9227a7d5b0c99c75aefc53f55ad90f9265cde061a

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\logging.properties
                                    Filesize

                                    2KB

                                    MD5

                                    0f00ec3e7a7767a4efeae1875fb5f3d4

                                    SHA1

                                    167808418571e9209b952188ddab2f4e62920e68

                                    SHA256

                                    b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f

                                    SHA512

                                    e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\net.properties
                                    Filesize

                                    6KB

                                    MD5

                                    385443b7e4a37bc277c018cd1d336d49

                                    SHA1

                                    b2c0dfb00bf699e817bdd49b14bc24b8d3282c65

                                    SHA256

                                    5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08

                                    SHA512

                                    260afc7671a1dc0c443564f1d10386f0b241bb53c76df68d8d03f1d0b1ceaf3f68847ab3477732c876c2b01c812ef7521744befe88e312f3aa63164b608b67a1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\README.txt
                                    Filesize

                                    2KB

                                    MD5

                                    3d47d94bc4f19d18bcc8b23f51d013af

                                    SHA1

                                    a97cd312d6a2a9c8c780c15e5af51a2f4f97c2cb

                                    SHA256

                                    6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5

                                    SHA512

                                    68a031264cf9442526307364ca74b336af55564c233c2f514cac48e910022767562f8ff6a64bb9cfcbf0fb5e755289273382c9246418a4b9207fc7761d03c64e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\default_US_export.policy.tlauncherdownload
                                    Filesize

                                    146B

                                    MD5

                                    1a08ffdf0bc871296c8d698fb22f542a

                                    SHA1

                                    f3f974d3f6245c50804dcc47173aa29d4d7f0e2c

                                    SHA256

                                    758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9

                                    SHA512

                                    4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\default_local.policy
                                    Filesize

                                    647B

                                    MD5

                                    6d7b4616a5dba477b6b6d3f9a12e568f

                                    SHA1

                                    7fb67e217c53a685cb9314001592b5bd50b5fbb9

                                    SHA256

                                    2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441

                                    SHA512

                                    a0b98cbbb49184df973bb2c4a506e9bc6e025a696bc0c8054a6352cc3f9b4a38e3baf117c6834ddaddc38498556607ed4eda8f1bc683f662d61da50e0db0c8c2

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\exempt_local.policy
                                    Filesize

                                    566B

                                    MD5

                                    4cbb03f484c86cbea1a217baae07d3c9

                                    SHA1

                                    ee67275bc119c98191a09ff72f043872b05ab7fd

                                    SHA256

                                    8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9

                                    SHA512

                                    2bd70518aed6b0e01c520c446830c5f567fa72974548818cac3e1e5c2be6f03db78ce6012f5463b1e19c36243d04cbaad38ec79524635eaae2e427eb1875ccdb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\unlimited\default_local.policy
                                    Filesize

                                    193B

                                    MD5

                                    2a0f330c51aff13a96af8bd5082c84a8

                                    SHA1

                                    ad2509631ed743c882999ac1200fd5fb8a593639

                                    SHA256

                                    8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a

                                    SHA512

                                    2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\sound.properties.tlauncherdownload
                                    Filesize

                                    1KB

                                    MD5

                                    4f95242740bfb7b133b879597947a41e

                                    SHA1

                                    9afceb218059d981d0fa9f07aad3c5097cf41b0c

                                    SHA256

                                    299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66

                                    SHA512

                                    99fdd75b8ce71622f85f957ae52b85e6646763f7864b670e993df0c2c77363ef9cfce2727badee03503cda41abe6eb8a278142766bf66f00b4eb39d0d4fc4a87

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\ADDITIONAL_LICENSE_INFO
                                    Filesize

                                    2KB

                                    MD5

                                    71bb3ad0017bf36d14bb96a8d4b32c45

                                    SHA1

                                    1a5c553e71bdb7d94995b206bc9eaa49abd1e888

                                    SHA256

                                    a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916

                                    SHA512

                                    9f658dfea71bdc3cc1549edfb5ad3171dbfa0082b2d91e820c09abe0b376b6bcd8b5170442a5e25e72274e98f130176bbdecfa7997c59705782b214f02136a20

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\LICENSE
                                    Filesize

                                    18KB

                                    MD5

                                    3e0b59f8fac05c3c03d4a26bbda13f8f

                                    SHA1

                                    a4fb972c240d89131ee9e16b845cd302e0ecb05f

                                    SHA256

                                    4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726

                                    SHA512

                                    6732288c682a39ed9edf11a151f6f48e742696f4a762c0c7d8872b99b9f6d5ab6c305064d4910b1a254862a873129f11fd0fa56ff11bc577d29303f4fb492673

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\aes.md
                                    Filesize

                                    1KB

                                    MD5

                                    2e33468a535a4eb09ef57fc12a2652d0

                                    SHA1

                                    e64516f3fa1e72f88caa50f14b8046dd74d012b6

                                    SHA256

                                    45c6d4da48325edfbff3dcf71c704e504c057904435ed23c6d57046d551eb69d

                                    SHA512

                                    4d14b5ddbb4d09797264ed29ba71fab6986b4a9e75efb9402c1476e0a9e2884813d6a922dea125643b4f74e1f3e458f4e48d6c840e0f4d16ed72ffbc4611dbb2

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\c-libutl.md
                                    Filesize

                                    1KB

                                    MD5

                                    2e89a282a50f8702e52703464e6937ca

                                    SHA1

                                    cfc22a6f5b17cd539234d5b3160a5224abefadb9

                                    SHA256

                                    bef40679922d6fdfb7e4ddb223ad6722300f6054ba737bbf6188d60fcec517f9

                                    SHA512

                                    ae459d8ce5581ea57e203088373c1ce86d122d0e27eb871ee1383e0e64cd8a184fa207eee0e835347316e70afa24a1c95aec30def3e09d15ee19a0b2c3ad2095

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\wepoll.md
                                    Filesize

                                    1KB

                                    MD5

                                    cef1d92ff8ace278bd32ac5e18735b86

                                    SHA1

                                    6c7d15e2b8f3e99527458c8ea33420ee1d34af7b

                                    SHA256

                                    3ac2992770080453b98c42afa807ba4b2c1738ef756b92a55c645f55e7df48f0

                                    SHA512

                                    12aa61ae93fc626a230f39f44ca11c75086fd9bb50f2794fb9fec29b9bef924545fc19d9cb38fda631560ca78ae8e587144cf3cf3c83a6b336bb4711611393bf

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\zlib.md.tlauncherdownload
                                    Filesize

                                    1011B

                                    MD5

                                    440321d71d082c9f04a9995b613bdff2

                                    SHA1

                                    9af688d499b3026ec8e5a2e266dc4b9b4884a87b

                                    SHA256

                                    81518ebc49d23a7c77b2e08eff48664ea0c7dd90957a0caf22fd9654985d3285

                                    SHA512

                                    c516403a109630b79998f3bea6b698247a0b5367cc9873defa75014e8c98c690d34d0810d32792d80fde1333980ac6c5f19324743795cb6455ef0ee4979496bb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.datatransfer\LICENSE.tlauncherdownload
                                    Filesize

                                    32B

                                    MD5

                                    663f71c746cc2002aa53b066b06c88ab

                                    SHA1

                                    12976a6c2b227cbac58969c1455444596c894656

                                    SHA256

                                    d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80

                                    SHA512

                                    507b7d09d3bcd9a24f0b4eeda67167595ac6ad37cd19fb31cd8f5ce8466826840c582cb5dc012a4bd51b55e01bb551e207e9da9e0d51948e89f962ba09606aab

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\ADDITIONAL_LICENSE_INFO.tlauncherdownload
                                    Filesize

                                    48B

                                    MD5

                                    512f151af02b6bd258428b784b457531

                                    SHA1

                                    84d2102ad171863db04e7ee22a259d1f6c5de4a5

                                    SHA256

                                    d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83

                                    SHA512

                                    1a305bc333c7c2055a334dc67734db587fd6fda457b46c8df8f17ded0a8982e3830970bee75cc17274aa0a4082f32792b5dbff88410fa43cc61b55c1dce4c129

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\ASSEMBLY_EXCEPTION.tlauncherdownload
                                    Filesize

                                    43B

                                    MD5

                                    bd468da51b15a9f09778545b00265f34

                                    SHA1

                                    c80e4bab46e34d02826eab226a4441d0970f2aba

                                    SHA256

                                    7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b

                                    SHA512

                                    2c1d43c3e17bb2fca24a77bea3d2b3954a47da92e0cdd0738509bffcdbe2935c11764cd5af50439061638bba8b8d59da29e97ea7404ea605f7575fc13395ca93

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\colorimaging.md
                                    Filesize

                                    167B

                                    MD5

                                    0889fd01a6802a5a934572d9bd47f430

                                    SHA1

                                    7a7e547452ee1c72e8b0d96dccbe315f62d5b564

                                    SHA256

                                    04d61e3e8e71dd452ebe52008af5378d9f6640d14578aeb515dc5375973b0189

                                    SHA512

                                    f5872960470810cdbdc2db1dfb216cab88203b23400b16e157c8654c2eecff8d9b26ce066ec18718c8e6d54ee1c54533fdade395c454210fed5159fd4a7a0adb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\giflib.md
                                    Filesize

                                    1KB

                                    MD5

                                    867001e2a577f88cfc856f45959502aa

                                    SHA1

                                    109c11cec13349212ba94b9f3eb7d0943229938e

                                    SHA256

                                    c8b99f33890887d27ad56fba9edd8ebbc668cfe0689168505a95613d1d4b32f8

                                    SHA512

                                    dafac31d75a7ab4ddd7666799a24abf22c1583ca22554a738cc26a77bf927b20dde52f12194670a5196bce3a43bd58de46944291727c8877fee1fe4a38a1f1ca

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\lcms.md.tlauncherdownload
                                    Filesize

                                    2KB

                                    MD5

                                    04a8a77cafdd6185a3506eccf7a83346

                                    SHA1

                                    1acbec21e9eab8bd2bee9826353c1e768d5457b5

                                    SHA256

                                    8acf00b5efd25c1c055927222fd3c26b0c9fd02ed02e478c225b64e7a24d9782

                                    SHA512

                                    a91faa243a09bdfe62714859b9b4420e8434dd09693a6a280e1c8ef6694fb7858d0171fae4ca36721b685e3ab8bc8000c5635bf3789250a5b9081130eb4ff57c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\mesa3d.md.tlauncherdownload
                                    Filesize

                                    5KB

                                    MD5

                                    c7e0d19c8f4eff11e97f0eb9afd3f7f4

                                    SHA1

                                    6a98ee2703132e181f37d162452f073fb64ced83

                                    SHA256

                                    63f4e6f75caebbccb95d903fb43e46ac7111b3624d0a34f146b276d7d9e7b152

                                    SHA512

                                    9c4111728ab9472f0b160cb11ce1e4ebd75a83cfddca0b3cb87243d15afc5a7fa34dc6006e6b92084648cbad1426f70b405259f589cdef758442643e1618dff4

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.xml\bcel.md
                                    Filesize

                                    10KB

                                    MD5

                                    daae908a4dd474afec9c010d416acb2d

                                    SHA1

                                    a59717166af2e8fa9ecd6d622fd6b82b835acce9

                                    SHA256

                                    853a1e7ce397bb10de0e2b3bde0844bcc651f17d983decd07d2d003c0304c311

                                    SHA512

                                    25f2189643a113616f53cd87fc96df01b55602bfc3f6653e48c310de03f6d79ccbbec58936d54b88052e32d68c646017bf75b8a179f59fb9d2c5f6938e351a4d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.xml\dom.md
                                    Filesize

                                    3KB

                                    MD5

                                    13952c46b3867103ad7d1e9c6c9e906c

                                    SHA1

                                    4bf3f9908314b05f3b0f6e27be2c1fb7e25fffbb

                                    SHA256

                                    6686e8877667584a3a7c07344baadca1a03e29f677162d87c3c0811e990d1148

                                    SHA512

                                    8c71f226f0f07b471aea6b8e715434b5eaa6b4a59a653ec22c2489e743e9288a0c4537f479719f9d58737d0257470c9cceff9ce647a96e79fd757a4cdcfed499

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.xml\jcup.md
                                    Filesize

                                    1KB

                                    MD5

                                    d19594fbf6eab2242dc29257905d8ded

                                    SHA1

                                    fbdcbe5a7e7d91d440c200f5fb00e0cf6a81976c

                                    SHA256

                                    8d5dcfdf50455a3c34c753a98f21e953248af200415a9084e3f102cb6c43b8bf

                                    SHA512

                                    7ed3e58f189f2922f7543d4617308d0c35f8adc2e7cbbb6fbba49d33cdd5da64c6edc022ae9842c28e58d97b056a245245c816003978f1e0152236636ca72ba5

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md
                                    Filesize

                                    3KB

                                    MD5

                                    fa24b7e2a61a7045cb0c6c385000681b

                                    SHA1

                                    869fc0b687986ea26b8ff63c137e03c92234a5c8

                                    SHA256

                                    262802e081760b38b3748c8b194353d340e39bc936ac22e17abbb7158d895811

                                    SHA512

                                    2676cfdfd61762c7b6171985e8cfe1068c36683ca43753a1ffb10241ac61a74c9be1c00be22903df85ba6954fd908d77de60903c316506fd88b9679672ada968

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.crypto.cryptoki\pkcs11wrapper.md
                                    Filesize

                                    2KB

                                    MD5

                                    b77d1951df7a8488eb84ce1d25486a14

                                    SHA1

                                    e35415235ec3bbcb92beeceb03a9a8e7c13a6fce

                                    SHA256

                                    371974b1fca3744a3892c7ee1fcc593b8b4281fc218f4cafd2f709e9df5fd81d

                                    SHA512

                                    759c75f87309b67c56a5b7088045e04be7c023ecdbaea80842e22b81b0bfb36026191070471f8b08fef47ec73664611ce0453b4a9818f7708c95663733ee5ce9

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNG
                                    Filesize

                                    45KB

                                    MD5

                                    75271ec49105bb1ad1f2808eff816b2f

                                    SHA1

                                    3f5d1487b681fca37f61c136b5a82b601a9cee24

                                    SHA256

                                    8ce00af9dafad204fe53683a468465b18d6659ff2f2b067b481da2f1a519ec0d

                                    SHA512

                                    5cbf55741a58fb476712b27a321243f1b0d4bd445386bfded6a115eacff488691d7dd482f17849942da00d19e8f2afc3c922a7606dbef7fb345ad467e58f969b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNG
                                    Filesize

                                    206B

                                    MD5

                                    bdb247c44cbe2d5f63ac51a2378734f3

                                    SHA1

                                    024844330b6cc23986de94e2b80bc3c2e32c08de

                                    SHA256

                                    53f406badad3465d216d3f0b6f5a87adddec77b04f0bdc585d2de1e786d0aa13

                                    SHA512

                                    23bc82934d62081f6e662624990f2e823da11938d407ab1c0d1c00f4e0377527160ac82cce036b8804f8e76b0505ab7664bce2bfbe96e480baa466ab772820a0

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG12.PNG
                                    Filesize

                                    22KB

                                    MD5

                                    41ab50b3934447b580a3f05a0919de5b

                                    SHA1

                                    a7f811516242d5ec9ec9897f2a7f1af5363705a7

                                    SHA256

                                    49c7cee51e5cc0dabb2cd026c4ab58ac24e8a511619379795806c9aa1f0ad21f

                                    SHA512

                                    63de6de7cd1f087b69e5f69d78266d0d14aee0e22d085eb460b029af053b3a76e39910b26f4486c258d498105f8213574f5a9810ae4f779d3c4310c48dee2687

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG14.PNG
                                    Filesize

                                    41KB

                                    MD5

                                    36c744011f2c71f2caa553236b339d03

                                    SHA1

                                    1739c336922e03a8a138999d8247668a279c6d95

                                    SHA256

                                    a7eab595e57de5a17cfe132117b4fef50234dc9a15e452d900b63f9c377f6aa1

                                    SHA512

                                    b1b236dbaf45c78fbdfc5441ec05f95fbf4a64be45d07baf30a70a0c962921d436137e8d618ee872662476615740e88f05cc18d45f0af48511a886c2c165a3a8

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNG
                                    Filesize

                                    475B

                                    MD5

                                    c4aba50a1fac1d4d5e13c5bcd9e852c9

                                    SHA1

                                    9c74e687194c16c8853298b75f1e859392280a1d

                                    SHA256

                                    09aee04971d4f9bb30f0b9fd17b0c6c17fd8a2d3d0a78d9a9b580bc73f1b7f2e

                                    SHA512

                                    88c1b12eb8d915386ecb1145fcd913e3648fc881adaed7264a7ed41ef4993b3d69fb09466464955a93895a65957a6e77e68cc0d808e8f1bca97e362c3b104bbf

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
                                    Filesize

                                    368B

                                    MD5

                                    6ac0e4f3277501ec673ea0c50869f7ee

                                    SHA1

                                    7a469e8fb0f7cbbf9a3dd605c265961e8b939676

                                    SHA256

                                    e1f08449a822c655b834b5cb8cea3e1e78e1aab14d5f9b20743f1fb36a0a3759

                                    SHA512

                                    1b03065fa39fcc84c6bef735e7ce357960f7df29a64d72350ee54af34b5b3de579d00ec9b8f2297bcf48fd9f1d27834a1cb1bc5590afb39a148980740a4df121

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG9.PNG
                                    Filesize

                                    438B

                                    MD5

                                    c62000dc4b635684ceca46116344bcd8

                                    SHA1

                                    9202be85e22535f2312b7db7c77707a05e803336

                                    SHA256

                                    dd7f7f45410e999f2bc0147dc120974c574028a1507ddb14eaeaccb49479bdf1

                                    SHA512

                                    dcce6fa45ac77a99e52079308972d8f44c79cb8c036efb25171ff04b09e52af8cb99830391acbe2f5ee7b5c1240215432b1f88e82f6332a297cdd953bf6a74cc

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                    Filesize

                                    4KB

                                    MD5

                                    1309abb4d7695b135de1bccb3d0383bd

                                    SHA1

                                    6435990c33f357ecdad2f72f11da62a766c4abd8

                                    SHA256

                                    d705428077945f54aea3cb29ccf04123369634444a578cd9f01ab1b947d454c3

                                    SHA512

                                    05440cbc9f24a56083a4ad63b42cc02b782c46abecdf4b23de9f7d6f8f66b196bcc9fa21920575ba1899735bd2bf398166151e95d2a802288d637ae4ec2ec83a

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
                                    Filesize

                                    23KB

                                    MD5

                                    2c05460caed8cd10beab60de6ee34a6e

                                    SHA1

                                    d29b7d606fb3d25744060bb04134d13f81be8666

                                    SHA256

                                    831ec487ab350f7f1fdd189bf5002a9987d0fc538075f2a8f0d182511a4d4793

                                    SHA512

                                    dc8a91dd07ac3f48f907b5e5e1cb9ed3f3781c4691bfefdf241d8fac4a99ecdc08d8fc3a00fc11bbc6fe381c787af05cc080f7cbca67478033c6eaa54493ed32

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.924\dependencies.json
                                    Filesize

                                    17KB

                                    MD5

                                    63efc497f38e113390292117062cbba6

                                    SHA1

                                    be942f92cce4876068f8100e0c2f791cfb2d7acb

                                    SHA256

                                    ebc5231524854028e6b4a34bedbb91dbe311e4f40802e88c4ea340c3459db661

                                    SHA512

                                    f6850f315cc1f5507ff194b2a2588cfbb3314947b973afe369f75d0435f3a30c2de7086c0796cedb2b156002b2ba5c4c12e3d4dc099f3e5e15cc32a02ea05bb6

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.924\resources.json
                                    Filesize

                                    17KB

                                    MD5

                                    39ce244fc02a8306645263bc762c3f68

                                    SHA1

                                    8a7466cdea0b463346fd9a24928d8c0cfcc6eddf

                                    SHA256

                                    d870c69c8a8cc0f64c0c5cc599cad6e64675fd68b80a1d1b6fbcfc5f8945d2e3

                                    SHA512

                                    4274215a1ae01d93c0baf46881c4fc1507b20315f8058b587b693da8791c18da318dfd35a1e4ba8bb908b38da935d117d3204dda56a511d0f50dbf411f4ad6aa

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
                                    Filesize

                                    3KB

                                    MD5

                                    bbe6c940b1257b9c5b2c153ad15d577e

                                    SHA1

                                    68adad71094b3ba44c29ac094d1a3302109897d4

                                    SHA256

                                    4b41c9415d9c8657f02c30533824db8c08cfade715a1c558b3838c4e9f89d2a7

                                    SHA512

                                    97268f256526280f2e2a7021460210724c87216dd863809233eca8b5c12023b276a3d4ff2f6be05d3bd0652c05a06e106c3d2c4b0cfa28689e45243066ae4602

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig.json
                                    Filesize

                                    3KB

                                    MD5

                                    e2cbea0a8a22b79e63558273dded5e6c

                                    SHA1

                                    bfbbbba0679adcbcf9e079ed3c7c7a60cb0b2d61

                                    SHA256

                                    10d0f3646be0a7d73942d7bdd1e55c4b8df0c34cad7ad15a9dc23b2932155007

                                    SHA512

                                    a6aa26ff49c911fb4705df1e8e434c72e206b20fdaae0abc529e2734f5db49c75da35c3d75769e0ac1b6795de540de4c7e1089b387217fc58f8b19b023064e5a

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\COPYRIGHT
                                    Filesize

                                    35B

                                    MD5

                                    4586c3797f538d41b7b2e30e8afebbc9

                                    SHA1

                                    3419ebac878fa53a9f0ff1617045ddaafb43dce0

                                    SHA256

                                    7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018

                                    SHA512

                                    f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\LICENSE
                                    Filesize

                                    33B

                                    MD5

                                    16989bab922811e28b64ac30449a5d05

                                    SHA1

                                    51ab20e8c19ee570bf6c496ec7346b7cf17bd04a

                                    SHA256

                                    86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192

                                    SHA512

                                    86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO
                                    Filesize

                                    51B

                                    MD5

                                    494903d6add168a732e73d7b0ba059a0

                                    SHA1

                                    f85c0fd9f8b04c4de25d85de56d4db11881e08ca

                                    SHA256

                                    0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4

                                    SHA512

                                    b6e0968c9fd9464623bfa595bf47faf8f6bc1c55b09a415724c709ef8a3bcf8a954079cce1e0e6c91d34c607da2cecc2a6454d08c370a618fb9a4d7d9a078b24

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION
                                    Filesize

                                    46B

                                    MD5

                                    c62a00c3520dc7970a526025a5977c34

                                    SHA1

                                    f81a2bcb42ccbf898d92f59a4dc4b63fef6c2848

                                    SHA256

                                    a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0

                                    SHA512

                                    60907d1910b6999b8210b450c6695b7cc35a0c50c25d6569cf8bb975a5967ca4e53f0985bee474b20379df88bb0891068347ecf3e9c42900ed19a1dcbc2d56ec

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\LICENSE
                                    Filesize

                                    35B

                                    MD5

                                    f815ea85f3b4676874e42320d4b8cfd7

                                    SHA1

                                    3a2ddf103552fefe391f67263b393509eee3e807

                                    SHA256

                                    01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105

                                    SHA512

                                    ddf09f482536966ac17313179552a5efc1b230fa5f270ebde5df6adebf07ee911b9ef433dfbfcb4e5236922da390f44e355709ecaf390c741648dd2a17084950

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties
                                    Filesize

                                    1KB

                                    MD5

                                    783c4f9eeea1b11ddd53a6ba87e417e7

                                    SHA1

                                    5138ec6862af39ff5163ba1c88c52af35eccb529

                                    SHA256

                                    8274d3217982c7f40b1a247a4fafefc076f83e5796ee3f1f48b532c4388dfed9

                                    SHA512

                                    d7f35a15ed665787219374d04a1069eb97a49e1da8aec6c2243dfca4bda5cfcb11724b11da86b8aea6ddacadc0329d2acf57eff1d2394d96bc4c273f4b2f67c8

                                    Download Submit

                                  • C:\Windows\Installer\MSI3E60.tmp
                                    Filesize

                                    953KB

                                    MD5

                                    64a261a6056e5d2396e3eb6651134bee

                                    SHA1

                                    32a34baf051b514f12b3e3733f70e608083500f9

                                    SHA256

                                    15c1007015be7356e422050ed6fa39ba836d0dd7fbf1aa7d2b823e6754c442a0

                                    SHA512

                                    d3f95e0c8b5d76b10b61b0ef1453f8d90af90f97848cad3cb22f73878a3c48ea0132ecc300bfb79d2801500d5390e5962fb86a853695d4f661b9ea9aae6b8be8

                                    Download Submit

                                  • C:\Windows\Installer\f773ad5.msi
                                    Filesize

                                    1.0MB

                                    MD5

                                    d7390d55b7462787b910a8db0744c1e0

                                    SHA1

                                    b0c70c3ec91d92d51d52d4f205b5a261027ba80c

                                    SHA256

                                    4a2f7d9d33e4ad643bf72722587f2b268d92dab3bb1d9bc56af316672e34728a

                                    SHA512

                                    64f3837dd6099561ce9be97d6fae0b11f3f6cc08281f1a3266d5a6f3ca8baf13bbd780735ef62b449b577d62d086f942b48519671226c60f0e1480f9dbdde434

                                    Download Submit

                                  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
                                    Filesize

                                    1.7MB

                                    MD5

                                    dabd469bae99f6f2ada08cd2dd3139c3

                                    SHA1

                                    6714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b

                                    SHA256

                                    89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606

                                    SHA512

                                    9c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915

                                    Download Submit

                                  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
                                    Filesize

                                    97KB

                                    MD5

                                    da1d0cd400e0b6ad6415fd4d90f69666

                                    SHA1

                                    de9083d2902906cacf57259cf581b1466400b799

                                    SHA256

                                    7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                                    SHA512

                                    f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                                    Download Submit

                                  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
                                    Filesize

                                    1.2MB

                                    MD5

                                    b5043eda3b89c980a4957f3667d7d53b

                                    SHA1

                                    2c0a4c924a255e57cd00dc65ff5fe2db45050d49

                                    SHA256

                                    6041dcdad508a9063d182479cf2f25d75b4bc38cb3f0c6f2067843a6b7dcfa08

                                    SHA512

                                    b3b85f7d023b6b59409721d5c4016d436319dee693d036d4498dc68d46a778bdefc7b35aee661a9a1e179ac2fa469dc47c4d5cc45c17df3893b5404eccafbd71

                                    Download Submit

                                  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
                                    Filesize

                                    1.2MB

                                    MD5

                                    07552732fa64db456300880d52e81b2f

                                    SHA1

                                    9a653ea405f5f26ec0c2d9a0bc9bcb11ba010efc

                                    SHA256

                                    94bc1aa272183daf13f24594493eea40e02cb9861c76f9de3711c139f5315226

                                    SHA512

                                    47e97e300330ec1523f4af6e87b9866fae2e90cd9b59fc4d02e53e29b223691f980daf1f221f5286dbc1a9a9ddf6e01e7a597c5cf763710c51d84c8d5bac60b0

                                    Download Submit

                                  • memory/236-4203-0x0000000000400000-0x0000000000417000-memory.dmp

                                    Filesize

                                    92KB

                                    Download

                                  • memory/300-3254-0x000007FFFFF70000-0x000007FFFFF80000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/372-3385-0x0000000000230000-0x0000000000231000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/372-3387-0x0000000000230000-0x0000000000231000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/1252-847-0x0000000003380000-0x0000000003769000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/1252-2174-0x0000000003380000-0x0000000003769000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/1252-846-0x0000000003380000-0x0000000003769000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/1252-848-0x0000000003380000-0x0000000003769000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/1524-6061-0x0000000000AF0000-0x0000000000B4C000-memory.dmp

                                    Filesize

                                    368KB

                                    Download

                                  • memory/1524-6062-0x0000000000AF0000-0x0000000000B4C000-memory.dmp

                                    Filesize

                                    368KB

                                    Download

                                  • memory/1524-6065-0x0000000000A20000-0x0000000000A4A000-memory.dmp

                                    Filesize

                                    168KB

                                    Download

                                  • memory/1524-6060-0x0000000000AF0000-0x0000000000B4C000-memory.dmp

                                    Filesize

                                    368KB

                                    Download

                                  • memory/1524-6066-0x0000000000A20000-0x0000000000A4A000-memory.dmp

                                    Filesize

                                    168KB

                                    Download

                                  • memory/1524-6056-0x0000000000470000-0x000000000047A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/1524-6057-0x0000000000470000-0x000000000047A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/1736-2154-0x00000000010B0000-0x0000000001499000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/1736-3158-0x00000000010B0000-0x0000000001499000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/1736-3533-0x00000000010B0000-0x0000000001499000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/1736-2550-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/1736-2916-0x00000000010B0000-0x0000000001499000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/1736-1420-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/1736-849-0x00000000010B0000-0x0000000001499000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2152-2917-0x0000000000230000-0x0000000000231000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2160-3185-0x0000000000140000-0x0000000000141000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2160-3159-0x0000000000140000-0x0000000000141000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2160-3155-0x0000000000140000-0x0000000000141000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2160-3142-0x0000000000140000-0x0000000000141000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2384-3128-0x0000000000340000-0x0000000000341000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2384-3120-0x0000000000340000-0x0000000000341000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2384-3090-0x0000000000340000-0x0000000000341000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2384-3106-0x0000000000340000-0x0000000000341000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2384-3103-0x0000000000340000-0x0000000000341000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2688-3369-0x0000000000130000-0x0000000000131000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2688-3374-0x0000000000130000-0x0000000000131000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2848-16-0x00000000037A0000-0x0000000003B89000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2848-768-0x00000000037A0000-0x0000000003B89000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2848-17-0x00000000037A0000-0x0000000003B89000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2872-2332-0x0000000000900000-0x0000000000CE9000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2872-19-0x0000000000900000-0x0000000000CE9000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2872-764-0x0000000000900000-0x0000000000CE9000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2872-686-0x0000000010000000-0x0000000010051000-memory.dmp

                                    Filesize

                                    324KB

                                    Download

                                  • memory/2872-3074-0x0000000000900000-0x0000000000CE9000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2872-2158-0x0000000000900000-0x0000000000CE9000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2872-2173-0x0000000002B80000-0x0000000002B90000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/2872-767-0x0000000010000000-0x0000000010051000-memory.dmp

                                    Filesize

                                    324KB

                                    Download

                                  • memory/2872-766-0x0000000000900000-0x0000000000CE9000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2872-803-0x0000000002B80000-0x0000000002B90000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/2872-687-0x00000000007B0000-0x00000000007B3000-memory.dmp

                                    Filesize

                                    12KB

                                    Download

                                  • memory/2872-4206-0x0000000000900000-0x0000000000CE9000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2872-765-0x0000000010000000-0x0000000010051000-memory.dmp

                                    Filesize

                                    324KB

                                    Download

                                  • memory/2872-1025-0x0000000000900000-0x0000000000CE9000-memory.dmp

                                    Filesize

                                    3.9MB

                                    Download

                                  • memory/2872-2333-0x0000000010000000-0x0000000010051000-memory.dmp

                                    Filesize

                                    324KB

                                    Download

                                  • memory/3084-6064-0x000000001EFE0000-0x000000001EFEA000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3084-5569-0x000000001E350000-0x000000001E35A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3084-5570-0x000000001E350000-0x000000001E35A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3084-5639-0x000000001EFE0000-0x000000001EFEA000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3084-5636-0x000000001EFE0000-0x000000001EFEA000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3084-5637-0x000000001EFE0000-0x000000001EFEA000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3084-5640-0x000000001EFE0000-0x000000001EFEA000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3084-6059-0x000000001E350000-0x000000001E35A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3084-6058-0x000000001E350000-0x000000001E35A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3984-4805-0x0000000002080000-0x000000000208A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3984-4217-0x0000000001F30000-0x0000000001F31000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/3984-4262-0x0000000002080000-0x000000000208A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3984-4261-0x0000000002080000-0x000000000208A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3984-4264-0x0000000001F30000-0x0000000001F31000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/3984-4279-0x0000000001F30000-0x0000000001F31000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/3984-4804-0x0000000002080000-0x000000000208A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/3984-6008-0x0000000002080000-0x0000000002082000-memory.dmp

                                    Filesize

                                    8KB

                                    Download