Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    634s
  • max time network
    441s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    19/08/2024, 14:59

General

  • Target

    EnderLauncher - 1.2.zip

  • Size

    13.2MB

  • MD5

    a5968c681cec9969c2bf584780ecb27d

  • SHA1

    367ff09d5ba6e35051bd0f5195c05ebaa825fa7a

  • SHA256

    b6d494896fa5d47ab4e71cfa42f9265d45b9b044c25b2f614e409ebc13af99c6

  • SHA512

    f8fa5899f7a8d8229cf797c00c4d8b0de303d88b123c937255345711643a58a8d590c1dc2cc8292fe223991b5349e956c9b265d078d0a77a31b8fba41b3e8754

  • SSDEEP

    196608:1D/nKt9DwqkixBXhcWDwWB2k0UdtbMtpwaggREKY6ACJrH4T77XXQ/wMRg/yzyJc:29DwqXXuWDwW0euwagEAIHSPXx/vppK

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 58 IoCs
  • Detects Pyinstaller 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\EnderLauncher - 1.2.zip"
    1⤵
      PID:5596
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1576
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\EnderLauncher - 1.2\" -spe -an -ai#7zMap9335:96:7zEvent32438
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2272
      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\EnderLauncher.exe
        "C:\Users\Admin\Desktop\EnderLauncher - 1.2\EnderLauncher.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2896
      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\EnderLauncher.exe
        "C:\Users\Admin\Desktop\EnderLauncher - 1.2\EnderLauncher.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:5756
        • C:\Users\Admin\AppData\Roaming\.ender\runtime\jre-legacy\windows-x64\jre-legacy\bin\java.exe
          C:/Users/Admin/AppData/Roaming/.ender\runtime\jre-legacy\windows-x64\jre-legacy\bin\java.exe -Xmx1G -Xms1G -Djava.library.path=C:/Users/Admin/AppData/Roaming/.ender\versions\1.8.9\natives -cp C:/Users/Admin/AppData/Roaming/.ender\libraries\com\mojang\netty\1.8.8\netty-1.8.8.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\oshi-project\oshi-core\1.1\oshi-core-1.1.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\net\java\dev\jna\jna\3.4.0\jna-3.4.0.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\net\java\dev\jna\platform\3.4.0\platform-3.4.0.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\ibm\icu\icu4j-core-mojang\51.2\icu4j-core-mojang-51.2.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\net\sf\jopt-simple\jopt-simple\4.6\jopt-simple-4.6.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\paulscode\codecjorbis\20101023\codecjorbis-20101023.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\paulscode\codecwav\20101023\codecwav-20101023.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\paulscode\libraryjavasound\20101123\libraryjavasound-20101123.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\paulscode\librarylwjglopenal\20100824\librarylwjglopenal-20100824.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\paulscode\soundsystem\20120107\soundsystem-20120107.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\io\netty\netty-all\4.0.23.Final\netty-all-4.0.23.Final.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\google\guava\guava\17.0\guava-17.0.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org\apache\commons\commons-lang3\3.3.2\commons-lang3-3.3.2.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\commons-io\commons-io\2.4\commons-io-2.4.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\commons-codec\commons-codec\1.9\commons-codec-1.9.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\net\java\jinput\jinput\2.0.5\jinput-2.0.5.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\net\java\jutils\jutils\1.0.0\jutils-1.0.0.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\google\code\gson\gson\2.2.4\gson-2.2.4.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\mojang\authlib\1.5.21\authlib-1.5.21.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\com\mojang\realms\1.7.59\realms-1.7.59.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org\apache\commons\commons-compress\1.8.1\commons-compress-1.8.1.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org\apache\httpcomponents\httpclient\4.3.3\httpclient-4.3.3.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\commons-logging\commons-logging\1.1.3\commons-logging-1.1.3.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org\apache\httpcomponents\httpcore\4.3.2\httpcore-4.3.2.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org\apache\logging\log4j\log4j-api\2.0-beta9\log4j-api-2.0-beta9.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org\apache\logging\log4j\log4j-core\2.0-beta9\log4j-core-2.0-beta9.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org\lwjgl\lwjgl\lwjgl\2.9.4-nightly-20150209\lwjgl-2.9.4-nightly-20150209.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org\lwjgl\lwjgl\lwjgl_util\2.9.4-nightly-20150209\lwjgl_util-2.9.4-nightly-20150209.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org\lwjgl\lwjgl\lwjgl-platform\2.9.4-nightly-20150209\lwjgl-platform-2.9.4-nightly-20150209.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\org/lwjgl/lwjgl/lwjgl-platform/2.9.4-nightly-20150209/lwjgl-platform-2.9.4-nightly-20150209-natives-windows.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\net\java\jinput\jinput-platform\2.0.5\jinput-platform-2.0.5.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\net/java/jinput/jinput-platform/2.0.5/jinput-platform-2.0.5-natives-windows.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\tv\twitch\twitch\6.5\twitch-6.5.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\tv\twitch\twitch-platform\6.5\twitch-platform-6.5.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\tv/twitch/twitch-platform/6.5/twitch-platform-6.5-natives-windows-64.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\tv\twitch\twitch-external-platform\4.5\twitch-external-platform-4.5.jar;C:/Users/Admin/AppData/Roaming/.ender\libraries\tv/twitch/twitch-external-platform/4.5/twitch-external-platform-4.5-natives-windows-64.jar;C:/Users/Admin/AppData/Roaming/.ender\versions\1.8.9\1.8.9.jar net.minecraft.client.main.Main --username sdfsfsdf --version 1.8.9 --gameDir C:/Users/Admin/AppData/Roaming/.ender --assetsDir C:/Users/Admin/AppData/Roaming/.ender\assets --assetIndex 1.8 --uuid "" --accessToken "" --userProperties {} --userType msa
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4652

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\.ender\runtime\jre-legacy\windows-x64\jre-legacy\bin\msvcr100.dll

        Filesize

        809KB

        MD5

        df3ca8d16bded6a54977b30e66864d33

        SHA1

        b7b9349b33230c5b80886f5c1f0a42848661c883

        SHA256

        1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36

        SHA512

        951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

      • C:\Users\Admin\AppData\Roaming\.ender\runtime\jre-legacy\windows-x64\jre-legacy\lib\deploy\messages_zh_HK.properties

        Filesize

        3KB

        MD5

        880baacb176553deab39edbe4b74380d

        SHA1

        37a57aad121c14c25e149206179728fa62203bf0

        SHA256

        ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620

        SHA512

        3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5

      • C:\Users\Admin\AppData\Roaming\.ender\runtime\jre-legacy\windows-x64\jre-legacy\lib\images\cursors\win32_LinkNoDrop32x32.gif

        Filesize

        153B

        MD5

        1e9d8f133a442da6b0c74d49bc84a341

        SHA1

        259edc45b4569427e8319895a444f4295d54348f

        SHA256

        1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

        SHA512

        63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2.zip

        Filesize

        13.2MB

        MD5

        a5968c681cec9969c2bf584780ecb27d

        SHA1

        367ff09d5ba6e35051bd0f5195c05ebaa825fa7a

        SHA256

        b6d494896fa5d47ab4e71cfa42f9265d45b9b044c25b2f614e409ebc13af99c6

        SHA512

        f8fa5899f7a8d8229cf797c00c4d8b0de303d88b123c937255345711643a58a8d590c1dc2cc8292fe223991b5349e956c9b265d078d0a77a31b8fba41b3e8754

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\EnderLauncher.exe

        Filesize

        3.2MB

        MD5

        db6f86fff7068acfebfcb0e5f5d63464

        SHA1

        09b65e4d342c78c6fa9c975c227f75820c2ba465

        SHA256

        f0d46688d4946a7d8a6e29ece59dfb721463c06a4555b2ff64e9153420dd257a

        SHA512

        b7dfee0a9295861d679fe14c9c93beae74b9e09f45c131d70816d5f50089f569d7c4117c8b43c0fdb3827d7bb45bb46490cc181ce983cdf34249fe5708dfb567

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\VCRUNTIME140.dll

        Filesize

        116KB

        MD5

        be8dbe2dc77ebe7f88f910c61aec691a

        SHA1

        a19f08bb2b1c1de5bb61daf9f2304531321e0e40

        SHA256

        4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

        SHA512

        0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\VCRUNTIME140_1.dll

        Filesize

        48KB

        MD5

        f8dfa78045620cf8a732e67d1b1eb53d

        SHA1

        ff9a604d8c99405bfdbbf4295825d3fcbc792704

        SHA256

        a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

        SHA512

        ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_bz2.pyd

        Filesize

        83KB

        MD5

        dd26ed92888de9c57660a7ad631bb916

        SHA1

        77d479d44d9e04f0a1355569332233459b69a154

        SHA256

        324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697

        SHA512

        d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_ctypes.pyd

        Filesize

        122KB

        MD5

        c8afa1ebb28828e1115c110313d2a810

        SHA1

        1d0d28799a5dbe313b6f4ddfdb7986d2902fa97a

        SHA256

        8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0

        SHA512

        4d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_decimal.pyd

        Filesize

        251KB

        MD5

        cea3b419c7ca87140a157629c6dbd299

        SHA1

        7dbff775235b1937b150ae70302b3208833dc9be

        SHA256

        95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5

        SHA512

        6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_hashlib.pyd

        Filesize

        64KB

        MD5

        d19cb5ca144ae1fd29b6395b0225cf40

        SHA1

        5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4

        SHA256

        f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa

        SHA512

        9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_lzma.pyd

        Filesize

        156KB

        MD5

        8cfbafe65d6e38dde8e2e8006b66bb3e

        SHA1

        cb63addd102e47c777d55753c00c29c547e2243c

        SHA256

        6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff

        SHA512

        fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_queue.pyd

        Filesize

        31KB

        MD5

        7d91dd8e5f1dbc3058ea399f5f31c1e6

        SHA1

        b983653b9f2df66e721ece95f086c2f933d303fc

        SHA256

        76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d

        SHA512

        b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_socket.pyd

        Filesize

        81KB

        MD5

        e43aed7d6a8bcd9ddfc59c2d1a2c4b02

        SHA1

        36f367f68fb9868412246725b604b27b5019d747

        SHA256

        2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a

        SHA512

        d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_ssl.pyd

        Filesize

        174KB

        MD5

        6a2b0f8f50b47d05f96deff7883c1270

        SHA1

        2b1aeb6fe9a12e0d527b042512fc8890eedb10d8

        SHA256

        68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a

        SHA512

        a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_tkinter.pyd

        Filesize

        64KB

        MD5

        e38a6b96f5cc200f21da22d49e321da3

        SHA1

        4ea69d2b021277ab0b473cfd44e4bfd17e3bac3b

        SHA256

        f0ebdf2ca7b33c26b8938efa59678068d3840957ee79d2b3c576437f8f913f20

        SHA512

        3df55cdd44ea4789fb2de9672f421b7ff9ad798917417dcb5b1d8575804306fb7636d436965598085d2e87256ecb476ed69df7af05986f05b9f4a18eed9629e2

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_uuid.pyd

        Filesize

        25KB

        MD5

        8f5402bb6aac9c4ff9b4ce5ac3f0f147

        SHA1

        87207e916d0b01047b311d78649763d6e001c773

        SHA256

        793e44c75e7d746af2bb5176e46c454225f07cb27b1747f1b83d1748d81ad9ac

        SHA512

        65fdef32aeba850aa818a8c8bf794100725a9831b5242350e6c04d0bca075762e1b650f19c437a17b150e9fca6ad344ec4141a041fa12b5a91652361053c7e81

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\_wmi.pyd

        Filesize

        36KB

        MD5

        bed7b0ced98fa065a9b8fe62e328713f

        SHA1

        e329ebca2df8889b78ce666e3fb909b4690d2daa

        SHA256

        5818679010bb536a3d463eeee8ce203e880a8cd1c06bf1cb6c416ab0dc024d94

        SHA512

        c95f7bb6ca9afba50bf0727e971dff7326ce0e23a4bfa44d62f2ed67ed5fede1b018519dbfa0ed3091d485ed0ace68b52dd0bb2921c9c1e3bc1fa875cd3d2366

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\base_library.zip

        Filesize

        1.3MB

        MD5

        b87e5800fc1d89323217c20b47bb3c06

        SHA1

        561f6540611a88fb9b4b2824d431f454d5e2b66d

        SHA256

        5fc06d7643743f494980821adc434631adcf60c0c7674432ca61d308a093e8db

        SHA512

        8cbef7efd8dd1ea0ab407c7cb84b352694698c109c7d330c765ba590bdb8019a09b576a8759ad522b6259c422f376faee9b8665dc83a86690b55b97df6f36c3c

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\certifi\cacert.pem

        Filesize

        284KB

        MD5

        181ac9a809b1a8f1bc39c1c5c777cf2a

        SHA1

        9341e715cea2e6207329e7034365749fca1f37dc

        SHA256

        488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee

        SHA512

        e19a92b94aedcf1282b3ef561bd471ea19ed361334092c55d72425f9183ebd1d30a619e493841b6f75c629f26f28dc682960977941b486c59475f21cf86fff85

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\charset_normalizer\md.cp312-win_amd64.pyd

        Filesize

        10KB

        MD5

        d9e0217a89d9b9d1d778f7e197e0c191

        SHA1

        ec692661fcc0b89e0c3bde1773a6168d285b4f0d

        SHA256

        ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0

        SHA512

        3b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

        Filesize

        120KB

        MD5

        bf9a9da1cf3c98346002648c3eae6dcf

        SHA1

        db16c09fdc1722631a7a9c465bfe173d94eb5d8b

        SHA256

        4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637

        SHA512

        7371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\customtkinter\assets\themes\blue.json

        Filesize

        4KB

        MD5

        05eb3947ce9a8c3bef66c14d0f938671

        SHA1

        06ffc811ee51609809d88894022e222b339aefee

        SHA256

        c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b

        SHA512

        4db7c14fba78185edf6459016608cb8fa0a250dfb48432c552bb4e0466cf49622b34d847e17c254bb1c8d15bf365e91bce3ede552ba8733fde9d21779f7f1c13

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\jaraco\text\Lorem ipsum.txt

        Filesize

        1KB

        MD5

        4ce7501f6608f6ce4011d627979e1ae4

        SHA1

        78363672264d9cd3f72d5c1d3665e1657b1a5071

        SHA256

        37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b

        SHA512

        a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\libcrypto-3.dll

        Filesize

        5.0MB

        MD5

        e547cf6d296a88f5b1c352c116df7c0c

        SHA1

        cafa14e0367f7c13ad140fd556f10f320a039783

        SHA256

        05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

        SHA512

        9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\libffi-8.dll

        Filesize

        38KB

        MD5

        0f8e4992ca92baaf54cc0b43aaccce21

        SHA1

        c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

        SHA256

        eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

        SHA512

        6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\libssl-3.dll

        Filesize

        768KB

        MD5

        19a2aba25456181d5fb572d88ac0e73e

        SHA1

        656ca8cdfc9c3a6379536e2027e93408851483db

        SHA256

        2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

        SHA512

        df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\pyexpat.pyd

        Filesize

        197KB

        MD5

        815f1bdabb79c6a12b38d84aa343196d

        SHA1

        916483149875a5e20c6046ceffef62dd6089ddd5

        SHA256

        31712ae276e2ced05ecda3e1c08fbbcc2cff8474a972626aba55f7797f0ed8c9

        SHA512

        1078e7e48b6f6ed160ae2bccf80a43a5f1cca769b8a690326e112bf20d7f3d018f855f6aa3b56d315dc0853472e0affcfe8e910b5ce69ce952983cfaa496c21d

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\python312.dll

        Filesize

        6.6MB

        MD5

        cae8fa4e7cb32da83acf655c2c39d9e1

        SHA1

        7a0055588a2d232be8c56791642cb0f5abbc71f8

        SHA256

        8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

        SHA512

        db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\select.pyd

        Filesize

        30KB

        MD5

        79ce1ae3a23dff6ed5fc66e6416600cd

        SHA1

        6204374d99144b0a26fd1d61940ff4f0d17c2212

        SHA256

        678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0

        SHA512

        a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tcl86t.dll

        Filesize

        1.7MB

        MD5

        3ae729942d15f4f48b1ea8c91880f1f4

        SHA1

        d27596d14af5adeb02edab74859b763bf6ac2853

        SHA256

        fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760

        SHA512

        355800e9152daad675428421b867b6d48e2c8f8be9ca0284f221f27fae198c8f07d90980e04d807b50a88f92ffb946dc53b7564e080e2e0684f7f6ccc84ff245

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tcl8\8.5\msgcat-1.6.1.tm

        Filesize

        34KB

        MD5

        bd4ff2a1f742d9e6e699eeee5e678ad1

        SHA1

        811ad83aff80131ba73abc546c6bd78453bf3eb9

        SHA256

        6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb

        SHA512

        b77e4a68017ba57c06876b21b8110c636f9ba1dd0ba9d7a0c50096f3f6391508cf3562dd94aceaf673113dbd336109da958044aefac0afb0f833a652e4438f43

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tcl\auto.tcl

        Filesize

        21KB

        MD5

        08edf746b4a088cb4185c165177bd604

        SHA1

        395cda114f23e513eef4618da39bb86d034124bf

        SHA256

        517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c

        SHA512

        c1727e265a6b0b54773c886a1bce73512e799ba81a4fceeeb84cdc33f5505a5e0984e96326a78c46bf142bc4652a80e213886f60eb54adf92e4dffe953c87f6b

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tcl\encoding\cp1252.enc

        Filesize

        1KB

        MD5

        e9117326c06fee02c478027cb625c7d8

        SHA1

        2ed4092d573289925a5b71625cf43cc82b901daf

        SHA256

        741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e

        SHA512

        d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tcl\init.tcl

        Filesize

        25KB

        MD5

        fe92c81bb4acdda00761c695344d5f1e

        SHA1

        a87e1516fbd1f9751ec590273925cbc5284b16bd

        SHA256

        7a103a85413988456c2ad615c879bbcb4d91435bcfbbe23393e0eb52b56af6e2

        SHA512

        c983076e420614d12ab2a7342f6f74dd5dcdad21c7c547f660e73b74b3be487a560abd73213df3f58be3d9dbd061a12d2956ca85a58d7b9d9e40d9fa6e6c25eb

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tcl\package.tcl

        Filesize

        23KB

        MD5

        ddb0ab9842b64114138a8c83c4322027

        SHA1

        eccacdc2ccd86a452b21f3cf0933fd41125de790

        SHA256

        f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948

        SHA512

        c0cf718258b4d59675c088551060b34ce2bc8638958722583ac2313dc354223bfef793b02f1316e522a14c7ba9bed219531d505de94dc3c417fc99d216a01463

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tcl\tclIndex

        Filesize

        5KB

        MD5

        c62fb22f4c9a3eff286c18421397aaf4

        SHA1

        4a49b8768cff68f2effaf21264343b7c632a51b2

        SHA256

        ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89

        SHA512

        558d401cb6af8ce3641af55caebc9c5005ab843ee84f60c6d55afbbc7f7129da9c58c2f55c887c3159107546fa6bc13ffc4cca63ea8841d7160b8aa99161a185

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tcl\tm.tcl

        Filesize

        11KB

        MD5

        215262a286e7f0a14f22db1aa7875f05

        SHA1

        66b942ba6d3120ef8d5840fcdeb06242a47491ff

        SHA256

        4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f

        SHA512

        6ecd745d7da9d826240c0ab59023c703c94b158ae48c1410faa961a8edb512976a4f15ae8def099b58719adf0d2a9c37e6f29f54d39c1ab7ee81fa333a60f39b

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tk86t.dll

        Filesize

        1.5MB

        MD5

        966580716c0d6b7eec217071a6df6796

        SHA1

        e3d2d4a7ec61d920130d7a745586ceb7aad4184d

        SHA256

        afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2

        SHA512

        cf0675ea888a6d1547842bcfb27d45815b164337b4a285253716917eb157c6df3cc97cba8ad2ab7096e8f5131889957e0555bae9b5a8b64745ac3d2f174e3224

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\tk\tk.tcl

        Filesize

        23KB

        MD5

        184d05201893b2042d3fa6140fcf277c

        SHA1

        aad67797864456749adf0c4a1c0be52f563c8fb8

        SHA256

        1d5e7518afc1382e36bf13fc5196c8a7cd93a4e9d24acf445522564245a489b0

        SHA512

        291bdf793cabc5ec27e8265a8a313fe0f4acab4db6ce507a46488a83eef72cd43cf5815762b22d1c8d64a9eedea927e109f937e6573058e5493b1354dd449cb3

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\unicodedata.pyd

        Filesize

        1.1MB

        MD5

        b848e259fabaf32b4b3c980a0a12488d

        SHA1

        da2e864e18521c86c7d8968db74bb2b28e4c23e2

        SHA256

        c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c

        SHA512

        4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

      • C:\Users\Admin\Desktop\EnderLauncher - 1.2\_internal\zlib1.dll

        Filesize

        143KB

        MD5

        4fadeda3c1da95337b67d15c282d49d8

        SHA1

        f49ee3256f8f5746515194114f7ef73d6b6141c0

        SHA256

        28484bcea1e387c4a41564af8f62c040fe203fe2491e415ce90f3d7f5c7ab013

        SHA512

        45634caf9d9214f0e45e11a1539d8663b45527e1ae9282558b5fdb8465d90b0fabcf4c0e508504427a597ba390c029bc12068ac17d842fd0fcbb1886d252c6b1

      • memory/2896-1990-0x00007FF99D8C0000-0x00007FF99D8EA000-memory.dmp

        Filesize

        168KB

      • memory/2896-4412-0x00007FF99D8C0000-0x00007FF99D8EA000-memory.dmp

        Filesize

        168KB

      • memory/4652-4422-0x0000000000670000-0x0000000000671000-memory.dmp

        Filesize

        4KB