Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

TLauncher-....9.exe

windows7-x64

8

Resubmissions

05/08/2024, 18:01

240805-wl6craxdqh 8

05/08/2024, 17:55

240805-whmq8stcqq 7

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    05/08/2024, 18:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TLauncher-Installer-1.4.9.exe

  • Size

    24.1MB

  • MD5

    79673d0cd668ac6e4ecfc7dcc4db5b23

  • SHA1

    0a576f857765e759f582126f099b0c04c6c6349e

  • SHA256

    8535bf7f8914c54823a1b57e5977c84add0caebfc967567dcf13f8fd843b8b1d

  • SHA512

    a9d1c9d47cf67bf80a60c6250cd84151551e549a1ff179faa62381260d03d531dbd5b1df2bc83a43f71ab5a699aaf593ba6606416e3c8957b6c2fa8e3863f8c9

  • SSDEEP

    786432:+KAWuabJBM9irrKJBH5lFRqH0fYk/pUJ8a:+KDMQPKJBZlCUfYSpUJ8

Score
8/10
adwarediscoverypersistenceprivilege_escalationstealerupx

Malware Config

Signatures

  • Downloads MZ/PE file
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.9.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.9.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.9.exe" "__IRCT:3" "__IRTSS:25232289" "__IRSID:S-1-5-21-1506706701-1246725540-2219210854-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2588
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1679762 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1709878" "__IRSID:S-1-5-21-1506706701-1246725540-2219210854-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2272
      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
        "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Users\Admin\AppData\Local\Temp\jds259539892.tmp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jds259539892.tmp\jre-windows.exe" "STATIC=1"
          4⤵
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1936
          • C:\Program Files\Java\jre-1.8\bin\javaw.exe
            -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
            5⤵
            • Executes dropped EXE
            PID:3012
          • C:\Program Files\Java\jre-1.8\bin\javaw.exe
            -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
            5⤵
            • Executes dropped EXE
            PID:860
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1756
        • C:\Program Files\Java\jre-1.8\bin\javaw.exe
          "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2824
          • C:\Windows\system32\icacls.exe
            C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
            5⤵
            • Modifies file permissions
            PID:2856
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 561C9F5EF8C991515C74714915A5A820
      2⤵
      • Loads dropped DLL
      PID:2236
    • C:\Program Files\Java\jre-1.8\installer.exe
      "C:\Program Files\Java\jre-1.8\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre-1.8\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={71024AE4-039E-4CA4-87B4-2F64180401F0}
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Program Files\Java\jre-1.8\bin\javaw.exe
        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1756
      • C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        "C:\Program Files\Java\jre-1.8\bin\ssvagent.exe" -doHKCUSSVSetup
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:1872
      • C:\Program Files\Java\jre-1.8\bin\javaws.exe
        "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -permissions -silent
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
          "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2964
      • C:\Program Files\Java\jre-1.8\bin\javaws.exe
        "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -shortcut -silent
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
          "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:280
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 74D9DE38BA24DC8E275F24C452AD63DF M Global\MSI0000
      2⤵
        PID:1660
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 58F4034EDB0FFCF3B2B185818569C18A
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2236
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2117B20F8153AA0A99D46E322EF38571 M Global\MSI0000
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2144

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Browser Extensions

    1
    T1176

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Defense Evasion

    File and Directory Permissions Modification

    1
    T1222

    Modify Registry

    4
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    3
    T1012

    Software Discovery

    1
    T1518

    Security Software Discovery

    1
    T1518.001

    System Information Discovery

    3
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\f786694.rbs
      Filesize

      962KB

      MD5

      64bc007441961b53d7b2c4899e3ea7fc

      SHA1

      dcb6b51b57eff44599fbd91b1cc435cc01504291

      SHA256

      2d9a091db470b56cc8f2850f7e811139ab8cbb310853c4c4083503485c295419

      SHA512

      70ef696de3832e2ec4a80b14191e83de5959289ec096fcce91575c5f8175a40d4b3238b40f4ad237dd6477421d63d07943b0279d39e26d3c80a795c4b8650f00

      Download Submit

    • C:\Config.Msi\f78669a.rbs
      Filesize

      7KB

      MD5

      653fcc0916dc495e87418cb546ae6cdc

      SHA1

      fac4d154905270969768625bef8059336fdae782

      SHA256

      501fd08449e5a235379cab45f9118ab0ff0ecc54160a43b2e44eb41ab647854d

      SHA512

      cdc7c66f5f5715308624a798a057656bc0c4d141b01d38887a8cea699c9ad501552eb4b95712acf0760920c8c7a6c99b4dc48b6313888b9d239dca196475b32c

      Download Submit

    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk
      Filesize

      197B

      MD5

      b5e1de7d05841796c6d96dfe5b8b338c

      SHA1

      c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547

      SHA256

      062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d

      SHA512

      963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d

      Download Submit

    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
      Filesize

      177B

      MD5

      6684bd30905590fb5053b97bfce355bc

      SHA1

      41f6b2b3d719bc36743037ae2896c3d5674e8af7

      SHA256

      aa4868d35b6b3390752a5e34ab8e5cba90217e920b8fb8a0f8e46edc1cc95a20

      SHA512

      1748ab352ba2af943a9cd60724c4c34b46f3c1e6112df0c373fa9ba8cb956eb548049a0ac0f4dccff6b5f243ff2d6d210661f0c77b9e1e3d241a404b86d54644

      Download Submit

    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url
      Filesize

      173B

      MD5

      625bd85c8b8661c2d42626fc892ee663

      SHA1

      86c29abb8b229f2d982df62119a23976a15996d9

      SHA256

      63c2e3467e162e24664b3de62d8eeb6a290a8ffcdf315d90e6ca14248bc0a13a

      SHA512

      07708de888204e698f72d8a8778ed504e0fe4d159191efb48b815852e3997b50a27ba0bc8d9586c6fb4844166f38f5f9026a89bbbc3627e78121373982656f12

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C
      Filesize

      579B

      MD5

      f55da450a5fb287e1e0f0dcc965756ca

      SHA1

      7e04de896a3e666d00e687d33ffad93be83d349e

      SHA256

      31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

      SHA512

      19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
      Filesize

      471B

      MD5

      6d5d7d3589c3daa08221c99cf53e6ad0

      SHA1

      46faf66d2adca6683e94b9b4cf379850ae5b28f4

      SHA256

      d6671565f0b32d97c621d13e4236282881348561bda753043d70ed39cfca1ce5

      SHA512

      4ffca8f3089592e689b0226d93f8eddf1ef3f9118927085dc160782467c9ee9410d19467279cd468e172dc1bd1577b0c3b75341208052032300780eebb097504

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C
      Filesize

      252B

      MD5

      c0466b7ed3394997726082110c9532a9

      SHA1

      ca467a0ed0c4be3b5103c9667712be50dedfa84c

      SHA256

      2d7b93350bd1f5aa28efe05ad41b233b43cd04cae99a590ab19103130ecb7d2a

      SHA512

      6117d2012d6943339174e40a7a868ed58327ccfe9c4bb0acc7074a783cc3ac4f42249046d1877c6bfd0536d2ccb84c4b300d14afceac92d081ef2b0b86131023

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      abb3a63d759dc2b125b48f6b008cf515

      SHA1

      dc127077da2aa6509ace5c04f872e0624f0a7cd1

      SHA256

      6a636478620fde0978a161bbe437a4768ca12316d22260f237caafa00ec8f5aa

      SHA512

      41eb503ea5102243a9c27221b679a04894d5c67bd9b01f04277d65c44e53cf072c7aab05fed493575bb1b2c0e3401424b3188b418bff1083a681702c200426ac

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      ba07dd0debbf6d5eb4f8f5914a1c2482

      SHA1

      0eb1235d9ea6ebbb9ff221847c2509b3a530d2fd

      SHA256

      72df11277fbad1cd9a8dbcbc3f7729b52611b85010c0d8827f36e0186426a266

      SHA512

      635c305e57bc8ceb2574d5d8260c0d2ee3690e5567d3a90c503b0d5074ef73b8d59c4a08b12ffdb5fa39007a5abc5ff79eed53e3206b9a4a88094bf7287d5706

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      01ffefac8885442202ec9313ebc2e312

      SHA1

      7ecf1011ae58cbbfc90fd5f26b800ac2328bf163

      SHA256

      e739f2baed970a937df27a97f850d77c7f5b489a218b20cc58e6c00f4502fc32

      SHA512

      119cc68c98647794932c4b2b9fc7634430637330fc00128c61bb4bcbe55b21a1c43f33cc046fddb632dcb6dc045014c0039e66f451003cf2eeae821a5c794622

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
      Filesize

      400B

      MD5

      28a45c73994d4d8adc964610b0e9eadd

      SHA1

      ab9a71b899525d3ea60b7dd5a129d2d115dbba12

      SHA256

      eaee11c82bf57d760bbf0f417c932ed2a7f53800e55400dc9c8279190f81c272

      SHA512

      34fd1800730135aa25fd8d21412826e4a9061ab85ddd9108f80a33480c053d4943c95cee5f5d109e2fb372ba5743b10707ba3ea308bfddd199d6ba1ab98e0e4b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
      Filesize

      242B

      MD5

      8a0bf70c305b2e4baeba20b19f88a1ac

      SHA1

      3b965ead57e28969a097397be3a1671897d7cd29

      SHA256

      5a99055a6c7e44fa7142004a86625352928387177ff0511f3a6d7289f39d3c88

      SHA512

      5fa7cc7622f88cf79b1fc1a9b730d2f15374c20b54acd7e2101f5af712581312ad714e72e09710a1ba241460a367c41c578d480be1979c3fb45ac56b0cc82114

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\rtutils[1]
      Filesize

      244B

      MD5

      c0a4cebb2c15be8262bf11de37606e07

      SHA1

      cafc2ccb797df31eecd3ae7abd396567de8e736d

      SHA256

      7da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1

      SHA512

      cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\runtime[1]
      Filesize

      42KB

      MD5

      5d4657b90d2e41960ebe061c1fd494b8

      SHA1

      71eca85088ccbd042cb861c98bccb4c7dec9d09d

      SHA256

      93a647b1f2cadcbdb0fe9c46b82b2b4baf7685167de05933811549145c584ee0

      SHA512

      237738c0a6cb25efe29effc9c3637245e3e2397207ed51e67bae5a1b54749f88e090de524f7868d964debbb29a920a68205ccbd2dfceed4a1f3cd72d08b16fa3

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\l10n[1]
      Filesize

      4KB

      MD5

      1fd5111b757493a27e697d57b351bb56

      SHA1

      9ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711

      SHA256

      85bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f

      SHA512

      80f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\masthead_fill[1]
      Filesize

      1KB

      MD5

      91a7b390315635f033459904671c196d

      SHA1

      b996e96492a01e1b26eb62c17212e19f22b865f3

      SHA256

      155d2a08198237a22ed23dbb6babbd87a0d4f96ffdc73e0119ab14e5dd3b7e00

      SHA512

      b3c8b6f86ecf45408ac6b6387ee2c1545115ba79771714c4dd4bbe98f41f7034eae0257ec43c880c2ee88c44e8fc48c775c5bb4fd48666a9a27a8f8ac6bcfdcb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHDSWW5V\host[1]
      Filesize

      1KB

      MD5

      a752a4469ac0d91dd2cb1b766ba157de

      SHA1

      724ae6b6d6063306cc53b6ad07be6f88eaffbab3

      SHA256

      1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3

      SHA512

      abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHDSWW5V\layout[1]
      Filesize

      2KB

      MD5

      cc86b13a186fa96dfc6480a8024d2275

      SHA1

      d892a7f06dc12a0f2996cc094e0730fe14caf51a

      SHA256

      fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058

      SHA512

      0e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHDSWW5V\masthead_left[1]
      Filesize

      4KB

      MD5

      b663555027df2f807752987f002e52e7

      SHA1

      aef83d89f9c712a1cbf6f1cd98869822b73d08a6

      SHA256

      0ce32c034dfb7a635a7f6e8152666def16d860b6c631369013a0f34af9d17879

      SHA512

      b104ed3327fed172501c5aa990357b44e3b31bb75373fb8a4ea6470ee6a72e345c9dc4bcf46a1983c81adb567979e6e8e6517d943eb204c3f7fac559cd17c451

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YW15VCHK\common[1]
      Filesize

      1KB

      MD5

      f5bb484d82e7842a602337e34d11a8f6

      SHA1

      09ea1dee4b7c969771e97991c8f5826de637716f

      SHA256

      219108bfef63f97562c4532681b03675c9e698c5ae495205853dbcbfd93faf1a

      SHA512

      a23cc05b94842e1f3a53c2ea8a0b78061649e0a97fcd51c8673b2bcb6de80162c841e9fdde212d3dfd453933df2362dcb237fe629f802bafaa144e33ca78b978

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CabC3EE.tmp
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TarC401.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
      Filesize

      116KB

      MD5

      e043a9cb014d641a56f50f9d9ac9a1b9

      SHA1

      61dc6aed3d0d1f3b8afe3d161410848c565247ed

      SHA256

      9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

      SHA512

      4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
      Filesize

      1.6MB

      MD5

      199e6e6533c509fb9c02a6971bd8abda

      SHA1

      b95e5ef6c4c5a15781e1046c9a86d7035f1df26d

      SHA256

      4257d06e14dd5851e8ac75cd4cbafe85db8baec17eaebd8f8a983b576cd889f8

      SHA512

      34d90fa78bd5c26782d16421e634caec852ca74b85154b2a3499bc85879fc183402a7743dd64f2532b27c791df6e9dd8113cc652dcb0cdf3beae656efe79c579

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
      Filesize

      12KB

      MD5

      3adf5e8387c828f62f12d2dd59349d63

      SHA1

      bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a

      SHA256

      1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0

      SHA512

      e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG
      Filesize

      43KB

      MD5

      2c514bd7dfd4f27367eef795df2be8b1

      SHA1

      7f01317b1be248a599279a0772153feb570b8535

      SHA256

      709f42f77d52118942c68932ffff7cc6db58a5b31a2b9098e0ed68a377a44d0a

      SHA512

      828ca614a82210205be9d03fab21393b57071de49a40c979f666d8aa492cfe62ac7827a63fc11ee955ee03f5adbbb3906da630b9058da530acb615429261b026

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG16.PNG
      Filesize

      644B

      MD5

      79e5cf49ee3a4909162476b3995d2f19

      SHA1

      d92481b1b7d44afbbd6f3b5eb676eb30dd62016b

      SHA256

      99c3d263f71af8b914aa9ddda9285f950b9393685c8d7d4dac93aba27e3b3114

      SHA512

      8eb4fcf894c7ac1e581d24b28d617cf5ffdd7f32ee11e997193a31d7a7bf035f2bbfcb4bd57ae29fa984d2ec4f3e4b97b23084bc2ed12a9bc222cdc6c9f157e3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG18.PNG
      Filesize

      40KB

      MD5

      3385b6d8085d360e3f5089ebf3617f5b

      SHA1

      56689fea821642bbc64d4b0c7fd033a9b0607376

      SHA256

      3d1b359ab9e72ffc36722803b921d6a08f730c9003c25d7ffda393621803aea2

      SHA512

      013efb3b0d9b8be6eff13eb05d56d0b0062cbd1a958a17b00748e1a0a7424d281fa8033c55f31d6bd18037e60063ef1999d57136fe45595edc87741bed6bdbdd

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
      Filesize

      12KB

      MD5

      f35117734829b05cfceaa7e39b2b61fb

      SHA1

      342ae5f530dce669fedaca053bd15b47e755adc2

      SHA256

      9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3

      SHA512

      1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
      Filesize

      12KB

      MD5

      f5d6a81635291e408332cc01c565068f

      SHA1

      72fa5c8111e95cc7c5e97a09d1376f0619be111b

      SHA256

      4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26

      SHA512

      33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG49.BMP
      Filesize

      1.8MB

      MD5

      5c9fb63e5ba2c15c3755ebbef52cabd2

      SHA1

      79ce7b10a602140b89eafdec4f944accd92e3660

      SHA256

      54ee86cd55a42cfe3b00866cd08defee9a288da18baf824e3728f0d4a6f580e7

      SHA512

      262c50e018fd2053afb101b153511f89a77fbcfd280541d088bbfad19a9f3e54471508da8b56c90fe4c1f489b40f9a8f4de66eac7f6181b954102c6b50bdc584

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
      Filesize

      325KB

      MD5

      c333af59fa9f0b12d1cd9f6bba111e3a

      SHA1

      66ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0

      SHA256

      fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34

      SHA512

      2f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat
      Filesize

      151KB

      MD5

      c2be5f72a6cb93af45f70fcd786149a6

      SHA1

      91a3250d829e7019c7b96dc2886f1d961169a87f

      SHA256

      f616ad0cc12e4c8c01b1af5dd208aae46a5fdb1b02e8a192dfe84283e1161ca6

      SHA512

      522b82e48fc4d6c94236f6598352ef198500ef83f2b8d890dd14901173b35d179c567e9540908a9bf145f2492043fa6848182634ee4c58956418884449f223bb

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      3KB

      MD5

      5d88df8aab68e5d801ca69cbaa18d745

      SHA1

      816c2ffa0d8bae5c8d3a5856aaf4aaf2aac4f2cc

      SHA256

      ef157a626daf5abb6ec2f1a4378042ea8fc8772242d5bdfd55ae776bb9c96da2

      SHA512

      7ca06c8b266c2d7eae5f89416422b271dc3f0c78960967c24f7024c47f3449d6d4370fd3c51e4ec9eb4d221c6667e13adf034d2bd0b561de04760cad50b50a78

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      4KB

      MD5

      27fc4ac490afac7118a01de349430a24

      SHA1

      bfe347571c475cea3dbe791903285ab3ead68161

      SHA256

      9dedda38ec53fe64aa1291f40750d6e978e6f5c18284e0c77072d8c9ba6a9760

      SHA512

      4788b77a04f3bd1db83a8a3dd52c12320e066097ce4bdff87dd9d363002f52ed0289475f6a2664727e7d5dd18120f21254295bf4a5552c5314cc731ac7b315cd

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      23KB

      MD5

      ea79e956a0d6793cf916d7035db5495a

      SHA1

      5601fa5425b02495d3c25f2926b9c646f91c44d5

      SHA256

      1da38b2520d7cfd373dafd3aaf86373fabbbc8e0cc47cc0089cfeab020fed2bd

      SHA512

      a29cb5978747328192d76f66d3d3bb07db54cad152f9928fd122eb3b0aa6d2d712316335b0fcad49bd25d6c831bed21fd1a307d437804af8fd5e7728a8bb77a1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
      Filesize

      750B

      MD5

      92a8fabea91868a1c4878306d03d2a26

      SHA1

      b0fd096eb9f55c1efcb0f2251b360b64c0b20dfe

      SHA256

      b2b155e66407b22e38ecbc121fffc1dd33a3edeaa379f17c83c2d6ef3c734f96

      SHA512

      a01c08e4f867dcd41de6dcbb0d16f66db309ec03d75cd8a53d0777746717ecf273597518b387f77c824bbc53fe73305c194c2fcc96bc23ae35461a96d2254899

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
      Filesize

      9.1MB

      MD5

      833512c89f1ab92c80131d415f89f442

      SHA1

      dd9953ddcc33278bb97502ffdc6e7462e8005680

      SHA256

      717f80429e16e7c467a8472dfb0404e22fdf2d67ecd94018b6536dc9d995bff6

      SHA512

      f23201251ea19b6122f60a788a027bd59aca1233b17b265709a51a2babc1eea1394a4400eadcc6792bb5f9843d73a95660f60f487779cbfc05766f53fa3ef3d1

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNG
      Filesize

      45KB

      MD5

      66f6065f9f54487aa740e0dcaa2951b4

      SHA1

      6ee958852ac17dd5e7ad2614f697e61dd72c2d80

      SHA256

      2264bcdf6498620779f0c4b8fe23da78c7f7773d9649e0d8efd38e6df0cca232

      SHA512

      4694bea262f6c516d51581a1c652163d9fdafbdfb7540b12b8a972cf2faa612dcf849c56b9b74d4247324e78f9ca5561205fc3ba1542c3104c1fa0986e3c5731

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG10.PNG
      Filesize

      206B

      MD5

      ce98fbb31a48add445b91dea01249599

      SHA1

      aa2496a5a093c852e93dd7bcb85c60a3a5a261d2

      SHA256

      3b67e9de2c970d408662c6f82aa0f4d65545eab6ade30213668580b5d5bdc361

      SHA512

      e2495bc7c106484f25c43c99db1a31c492c6a90abaa761bd67cfc3cc95d3cfa255202d6829bb0fb8834d17a6a5dc29540ba0647a0ec7703c318e1e12521681c5

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG12.PNG
      Filesize

      22KB

      MD5

      0f35a9a97a16daa0192234e5d16a0059

      SHA1

      b6cf13bdb41e1302267cc0b01a842d82e68c32a4

      SHA256

      520ec8af70bf3e6b44becbdb52366c1fe02f6f2b7603fa6bddf0caff641ef027

      SHA512

      8272f78159126ece15c7a1ff7671608a8a5d7738ff1a53879c409be6430eb031a6c8002f3c6b0da5dd66fddda3117f4ba6f9099abf326b69bdbe865e8636489c

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG14.PNG
      Filesize

      41KB

      MD5

      9d63685a0c391d721ebcf87310b25f39

      SHA1

      c9ae79e1db7e17107186d61c306f46d1aeacf064

      SHA256

      55e9b3abdcc91a9981fa413b594d8c243c0947bc5cdb98f50c3edc322a78f044

      SHA512

      f34bffe9451fa2c99804fc7cbd3c9662a5536ca50603f1fd9fe5bf38b426231ea66888993ea9696fbaafb892cfa6cef1d33d5ade4743ffbcd5b330adffb5f19d

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNG
      Filesize

      475B

      MD5

      23f0faf72cf4bb8bb8e98e48826df4ab

      SHA1

      e20a505f97e77c62cc81e76fc73c0e196d6c067d

      SHA256

      97d8f85e825e532d18b6d8d7666d1f939c86397b5a91b809ef5f3f0731de52f6

      SHA512

      6c34b366a54bf34891f16cbf17b1c8f11ec57d6e50473aa60bd5ee4c034056573d948328d6f87c8cabff11d60601efe31e0f4df0b5d6ddd20e8fcca5a818ebb0

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG
      Filesize

      368B

      MD5

      befea87e5bb3fbb2e93fd23f812a7e8e

      SHA1

      3dfa6cfd8556f86907f62ce14cf09c99548bae64

      SHA256

      7e4cf8dc3fe613b14f317ea00a365841bf8a2178a691726e557f314072ae603d

      SHA512

      1ee90b045bffd717730f89c6169f2024b79091b1ee22cd22a6bf65d9a30c94181b12ce817c629e464bc41a38247ba709b12d0ec20e7ef8f64d5ba3e7c7c92d28

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG9.PNG
      Filesize

      438B

      MD5

      bcbf4818ea003315d9c0c4f6fca2838c

      SHA1

      379eedbbf160ef73047a54948c816a9f2bc6dcfb

      SHA256

      97b8e3dac4668d6f745f778b54e6031166d39f73fc893ccdca34e60b2681a4bb

      SHA512

      c1373ea355e33507f034562683795b7d80ed57d4ac2f3d7f09d980039fd632236079be950fa4b6249bf81d0b85f8049ad3621194de8d2d0b0d0f082241ca3125

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
      Filesize

      3KB

      MD5

      95124c42d92dcf85a4720c1b0acee595

      SHA1

      e5e32693541d0dfaddf7b393245fbbb693117cb0

      SHA256

      38c9e46f09a36251fe5dd6df6e1bea79145c7326b816a140eeec3ee9a0d87b82

      SHA512

      3e84650caaf06f968f60d7468f2e0b7ff657fbb19747438ab450272cf20df5dabb7efc11111d38f389cbf05415d01bded36e79d503c3acc55cc381f1cd99e631

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
      Filesize

      3KB

      MD5

      60d832c348c16a66eab4932deb6832be

      SHA1

      7e93e53c58d8aeb2f260e5f788dec34471b8af20

      SHA256

      21de00d3a52fd6806ec2c47731386165a4c64c4a919f042656791197dee9b44d

      SHA512

      c6c8885d2e56dfd20dfb7b4b4edb54338658a58edcdd830736a96325cd0fd7dd526317390b299312468728b71c3ab41379eea1bae7a5e95206d795c81cddd0f3

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
      Filesize

      5KB

      MD5

      4b6d3d78c92a12b15e70e0894a90b058

      SHA1

      59b1dda384a9e10dd7517df7b25fd82240f7b07f

      SHA256

      3fbbc7687c713ce6e49889113f28581354cab3f559c8ae8addbe5881264320d2

      SHA512

      bc56118860113271bda63aa2ee8f19e6586e177b567f7c0a10d5731ef5d153f2638c70335d8bde1b8eb4ae5aec7784989503f5f544d24a2673144cd3cf6c349c

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml
      Filesize

      23KB

      MD5

      2dbed53ff171b2d73ecaedafe00e8e73

      SHA1

      6e195672911efefdec3b6ec1c2fd9fd12bcd4b51

      SHA256

      5e5b0fa8110e596d56d33531ac30dcb3d7c96ecc161221ac832dcb04ffa77875

      SHA512

      39896b59ef60983bc4f20d911f447d19e1a7a73e0124ed6fdca6b35651f312b46ff9f8e7161b67a629edbf0deae4bc2f4107b130c9b50e2ba480230da3fd2742

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.924\dependencies.json
      Filesize

      17KB

      MD5

      63efc497f38e113390292117062cbba6

      SHA1

      be942f92cce4876068f8100e0c2f791cfb2d7acb

      SHA256

      ebc5231524854028e6b4a34bedbb91dbe311e4f40802e88c4ea340c3459db661

      SHA512

      f6850f315cc1f5507ff194b2a2588cfbb3314947b973afe369f75d0435f3a30c2de7086c0796cedb2b156002b2ba5c4c12e3d4dc099f3e5e15cc32a02ea05bb6

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.924\resources.json
      Filesize

      17KB

      MD5

      39ce244fc02a8306645263bc762c3f68

      SHA1

      8a7466cdea0b463346fd9a24928d8c0cfcc6eddf

      SHA256

      d870c69c8a8cc0f64c0c5cc599cad6e64675fd68b80a1d1b6fbcfc5f8945d2e3

      SHA512

      4274215a1ae01d93c0baf46881c4fc1507b20315f8058b587b693da8791c18da318dfd35a1e4ba8bb908b38da935d117d3204dda56a511d0f50dbf411f4ad6aa

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json
      Filesize

      3KB

      MD5

      bbe6c940b1257b9c5b2c153ad15d577e

      SHA1

      68adad71094b3ba44c29ac094d1a3302109897d4

      SHA256

      4b41c9415d9c8657f02c30533824db8c08cfade715a1c558b3838c4e9f89d2a7

      SHA512

      97268f256526280f2e2a7021460210724c87216dd863809233eca8b5c12023b276a3d4ff2f6be05d3bd0652c05a06e106c3d2c4b0cfa28689e45243066ae4602

      Download Submit

    • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig.json
      Filesize

      3KB

      MD5

      e2cbea0a8a22b79e63558273dded5e6c

      SHA1

      bfbbbba0679adcbcf9e079ed3c7c7a60cb0b2d61

      SHA256

      10d0f3646be0a7d73942d7bdd1e55c4b8df0c34cad7ad15a9dc23b2932155007

      SHA512

      a6aa26ff49c911fb4705df1e8e434c72e206b20fdaae0abc529e2734f5db49c75da35c3d75769e0ac1b6795de540de4c7e1089b387217fc58f8b19b023064e5a

      Download Submit

    • C:\Windows\Installer\f786696.msi
      Filesize

      1.0MB

      MD5

      d7390d55b7462787b910a8db0744c1e0

      SHA1

      b0c70c3ec91d92d51d52d4f205b5a261027ba80c

      SHA256

      4a2f7d9d33e4ad643bf72722587f2b268d92dab3bb1d9bc56af316672e34728a

      SHA512

      64f3837dd6099561ce9be97d6fae0b11f3f6cc08281f1a3266d5a6f3ca8baf13bbd780735ef62b449b577d62d086f942b48519671226c60f0e1480f9dbdde434

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
      Filesize

      1.7MB

      MD5

      dabd469bae99f6f2ada08cd2dd3139c3

      SHA1

      6714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b

      SHA256

      89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606

      SHA512

      9c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
      Filesize

      97KB

      MD5

      da1d0cd400e0b6ad6415fd4d90f69666

      SHA1

      de9083d2902906cacf57259cf581b1466400b799

      SHA256

      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

      SHA512

      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      Filesize

      1.2MB

      MD5

      f3b300079862aff353b412d490bf5abc

      SHA1

      b61ad13daa7d39a02aa1329788ece0737390a45d

      SHA256

      c052cb74d9b0ce37efba9c018b5bcf74c51cfbdcaf990ae53cb9772ea318945a

      SHA512

      d6e02701ec0990fd9a4b0e82ce69048a35ac114e7515ed2ed6a445ec9f8ad9f98287491e087a269b3e973fb55da360e2df1a516a9fa850c68cfcfaadacb2fbb6

      Download Submit

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
      Filesize

      1.2MB

      MD5

      07552732fa64db456300880d52e81b2f

      SHA1

      9a653ea405f5f26ec0c2d9a0bc9bcb11ba010efc

      SHA256

      94bc1aa272183daf13f24594493eea40e02cb9861c76f9de3711c139f5315226

      SHA512

      47e97e300330ec1523f4af6e87b9866fae2e90cd9b59fc4d02e53e29b223691f980daf1f221f5286dbc1a9a9ddf6e01e7a597c5cf763710c51d84c8d5bac60b0

      Download Submit

    • \Windows\Installer\MSI6992.tmp
      Filesize

      953KB

      MD5

      64a261a6056e5d2396e3eb6651134bee

      SHA1

      32a34baf051b514f12b3e3733f70e608083500f9

      SHA256

      15c1007015be7356e422050ed6fa39ba836d0dd7fbf1aa7d2b823e6754c442a0

      SHA512

      d3f95e0c8b5d76b10b61b0ef1453f8d90af90f97848cad3cb22f73878a3c48ea0132ecc300bfb79d2801500d5390e5962fb86a853695d4f661b9ea9aae6b8be8

      Download Submit

    • memory/280-3182-0x0000000002210000-0x0000000002211000-memory.dmp

      Filesize

      4KB

      Download

    • memory/280-3151-0x0000000002210000-0x0000000002211000-memory.dmp

      Filesize

      4KB

      Download

    • memory/280-3138-0x0000000002210000-0x0000000002211000-memory.dmp

      Filesize

      4KB

      Download

    • memory/280-3154-0x0000000002210000-0x0000000002211000-memory.dmp

      Filesize

      4KB

      Download

    • memory/280-3156-0x0000000002210000-0x0000000002211000-memory.dmp

      Filesize

      4KB

      Download

    • memory/860-3395-0x0000000001F30000-0x0000000001F31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/860-3393-0x0000000001F30000-0x0000000001F31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1756-2909-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1756-3567-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

      Download

    • memory/1768-15-0x00000000035B0000-0x0000000003999000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1768-16-0x00000000035B0000-0x0000000003999000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1768-6-0x00000000035B0000-0x0000000003999000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1768-830-0x00000000035B0000-0x0000000003999000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/1936-3248-0x000007FFFFF70000-0x000007FFFFF80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2148-848-0x00000000010C0000-0x00000000014A9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2148-801-0x0000000002C80000-0x0000000002C90000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2148-18-0x00000000010C0000-0x00000000014A9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2148-687-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2148-688-0x00000000003A0000-0x00000000003A3000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2148-3067-0x00000000010C0000-0x00000000014A9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2148-796-0x00000000010C0000-0x00000000014A9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2148-2172-0x00000000010C0000-0x00000000014A9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2148-2334-0x00000000010C0000-0x00000000014A9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2148-797-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2148-4164-0x00000000010C0000-0x00000000014A9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2148-1714-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2148-1713-0x00000000010C0000-0x00000000014A9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2148-2173-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2272-2546-0x0000000002560000-0x0000000002570000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2272-2169-0x00000000009D0000-0x0000000000DB9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2272-2134-0x0000000002560000-0x0000000002570000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2272-849-0x00000000009D0000-0x0000000000DB9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2272-4334-0x00000000009D0000-0x0000000000DB9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2272-3066-0x00000000009D0000-0x0000000000DB9000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2588-2175-0x0000000002FB0000-0x0000000003399000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2588-2331-0x0000000002FB0000-0x0000000003399000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2588-2332-0x0000000002FB0000-0x0000000003399000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2588-847-0x0000000002FB0000-0x0000000003399000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2588-834-0x0000000002FB0000-0x0000000003399000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2588-843-0x0000000002FB0000-0x0000000003399000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2588-845-0x0000000002FB0000-0x0000000003399000-memory.dmp

      Filesize

      3.9MB

      Download

    • memory/2824-4214-0x0000000000270000-0x000000000027A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2824-4215-0x0000000000270000-0x000000000027A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2824-4173-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2824-4815-0x0000000000270000-0x000000000027A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2824-4816-0x0000000000270000-0x000000000027A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2964-3124-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2964-3083-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2964-3096-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2964-3099-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3012-3382-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3012-3377-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

      Download