Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    523s
  • max time network
    533s
  • platform
    windows7_x64
  • resource
    win7-20240704-es
  • resource tags

    arch:x64arch:x86image:win7-20240704-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    27/09/2024, 09:53

General

  • Target

    TLauncher-Installer-1.5.2.exe

  • Size

    24.1MB

  • MD5

    bf7c6b903ee4acb62a91c2c46d773f88

  • SHA1

    68a5e851745b2c0620cc3a54797f5a440f849df1

  • SHA256

    31109bf139e93350f2adf5aceb87184ad8dacebf3ad31190451f44768a9f6725

  • SHA512

    7d3f82ec46c26fab2270181e7fcb6dc683ce66053dee1bff150960bb8416d0db28c37a324fbfa1bb0a7f424047dfac2f3d32deafc00f99c335e312bc38452e64

  • SSDEEP

    786432:TKQdii3bJZM9irrKJBH5lFRqkd4zUcjc+orlG:TKULMQPKJBZlCkOQcrorl

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 12 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 14 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.5.2.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.5.2.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.5.2.exe" "__IRCT:3" "__IRTSS:25260951" "__IRSID:S-1-5-21-3434294380-2554721341-1919518612-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1679762 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1709878" "__IRSID:S-1-5-21-3434294380-2554721341-1919518612-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:3004
      • C:\Users\Admin\AppData\Local\Temp\jre-windows.exe
        "C:\Users\Admin\AppData\Local\Temp\jre-windows.exe" STATIC=1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Users\Admin\AppData\Local\Temp\jds259461861.tmp\jre-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\jds259461861.tmp\jre-windows.exe" "STATIC=1"
          4⤵
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2668
          • C:\Program Files\Java\jre-1.8\bin\javaw.exe
            -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
            5⤵
            • Executes dropped EXE
            PID:2352
          • C:\Program Files\Java\jre-1.8\bin\javaw.exe
            -Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre-1.8\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
            5⤵
            • Executes dropped EXE
            PID:2128
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2392
        • C:\Program Files\Java\jre-1.8\bin\javaw.exe
          "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2280
          • C:\Windows\system32\icacls.exe
            C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
            5⤵
            • Modifies file permissions
            PID:2660
          • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exe
            C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\bin\java.exe -Xmx1024m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\fluent-hc-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.8.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\hamcrest-core-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient-4.5.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore-4.4.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-17.0.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junit-4.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.2721.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.72.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-server-API-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\url-cache-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.9289.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.9289
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Network Configuration Discovery: Internet Connection Discovery
            • System Time Discovery
            • Checks processor information in registry
            • Suspicious use of SetWindowsHookEx
            PID:2672
            • C:\Windows\system32\cmd.exe
              cmd.exe /C chcp 437 & wmic CPU get NAME
              6⤵
                PID:2692
                • C:\Windows\system32\chcp.com
                  chcp 437
                  7⤵
                    PID:1056
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic CPU get NAME
                    7⤵
                      PID:2644
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /C chcp 437 & set processor
                    6⤵
                      PID:1156
                      • C:\Windows\system32\chcp.com
                        chcp 437
                        7⤵
                          PID:3048
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /C chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                        6⤵
                          PID:3036
                          • C:\Windows\system32\chcp.com
                            chcp 437
                            7⤵
                              PID:1252
                            • C:\Windows\system32\dxdiag.exe
                              dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                              7⤵
                                PID:2208
                                • C:\Windows\SysWOW64\dxdiag.exe
                                  "C:\Windows\SysWOW64\dxdiag.exe" /whql:off /t C:\Users\Admin\AppData\Roaming\.minecraft\logs\tlauncher\dxdiag.txt
                                  8⤵
                                  • Drops file in System32 directory
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2496
                            • C:\Windows\system32\cmd.exe
                              cmd.exe /C chcp 437 & wmic qfe get HotFixID
                              6⤵
                                PID:2752
                                • C:\Windows\system32\chcp.com
                                  chcp 437
                                  7⤵
                                    PID:1296
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic qfe get HotFixID
                                    7⤵
                                      PID:2468
                        • C:\Windows\system32\msiexec.exe
                          C:\Windows\system32\msiexec.exe /V
                          1⤵
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • Blocklisted process makes network request
                          • Enumerates connected drives
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1168
                          • C:\Windows\system32\MsiExec.exe
                            C:\Windows\system32\MsiExec.exe -Embedding B1D0A551C9CEDFBADC8A272289B7CFDC
                            2⤵
                            • Loads dropped DLL
                            PID:2396
                          • C:\Program Files\Java\jre-1.8\installer.exe
                            "C:\Program Files\Java\jre-1.8\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre-1.8\\" STATIC=1 INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={71024AE4-039E-4CA4-87B4-2F64180401F0}
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Installs/modifies Browser Helper Object
                            • Drops file in System32 directory
                            • Modifies Internet Explorer settings
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:2304
                            • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                              "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:2364
                            • C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
                              "C:\Program Files\Java\jre-1.8\bin\ssvagent.exe" -doHKCUSSVSetup
                              3⤵
                              • Executes dropped EXE
                              • Modifies registry class
                              PID:2912
                            • C:\Program Files\Java\jre-1.8\bin\javaws.exe
                              "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -permissions -silent
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:2900
                              • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
                                "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
                                4⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:1828
                            • C:\Program Files\Java\jre-1.8\bin\javaws.exe
                              "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -wait -fix -shortcut -silent
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:1552
                              • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
                                "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
                                4⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:2020
                          • C:\Windows\system32\MsiExec.exe
                            C:\Windows\system32\MsiExec.exe -Embedding DBD9467D5E278EF15243335C81F1A13C M Global\MSI0000
                            2⤵
                              PID:932
                            • C:\Windows\system32\MsiExec.exe
                              C:\Windows\system32\MsiExec.exe -Embedding 1C719F2485C00E42B24F63D55F312938
                              2⤵
                                PID:2324
                              • C:\Windows\Installer\MSIA453.tmp
                                "C:\Windows\Installer\MSIA453.tmp" C:\Program Files\Java\jre7\;C;2
                                2⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3060
                              • C:\Windows\system32\rundll32.exe
                                rundll32.exe "C:\Program Files\Java\jre7\bin\\installer.dll",UninstallJREEntryPoint
                                2⤵
                                • Installs/modifies Browser Helper Object
                                • Drops file in System32 directory
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                PID:2764
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding AD7615109686DDC9D2C0DB53F10A09C4
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2272
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding D77581D5F9AD493076D7DC257AB6C373 M Global\MSI0000
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:848
                            • C:\Windows\system32\AUDIODG.EXE
                              C:\Windows\system32\AUDIODG.EXE 0xc8
                              1⤵
                                PID:2404

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Config.Msi\f772714.rbs

                                Filesize

                                963KB

                                MD5

                                3df3a0e9a73f9e554bc5ff950c0154fb

                                SHA1

                                101b55e2191cc1ede11383a26166b1709d8e030b

                                SHA256

                                984a1ff9eb749817b3eed666d1e054d15f6b91cf7e63bd75c01997fcebfe924a

                                SHA512

                                73cea95887a5014e2cf41f03163f3f4d675f3c77b9923eb47f236be20d0e048617d833c57235dd802f8c20cb310c2efa5c908578c0bbd467d4aa34ac0c7a0394

                              • C:\Config.Msi\f772719.rbs

                                Filesize

                                113KB

                                MD5

                                41556efdc8fda4e56dc2d75f4d761cb1

                                SHA1

                                4426f65c33c808f850aa01bb55877601e89e7061

                                SHA256

                                9bec582cd01a8a5f0fe4e91175957719a26d348341b480c32686ef457ebfcd60

                                SHA512

                                1bfc72dca05dd4738c3f72ac0f164560aad9f7dd5897cded43ac890c9c70c2dede9427a4e8350d9b98cdbf7b0d3da374722e633ff7a4f44b2dabce348e0513dd

                              • C:\Config.Msi\f772961.rbs

                                Filesize

                                7KB

                                MD5

                                2fa281f9a2abd364885d58337dbfb5d9

                                SHA1

                                6390240d831a1e24e202ad470fb02445a9622c13

                                SHA256

                                619c7367bb8e0a53b18c9c744807cd94bf8269b8aac222eda95f7312498ba6c0

                                SHA512

                                7ee50d2e32601142d1dff7568bd07cb44efdd8e3892dcd235f0762de7e5e5255ac22ecf97bacd639939ce018f97d35ed56615295baf3639409cc2c735e0ef6a1

                              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Documentación de Referencia.lnk

                                Filesize

                                197B

                                MD5

                                b5e1de7d05841796c6d96dfe5b8b338c

                                SHA1

                                c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547

                                SHA256

                                062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d

                                SHA512

                                963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d

                              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Obtener Ayuda.url

                                Filesize

                                177B

                                MD5

                                6684bd30905590fb5053b97bfce355bc

                                SHA1

                                41f6b2b3d719bc36743037ae2896c3d5674e8af7

                                SHA256

                                aa4868d35b6b3390752a5e34ab8e5cba90217e920b8fb8a0f8e46edc1cc95a20

                                SHA512

                                1748ab352ba2af943a9cd60724c4c34b46f3c1e6112df0c373fa9ba8cb956eb548049a0ac0f4dccff6b5f243ff2d6d210661f0c77b9e1e3d241a404b86d54644

                              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visite Java.com.url

                                Filesize

                                173B

                                MD5

                                625bd85c8b8661c2d42626fc892ee663

                                SHA1

                                86c29abb8b229f2d982df62119a23976a15996d9

                                SHA256

                                63c2e3467e162e24664b3de62d8eeb6a290a8ffcdf315d90e6ca14248bc0a13a

                                SHA512

                                07708de888204e698f72d8a8778ed504e0fe4d159191efb48b815852e3997b50a27ba0bc8d9586c6fb4844166f38f5f9026a89bbbc3627e78121373982656f12

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                Filesize

                                471B

                                MD5

                                48ae95acaa8c8c1563df6ab6ea8d5027

                                SHA1

                                85f4aa8e6961c4ef21e4f7a1888effb64354d626

                                SHA256

                                d327747c1d79878124c82eb4c8f6e35ed30d752b99f4b18d15beccf6f1e695cf

                                SHA512

                                6318314b145667c6ab468571e986259b4577754d40c6400d8400cea54584e0ae6ba30b361e5174a2a2f6c2a844f7985d463c7d94db29ffe85077a68a43f5dea1

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                Filesize

                                342B

                                MD5

                                afa60ceabed78f6e0e6fe1f52c8b7b48

                                SHA1

                                05b411061629f5735130cb28f5aea4de23428303

                                SHA256

                                9b5a938717588b1b804db62ebefb3cb20f07ae822861c57fd107387058807d48

                                SHA512

                                c9266690b01c394025410568121abb0471f4bb17a0988a28aaf7a98a53c9fd675357c9a4fbf4da04974a112131d46c8fe1b8c9be03acb6ecf63607685f09cc2f

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                Filesize

                                342B

                                MD5

                                d5f57a3c061348e2366c1113d201549e

                                SHA1

                                a10bbeb2b9166010837b20affc38e5b4f99b375b

                                SHA256

                                6a00416edda4abcecb24d2e137d374769f9860f41c64865d9ad7c9b945251b9b

                                SHA512

                                a40be7c346eb6bae72bb6aaa74ecf8719fb20ba9326bf26f7dfbde6a43c5093a9b932df47907957989f5b4994a5a2dc04fa4f42dfe5d6afbb0efa721f7adc798

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                Filesize

                                342B

                                MD5

                                07548f97843a66c2e234e71c31b3fcee

                                SHA1

                                a17b89d452778b4843259505260333c2be733d4a

                                SHA256

                                1987df6bb1585df5ed288a9a1515bab4c4b55dbc4bfeaa0a31059db77998d31f

                                SHA512

                                6fe0ce32319eb3a51da26f9fac45ae10eb73b503ea019c1e59de74688cf385eb9378fc73b27cb0c6c5316b89aff54d9ab1e1a5d28008c2336e733e86eace04c7

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                Filesize

                                400B

                                MD5

                                2281a3f033bc61065b83faabb2814664

                                SHA1

                                fa1bea3a8158f7f9e295171782c83a5a55ce4626

                                SHA256

                                59333d67907321e120d96fabcd9584aed609997cc31af1765ca8a4005f2428c8

                                SHA512

                                5c7c3aec842c758df2f2c231b60569a21fc4008050ed6311376edaaa479aacb4572b25f09c58600a45a4739a6b3318439c70071de2f462b9431cc98bb8135dd3

                              • C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.8.0_401\Java3BillDevices.png

                                Filesize

                                11KB

                                MD5

                                b3c9f084b052e95aa3014e492d16bfa6

                                SHA1

                                0e33962b2191e7b1a5d85102cdf3c74fcd1254e4

                                SHA256

                                a68ddd67f6fcb0bbf1defa0778ee543e92c1074c442197ab623f733cc6285948

                                SHA512

                                06f51ac2962a0ec5f05ad6c90a2ba85b851d1fa2f0c079dc264fe930316cead959f68f6e34ff591b131867b482c266ac42400b06385dae712637ff0a90f902d4

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH\common[1]

                                Filesize

                                1KB

                                MD5

                                f5bb484d82e7842a602337e34d11a8f6

                                SHA1

                                09ea1dee4b7c969771e97991c8f5826de637716f

                                SHA256

                                219108bfef63f97562c4532681b03675c9e698c5ae495205853dbcbfd93faf1a

                                SHA512

                                a23cc05b94842e1f3a53c2ea8a0b78061649e0a97fcd51c8673b2bcb6de80162c841e9fdde212d3dfd453933df2362dcb237fe629f802bafaa144e33ca78b978

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH\runtime[1]

                                Filesize

                                42KB

                                MD5

                                5d4657b90d2e41960ebe061c1fd494b8

                                SHA1

                                71eca85088ccbd042cb861c98bccb4c7dec9d09d

                                SHA256

                                93a647b1f2cadcbdb0fe9c46b82b2b4baf7685167de05933811549145c584ee0

                                SHA512

                                237738c0a6cb25efe29effc9c3637245e3e2397207ed51e67bae5a1b54749f88e090de524f7868d964debbb29a920a68205ccbd2dfceed4a1f3cd72d08b16fa3

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\l10n[1]

                                Filesize

                                4KB

                                MD5

                                1fd5111b757493a27e697d57b351bb56

                                SHA1

                                9ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711

                                SHA256

                                85bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f

                                SHA512

                                80f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\masthead_fill[1]

                                Filesize

                                1KB

                                MD5

                                91a7b390315635f033459904671c196d

                                SHA1

                                b996e96492a01e1b26eb62c17212e19f22b865f3

                                SHA256

                                155d2a08198237a22ed23dbb6babbd87a0d4f96ffdc73e0119ab14e5dd3b7e00

                                SHA512

                                b3c8b6f86ecf45408ac6b6387ee2c1545115ba79771714c4dd4bbe98f41f7034eae0257ec43c880c2ee88c44e8fc48c775c5bb4fd48666a9a27a8f8ac6bcfdcb

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\host[1]

                                Filesize

                                1KB

                                MD5

                                a752a4469ac0d91dd2cb1b766ba157de

                                SHA1

                                724ae6b6d6063306cc53b6ad07be6f88eaffbab3

                                SHA256

                                1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3

                                SHA512

                                abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\layout[1]

                                Filesize

                                2KB

                                MD5

                                cc86b13a186fa96dfc6480a8024d2275

                                SHA1

                                d892a7f06dc12a0f2996cc094e0730fe14caf51a

                                SHA256

                                fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058

                                SHA512

                                0e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\masthead_left[1]

                                Filesize

                                4KB

                                MD5

                                b663555027df2f807752987f002e52e7

                                SHA1

                                aef83d89f9c712a1cbf6f1cd98869822b73d08a6

                                SHA256

                                0ce32c034dfb7a635a7f6e8152666def16d860b6c631369013a0f34af9d17879

                                SHA512

                                b104ed3327fed172501c5aa990357b44e3b31bb75373fb8a4ea6470ee6a72e345c9dc4bcf46a1983c81adb567979e6e8e6517d943eb204c3f7fac559cd17c451

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\rtutils[1]

                                Filesize

                                244B

                                MD5

                                c0a4cebb2c15be8262bf11de37606e07

                                SHA1

                                cafc2ccb797df31eecd3ae7abd396567de8e736d

                                SHA256

                                7da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1

                                SHA512

                                cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74

                              • C:\Users\Admin\AppData\Local\Temp\+JXF10044152259971745856.tmp

                                Filesize

                                477KB

                                MD5

                                ec5d243a9958b3858b5a71fb9a690da7

                                SHA1

                                d80b02c91addef2ef58136d1a7df0189f453388c

                                SHA256

                                a4ece920f221b78d43b550d615c5934db162b64a331ffa663a85199e74ef2e6b

                                SHA512

                                479512c6076249a63a822d307b3d8c65d44d19abfadc597f0293fedf2c4fbac2ba6f60ca98d2c1dbb638ad09f3eb1419b6ef391fb098c7d1b62237bce9d79931

                              • C:\Users\Admin\AppData\Local\Temp\+JXF1595900117702839184.tmp

                                Filesize

                                141KB

                                MD5

                                54a91b0619ccf9373d525109268219dc

                                SHA1

                                1d1d41fcadc571decb6444211b7993b99ce926e2

                                SHA256

                                b2efabca5ea4bc56eea829713706b5cd0788b82aca153bd4adde9b1573933b4f

                                SHA512

                                7f79ff3b42a672371814f42814aa5646328b1a314691d30ce09ffdc7a322adcb1af66625274f7fac024ca2f22a42b625001735711c430faef6e077e1f1d24887

                              • C:\Users\Admin\AppData\Local\Temp\+JXF17154604247820268013.tmp

                                Filesize

                                132KB

                                MD5

                                afa7a91dadd77b23634a0fdf18c148f3

                                SHA1

                                6cbb57ba2355cf442e06899898ff5af55867103e

                                SHA256

                                9287925cae90ac480804094ff0876832065e2db116470da1f524d79ed9c18b70

                                SHA512

                                84d123b67505522c256f4ff79c3822eabe2d63036023896e9854298ff39e050bef7894f6320ccf950592015760354683c4dbd19aa203d433a04a5d6bb28e8115

                              • C:\Users\Admin\AppData\Local\Temp\+JXF2137067311484736662.tmp

                                Filesize

                                424KB

                                MD5

                                4c41e856744eb797e9936359a6509287

                                SHA1

                                0959e6f4dd535eb6fae388b6b9ac179dcf3afd76

                                SHA256

                                83ff53f599acefc11f5cf63fd0516d4db72aacf7f0125a5f79c9ff222cbf9dd7

                                SHA512

                                07ae284caa316315da74246c960198a7d549acf86f96cec550f41109fcd870a69ccac9818361657fb859e89d2bdc8398c7731c80d274d99a768102022a5f6e8b

                              • C:\Users\Admin\AppData\Local\Temp\+JXF9236875887625620629.tmp

                                Filesize

                                156KB

                                MD5

                                607fc518b9f6506e5ef66c2839c69149

                                SHA1

                                55be7d31240add9837da746369bf0bb5c52e0f6f

                                SHA256

                                7149f8f1d8b0386ab74427c78d660e211c572ffd901897f86475319d28248083

                                SHA512

                                05785828204fab7789aac12c10fa4d77673ac89741e6749424f863d69f13ac6731ff215eb80eee84820ad0461f754e863c9cb8045beb25efde5179a2c5ccb1ae

                              • C:\Users\Admin\AppData\Local\Temp\Cab88D2.tmp

                                Filesize

                                70KB

                                MD5

                                49aebf8cbd62d92ac215b2923fb1b9f5

                                SHA1

                                1723be06719828dda65ad804298d0431f6aff976

                                SHA256

                                b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                SHA512

                                bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                              • C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log

                                Filesize

                                27KB

                                MD5

                                2e5daeb42147bc8f5def108338d2f72d

                                SHA1

                                d31ec28053797b214a262113fad7ee90bb04e14e

                                SHA256

                                edc2a94734389ad13c53a495d6eda47adf3a09487f73b54ca60e5f2ffac4e88c

                                SHA512

                                569eefea1dc63cb89f386eff80ce0a14e1b173704be35f1a39dfc493898230e47ea56b35055f9b00c78c552f1d8f39873056ee05fdea284c0441ba2ca9c69d17

                              • C:\Users\Admin\AppData\Local\Temp\Tar8904.tmp

                                Filesize

                                181KB

                                MD5

                                4ea6026cf93ec6338144661bf1202cd1

                                SHA1

                                a1dec9044f750ad887935a01430bf49322fbdcb7

                                SHA256

                                8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                SHA512

                                6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

                                Filesize

                                116KB

                                MD5

                                e043a9cb014d641a56f50f9d9ac9a1b9

                                SHA1

                                61dc6aed3d0d1f3b8afe3d161410848c565247ed

                                SHA256

                                9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

                                SHA512

                                4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

                                Filesize

                                1.6MB

                                MD5

                                199e6e6533c509fb9c02a6971bd8abda

                                SHA1

                                b95e5ef6c4c5a15781e1046c9a86d7035f1df26d

                                SHA256

                                4257d06e14dd5851e8ac75cd4cbafe85db8baec17eaebd8f8a983b576cd889f8

                                SHA512

                                34d90fa78bd5c26782d16421e634caec852ca74b85154b2a3499bc85879fc183402a7743dd64f2532b27c791df6e9dd8113cc652dcb0cdf3beae656efe79c579

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP

                                Filesize

                                12KB

                                MD5

                                3adf5e8387c828f62f12d2dd59349d63

                                SHA1

                                bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a

                                SHA256

                                1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0

                                SHA512

                                e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG10.PNG

                                Filesize

                                206B

                                MD5

                                e05876a818319a4c70cc2c866caea6c3

                                SHA1

                                e27c39f87fb04e68c50313919367f1479d418ee1

                                SHA256

                                25a2007f1cdefb6461bc35cdee517498572a5c18614b2d60b9222d64c402ab02

                                SHA512

                                58bd266dc7f5face87cb59b0f6ffb2a56dda1846e74bfe6abff994f986a0bd6032c6e08b5650aff32c92fcf7f8ab2fdf3874bcf3692ee5b76a297111197265aa

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG

                                Filesize

                                43KB

                                MD5

                                caa1679cdd9d12b5b556dcbd052a66a2

                                SHA1

                                1b3429513a5d6f63fa372fa76136edd59d01ad65

                                SHA256

                                dbe2426ac4dd762853be5269ab5d15fc67ef00626929b836dee0d4f56639179b

                                SHA512

                                ac58a68070806d3e5f736eb4fb2ff2d33eaa9264a3bce203a1b3e43b6a0cf899d5f76b5f87fd693496f99802a1483a3ae7314589ae1cfc52d87133404e34be3b

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG16.PNG

                                Filesize

                                644B

                                MD5

                                7c30c405d19c2fe417687a3c9407d1fc

                                SHA1

                                62849d28e4b524dbdebc4ad2ea4646bdc6a0bed8

                                SHA256

                                2ae465c65379fbb48a7129eb14d5039383e2506b07eeeb4616670a8db71b8eba

                                SHA512

                                60b3efcc81290bfbe7147bf2447b66bc20cabc45982916aec180c17a5e5ed08cceb740dc8ffe47fcb51f06217635b4abc922422a691693f81de73db6b62782da

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG18.PNG

                                Filesize

                                40KB

                                MD5

                                55a998b77aa4894e34a1bd8594316b7f

                                SHA1

                                f7f710a7723d9b3d339dd744c7eca83d1a0e1b78

                                SHA256

                                619772c984fa29dbead3a0441086c748de6c2a577f389fdc92b22764855b98db

                                SHA512

                                7052932a369873219795693ecf0797cfae944e10074d26e6f1e3e59cee5b9dc13bc6102dfab8b89a177d264e9a0169c3c63d4babfff3e480d3e88474fc5aacc7

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG19.PNG

                                Filesize

                                40KB

                                MD5

                                ba34708a165478c7dd3622052cf20382

                                SHA1

                                1b5043ad8a229ad6a2ac62252c3b24e6249a7e60

                                SHA256

                                d393417f3aa0bdb4a627c37c32f38536760d5709f5dce2145fd08c41a66ffbe8

                                SHA512

                                d4b715f56ecc6ac2f89082f51b7477706dc39648bc35c35df72d150a32da8dfad042a056c4a871be3befeb1f2ac5c93665ffd5f225475354ca809eecb46cafa5

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP

                                Filesize

                                12KB

                                MD5

                                f35117734829b05cfceaa7e39b2b61fb

                                SHA1

                                342ae5f530dce669fedaca053bd15b47e755adc2

                                SHA256

                                9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3

                                SHA512

                                1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP

                                Filesize

                                12KB

                                MD5

                                f5d6a81635291e408332cc01c565068f

                                SHA1

                                72fa5c8111e95cc7c5e97a09d1376f0619be111b

                                SHA256

                                4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26

                                SHA512

                                33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG49.BMP

                                Filesize

                                1.8MB

                                MD5

                                5c9fb63e5ba2c15c3755ebbef52cabd2

                                SHA1

                                79ce7b10a602140b89eafdec4f944accd92e3660

                                SHA256

                                54ee86cd55a42cfe3b00866cd08defee9a288da18baf824e3728f0d4a6f580e7

                                SHA512

                                262c50e018fd2053afb101b153511f89a77fbcfd280541d088bbfad19a9f3e54471508da8b56c90fe4c1f489b40f9a8f4de66eac7f6181b954102c6b50bdc584

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG

                                Filesize

                                438B

                                MD5

                                8a28c899eb9a0e38337aec03dc0bd343

                                SHA1

                                8e38d9c3ceeca47e3b4247712f1f1ede72e03efd

                                SHA256

                                a7f18df02aa59a98cabb04a85fee8e62b0a806a3c340b3811a8c3b5a94d2208e

                                SHA512

                                0524dfb937827dc4fe78dddf8b8b4f08715bd690f926a3e9361887d5860e6b550c54fd71580d876bedca189c8bb09295c11e27b49da958bb0713ad274e9a4fcd

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

                                Filesize

                                325KB

                                MD5

                                c333af59fa9f0b12d1cd9f6bba111e3a

                                SHA1

                                66ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0

                                SHA256

                                fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34

                                SHA512

                                2f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat

                                Filesize

                                151KB

                                MD5

                                c2be5f72a6cb93af45f70fcd786149a6

                                SHA1

                                91a3250d829e7019c7b96dc2886f1d961169a87f

                                SHA256

                                f616ad0cc12e4c8c01b1af5dd208aae46a5fdb1b02e8a192dfe84283e1161ca6

                                SHA512

                                522b82e48fc4d6c94236f6598352ef198500ef83f2b8d890dd14901173b35d179c567e9540908a9bf145f2492043fa6848182634ee4c58956418884449f223bb

                              • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

                                Filesize

                                1.2MB

                                MD5

                                07552732fa64db456300880d52e81b2f

                                SHA1

                                9a653ea405f5f26ec0c2d9a0bc9bcb11ba010efc

                                SHA256

                                94bc1aa272183daf13f24594493eea40e02cb9861c76f9de3711c139f5315226

                                SHA512

                                47e97e300330ec1523f4af6e87b9866fae2e90cd9b59fc4d02e53e29b223691f980daf1f221f5286dbc1a9a9ddf6e01e7a597c5cf763710c51d84c8d5bac60b0

                              • C:\Users\Admin\AppData\Local\Temp\java_install_reg.log

                                Filesize

                                5KB

                                MD5

                                515c45d9da4c615f7aa931fe67941121

                                SHA1

                                71582470022487dc37cbcae8395bf9614ee8b365

                                SHA256

                                251c6dcbaff7129aba535ab84bba4e4828f2eacee8172d6b07acb4db2714c6c9

                                SHA512

                                587c416a401848ee7306a26c8a3100f778e71ccf1cbccdb04be9b405f85201120c2a1aac7551d6d119153d52b464eace7bf78fd4b0a81b8952700d30cb44f06f

                              • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                Filesize

                                3KB

                                MD5

                                2128c8cb3379b7916372d3c7716cd78f

                                SHA1

                                9a673ad25ab42473a4130a28c3adf7bafd853cfe

                                SHA256

                                b736346524f6418b7e1230d975d353246c9f00247b3b08682b89493899ba36b6

                                SHA512

                                0edffa9f7931b9bbf4f803f77bf10047514bf0ae8e64787839a5166b47a8d9573e8af277471e50ddcc6892eac0f6b346629ca6ea5be8167544b9def94e3299f1

                              • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                Filesize

                                4KB

                                MD5

                                cee5b85cc7de4ef1d3aa9e2eba91dcce

                                SHA1

                                2fd2c3538746f0d8f42b8933e8a5bc2b271a1b62

                                SHA256

                                fff7f4983bc3b7bbd3de7f823374d255e4551b2daefa5430a01a129d02251e0f

                                SHA512

                                6564a94cb1727f68dc1b65da2612b0a471e18ed31cea886810a695b8bd968898c38b9ca6045cb0c5e7a961c97e715f61cf200f32557b9fbd983e346d74d6ecc5

                              • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                Filesize

                                25KB

                                MD5

                                7cf9ac5c128128608e1658fe13268fd5

                                SHA1

                                046d1c01b3a78b0ef184675e64ff00534d7b6075

                                SHA256

                                ca97ce8e3f40b6132539fbba3d81b559c01e09cea33f915f5d3050cf3773c91c

                                SHA512

                                e7644b227a3dec4b33696eea9a7e390b8f9011bf8ef03d9dfa3a8f9affaaa9c1c6b66675e38e4e0948d480ee2a2bfc65fa5dc992783ac4499157c595a820ff98

                              • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

                                Filesize

                                750B

                                MD5

                                4f9059a32345e505f9e95fe0aee35ed7

                                SHA1

                                6a8ec7dff2149880d659dc0ad4d18effbf483b69

                                SHA256

                                0c815e7ee0d0f4a699712df56276949791633d7dafe3de8f7850618d169e8940

                                SHA512

                                c8ffa77179ac3f8b0a10dd1cad7c06e970418f507af0e8406d5c1e83c87ab27fb9c7d7603685a5359326d57578daacf3ef7816e04f2c34874fdf90da5a75d0ad

                              • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

                                Filesize

                                9.1MB

                                MD5

                                3fd8ea8955585f1867dfe40bcebe4f6a

                                SHA1

                                e79885c300af3111f15e56544d4dab7f5187dab0

                                SHA256

                                4a57d4e4de95e922353d327b318ef70de5431d57254f23487af9a87a2bd5d346

                                SHA512

                                42d8f094eb5b534303e90534d0bad4e4de9f72d002fffb75b7d905d7f921fc12a15451671b71017de9ffb00c5d21e34909b34e4b3e13ca6897d6971ba969c029

                              • C:\Users\Admin\AppData\Roaming\.minecraft\TlauncherProfiles.json

                                Filesize

                                439B

                                MD5

                                465f50c84944408a6a28a9165451297f

                                SHA1

                                99bd0afb8bc03233f7039d302f90f3597efb4d07

                                SHA256

                                a675683c36ff7dd960f80a3ec52072eea3e677b290cb637332b1701c1b6ebd61

                                SHA512

                                9362566244e13397a3fb45d7585921a50f5c391d1164db1ed100459e6200d25163e1996c8b770aa43f6ddf2d12a7610f0094a78bfce126d99cf9676b5bc233a2

                              • C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\66\666999116c467f10622db1527a06ddc0a6efad2a.tlauncherdownload

                                Filesize

                                1.4MB

                                MD5

                                d635e313e3178146dd6833844c52c16b

                                SHA1

                                666999116c467f10622db1527a06ddc0a6efad2a

                                SHA256

                                8f6a12f09a805b3e6c2e412050a14912c74f6ff31b157dc08f38eb10144c4643

                                SHA512

                                937d6635137db6ec5d4dabea7fed54264ac2e1368f77f4dbbbbca8a8d2a6e0669ac51477775d33db3a458f8f97141e10f636acafdefda5a49c99392033758e7f

                              • C:\Users\Admin\AppData\Roaming\.minecraft\assets\objects\ec\ec92a55cb324afd2b78cb6f7b1426fd80bf4d754.tlauncherdownload

                                Filesize

                                438KB

                                MD5

                                078b15d73729b693dc31fb5dbd2e8686

                                SHA1

                                ec92a55cb324afd2b78cb6f7b1426fd80bf4d754

                                SHA256

                                cc29fb5e5ebf4ca7f983b012af208371db40388c94385de59d7d758ebf9e69a5

                                SHA512

                                debbc0a4463c8ddb56b16ef9aaeed2a64f6b05dc9b11928c27a0ac34c83d1caeaa8f53816093db5a6630970d46516e019d18f1bd799a67c922644cae578e9751

                              • C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.1\failureaccess-1.0.1.jar

                                Filesize

                                4KB

                                MD5

                                091883993ef5bfa91da01dcc8fc52236

                                SHA1

                                1dcf1de382a0bf95a3d8b0849546c88bac1292c9

                                SHA256

                                a171ee4c734dd2da837e4b16be9df4661afab72a41adaf31eb84dfdaf936ca26

                                SHA512

                                f8d59b808d6ba617252305b66d5590937da9b2b843d492d06b8d0b1b1f397e39f360d5817707797b979a5bf20bf21987b35333e7a15c44ed7401fea2d2119cae

                              • C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-logging\commons-logging\1.2\commons-logging-1.2.jar

                                Filesize

                                60KB

                                MD5

                                040b4b4d8eac886f6b4a2a3bd2f31b00

                                SHA1

                                4bfc12adfe4842bf07b657f0369c4cb522955686

                                SHA256

                                daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636

                                SHA512

                                ed00dbfabd9ae00efa26dd400983601d076fe36408b7d6520084b447e5d1fa527ce65bd6afdcb58506c3a808323d28e88f26cb99c6f5db9ff64f6525ecdfa557

                              • C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\github\classgraph\classgraph\4.8.110\classgraph-4.8.110.jar.tlauncherdownload

                                Filesize

                                522KB

                                MD5

                                8a9143146fb4e5089159a8eba84c34ee

                                SHA1

                                892977fc6be6d049afd057b673bd42cdd4d74d5e

                                SHA256

                                a070b599da15fd66f892a09b7d7d47785e276943b570e382aaf8aac0f0f211b2

                                SHA512

                                c5ee236127ee564c81526cc039aa20e8e8718a861e8f0967b0df4d1226a8a6abbdcd4ba47b2243ef87fb8e63e8644cee16b63df2206e22c509c88fbf0fa5027c

                              • C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar

                                Filesize

                                76KB

                                MD5

                                eb0d9dffe9b0eddead68fe678be76c49

                                SHA1

                                4fdac2fbe92dfad86aa6e9301736f6b4342a3f5c

                                SHA256

                                df26cc58f235f477db07f753ba5a3ab243ebe5789d9f89ecf68dd62ea9a66c28

                                SHA512

                                cbc27e0b6da6ae4b6245353d6626d2e3c171c3026a555fa21e8ef61b30714e286db85086d1a57c167016e8a7f07be2a243e34b3ab504b1877806f3bcec5df986

                              • C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\tlauncher\tl_skin_cape_1.21_1.21.1\1.35d\tl_skin_cape_1.21_1.21.1-1.35d.jar.tlauncherdownload

                                Filesize

                                955KB

                                MD5

                                2b3d9ee28ec4834d4b844ac390db95b1

                                SHA1

                                90431b7b07a5bdeb7a14b2d154f01647ca9f04f3

                                SHA256

                                4572401d8fcfaafde784c6eb5ff6c70d739e3ad8f29be9613fc9754e916fcc14

                                SHA512

                                f360a3755fd13076a62042bf4f90846741e1171f07a20ee02605f9c48beba837fd31a4c553e4e1f23677c14bf5e1af293348d3389b6cb03c47ac895e5cb0c58b

                              • C:\Users\Admin\AppData\Roaming\.minecraft\libraries\v1\objects\30c73b1c5da787909b2f73340419fdf13b9def88\client.jar

                                Filesize

                                25.6MB

                                MD5

                                0b90a83eb9910468c60152f6594b9271

                                SHA1

                                30c73b1c5da787909b2f73340419fdf13b9def88

                                SHA256

                                499f6897d1837516680f3114072d8106e11c9adcd933fe5cf051b551089b0c99

                                SHA512

                                a63c09e9b8cfe80bd5815c88818291d54cbe7c9ffcd806be6365376e865c44d5aa85e8348467e6ded8f4d9722047d3c5b075f755047a982c2e75223d2b9f68ac

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\logging.properties

                                Filesize

                                2KB

                                MD5

                                0f00ec3e7a7767a4efeae1875fb5f3d4

                                SHA1

                                167808418571e9209b952188ddab2f4e62920e68

                                SHA256

                                b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f

                                SHA512

                                e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\net.properties

                                Filesize

                                6KB

                                MD5

                                385443b7e4a37bc277c018cd1d336d49

                                SHA1

                                b2c0dfb00bf699e817bdd49b14bc24b8d3282c65

                                SHA256

                                5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08

                                SHA512

                                260afc7671a1dc0c443564f1d10386f0b241bb53c76df68d8d03f1d0b1ceaf3f68847ab3477732c876c2b01c812ef7521744befe88e312f3aa63164b608b67a1

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\README.txt

                                Filesize

                                2KB

                                MD5

                                3d47d94bc4f19d18bcc8b23f51d013af

                                SHA1

                                a97cd312d6a2a9c8c780c15e5af51a2f4f97c2cb

                                SHA256

                                6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5

                                SHA512

                                68a031264cf9442526307364ca74b336af55564c233c2f514cac48e910022767562f8ff6a64bb9cfcbf0fb5e755289273382c9246418a4b9207fc7761d03c64e

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\default_US_export.policy.tlauncherdownload

                                Filesize

                                146B

                                MD5

                                1a08ffdf0bc871296c8d698fb22f542a

                                SHA1

                                f3f974d3f6245c50804dcc47173aa29d4d7f0e2c

                                SHA256

                                758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9

                                SHA512

                                4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\default_local.policy

                                Filesize

                                647B

                                MD5

                                6d7b4616a5dba477b6b6d3f9a12e568f

                                SHA1

                                7fb67e217c53a685cb9314001592b5bd50b5fbb9

                                SHA256

                                2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441

                                SHA512

                                a0b98cbbb49184df973bb2c4a506e9bc6e025a696bc0c8054a6352cc3f9b4a38e3baf117c6834ddaddc38498556607ed4eda8f1bc683f662d61da50e0db0c8c2

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\limited\exempt_local.policy

                                Filesize

                                566B

                                MD5

                                4cbb03f484c86cbea1a217baae07d3c9

                                SHA1

                                ee67275bc119c98191a09ff72f043872b05ab7fd

                                SHA256

                                8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9

                                SHA512

                                2bd70518aed6b0e01c520c446830c5f567fa72974548818cac3e1e5c2be6f03db78ce6012f5463b1e19c36243d04cbaad38ec79524635eaae2e427eb1875ccdb

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\security\policy\unlimited\default_local.policy

                                Filesize

                                193B

                                MD5

                                2a0f330c51aff13a96af8bd5082c84a8

                                SHA1

                                ad2509631ed743c882999ac1200fd5fb8a593639

                                SHA256

                                8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a

                                SHA512

                                2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\conf\sound.properties.tlauncherdownload

                                Filesize

                                1KB

                                MD5

                                4f95242740bfb7b133b879597947a41e

                                SHA1

                                9afceb218059d981d0fa9f07aad3c5097cf41b0c

                                SHA256

                                299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66

                                SHA512

                                99fdd75b8ce71622f85f957ae52b85e6646763f7864b670e993df0c2c77363ef9cfce2727badee03503cda41abe6eb8a278142766bf66f00b4eb39d0d4fc4a87

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\ADDITIONAL_LICENSE_INFO

                                Filesize

                                2KB

                                MD5

                                71bb3ad0017bf36d14bb96a8d4b32c45

                                SHA1

                                1a5c553e71bdb7d94995b206bc9eaa49abd1e888

                                SHA256

                                a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916

                                SHA512

                                9f658dfea71bdc3cc1549edfb5ad3171dbfa0082b2d91e820c09abe0b376b6bcd8b5170442a5e25e72274e98f130176bbdecfa7997c59705782b214f02136a20

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\LICENSE

                                Filesize

                                18KB

                                MD5

                                3e0b59f8fac05c3c03d4a26bbda13f8f

                                SHA1

                                a4fb972c240d89131ee9e16b845cd302e0ecb05f

                                SHA256

                                4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726

                                SHA512

                                6732288c682a39ed9edf11a151f6f48e742696f4a762c0c7d8872b99b9f6d5ab6c305064d4910b1a254862a873129f11fd0fa56ff11bc577d29303f4fb492673

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\aes.md

                                Filesize

                                1KB

                                MD5

                                2e33468a535a4eb09ef57fc12a2652d0

                                SHA1

                                e64516f3fa1e72f88caa50f14b8046dd74d012b6

                                SHA256

                                45c6d4da48325edfbff3dcf71c704e504c057904435ed23c6d57046d551eb69d

                                SHA512

                                4d14b5ddbb4d09797264ed29ba71fab6986b4a9e75efb9402c1476e0a9e2884813d6a922dea125643b4f74e1f3e458f4e48d6c840e0f4d16ed72ffbc4611dbb2

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\c-libutl.md

                                Filesize

                                1KB

                                MD5

                                2e89a282a50f8702e52703464e6937ca

                                SHA1

                                cfc22a6f5b17cd539234d5b3160a5224abefadb9

                                SHA256

                                bef40679922d6fdfb7e4ddb223ad6722300f6054ba737bbf6188d60fcec517f9

                                SHA512

                                ae459d8ce5581ea57e203088373c1ce86d122d0e27eb871ee1383e0e64cd8a184fa207eee0e835347316e70afa24a1c95aec30def3e09d15ee19a0b2c3ad2095

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\public_suffix.md

                                Filesize

                                17KB

                                MD5

                                1411e0a639389f2dbb2b21490a5c0713

                                SHA1

                                1706fdcd0dbf23d793f81f4130c81a8d16b4f765

                                SHA256

                                e662969300048d914f80265eb516021ad2b0015c7e7eedd45c93655f11f256d7

                                SHA512

                                cbd16c4c29a51669f51ff9817ed33e29b871df215fb252a946c3b4e80fc83d4f0e4e1b32d46c2998924092e4b14585666f748b598708773dc6d2432701d6f627

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\wepoll.md

                                Filesize

                                1KB

                                MD5

                                cef1d92ff8ace278bd32ac5e18735b86

                                SHA1

                                6c7d15e2b8f3e99527458c8ea33420ee1d34af7b

                                SHA256

                                3ac2992770080453b98c42afa807ba4b2c1738ef756b92a55c645f55e7df48f0

                                SHA512

                                12aa61ae93fc626a230f39f44ca11c75086fd9bb50f2794fb9fec29b9bef924545fc19d9cb38fda631560ca78ae8e587144cf3cf3c83a6b336bb4711611393bf

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.base\zlib.md.tlauncherdownload

                                Filesize

                                1011B

                                MD5

                                440321d71d082c9f04a9995b613bdff2

                                SHA1

                                9af688d499b3026ec8e5a2e266dc4b9b4884a87b

                                SHA256

                                81518ebc49d23a7c77b2e08eff48664ea0c7dd90957a0caf22fd9654985d3285

                                SHA512

                                c516403a109630b79998f3bea6b698247a0b5367cc9873defa75014e8c98c690d34d0810d32792d80fde1333980ac6c5f19324743795cb6455ef0ee4979496bb

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.compiler\LICENSE.tlauncherdownload

                                Filesize

                                32B

                                MD5

                                663f71c746cc2002aa53b066b06c88ab

                                SHA1

                                12976a6c2b227cbac58969c1455444596c894656

                                SHA256

                                d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80

                                SHA512

                                507b7d09d3bcd9a24f0b4eeda67167595ac6ad37cd19fb31cd8f5ce8466826840c582cb5dc012a4bd51b55e01bb551e207e9da9e0d51948e89f962ba09606aab

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\ADDITIONAL_LICENSE_INFO.tlauncherdownload

                                Filesize

                                48B

                                MD5

                                512f151af02b6bd258428b784b457531

                                SHA1

                                84d2102ad171863db04e7ee22a259d1f6c5de4a5

                                SHA256

                                d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83

                                SHA512

                                1a305bc333c7c2055a334dc67734db587fd6fda457b46c8df8f17ded0a8982e3830970bee75cc17274aa0a4082f32792b5dbff88410fa43cc61b55c1dce4c129

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\ASSEMBLY_EXCEPTION.tlauncherdownload

                                Filesize

                                43B

                                MD5

                                bd468da51b15a9f09778545b00265f34

                                SHA1

                                c80e4bab46e34d02826eab226a4441d0970f2aba

                                SHA256

                                7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b

                                SHA512

                                2c1d43c3e17bb2fca24a77bea3d2b3954a47da92e0cdd0738509bffcdbe2935c11764cd5af50439061638bba8b8d59da29e97ea7404ea605f7575fc13395ca93

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\colorimaging.md

                                Filesize

                                167B

                                MD5

                                0889fd01a6802a5a934572d9bd47f430

                                SHA1

                                7a7e547452ee1c72e8b0d96dccbe315f62d5b564

                                SHA256

                                04d61e3e8e71dd452ebe52008af5378d9f6640d14578aeb515dc5375973b0189

                                SHA512

                                f5872960470810cdbdc2db1dfb216cab88203b23400b16e157c8654c2eecff8d9b26ce066ec18718c8e6d54ee1c54533fdade395c454210fed5159fd4a7a0adb

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\giflib.md

                                Filesize

                                1KB

                                MD5

                                867001e2a577f88cfc856f45959502aa

                                SHA1

                                109c11cec13349212ba94b9f3eb7d0943229938e

                                SHA256

                                c8b99f33890887d27ad56fba9edd8ebbc668cfe0689168505a95613d1d4b32f8

                                SHA512

                                dafac31d75a7ab4ddd7666799a24abf22c1583ca22554a738cc26a77bf927b20dde52f12194670a5196bce3a43bd58de46944291727c8877fee1fe4a38a1f1ca

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\lcms.md.tlauncherdownload

                                Filesize

                                2KB

                                MD5

                                04a8a77cafdd6185a3506eccf7a83346

                                SHA1

                                1acbec21e9eab8bd2bee9826353c1e768d5457b5

                                SHA256

                                8acf00b5efd25c1c055927222fd3c26b0c9fd02ed02e478c225b64e7a24d9782

                                SHA512

                                a91faa243a09bdfe62714859b9b4420e8434dd09693a6a280e1c8ef6694fb7858d0171fae4ca36721b685e3ab8bc8000c5635bf3789250a5b9081130eb4ff57c

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.desktop\mesa3d.md.tlauncherdownload

                                Filesize

                                5KB

                                MD5

                                c7e0d19c8f4eff11e97f0eb9afd3f7f4

                                SHA1

                                6a98ee2703132e181f37d162452f073fb64ced83

                                SHA256

                                63f4e6f75caebbccb95d903fb43e46ac7111b3624d0a34f146b276d7d9e7b152

                                SHA512

                                9c4111728ab9472f0b160cb11ce1e4ebd75a83cfddca0b3cb87243d15afc5a7fa34dc6006e6b92084648cbad1426f70b405259f589cdef758442643e1618dff4

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.xml\bcel.md

                                Filesize

                                10KB

                                MD5

                                daae908a4dd474afec9c010d416acb2d

                                SHA1

                                a59717166af2e8fa9ecd6d622fd6b82b835acce9

                                SHA256

                                853a1e7ce397bb10de0e2b3bde0844bcc651f17d983decd07d2d003c0304c311

                                SHA512

                                25f2189643a113616f53cd87fc96df01b55602bfc3f6653e48c310de03f6d79ccbbec58936d54b88052e32d68c646017bf75b8a179f59fb9d2c5f6938e351a4d

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.xml\dom.md

                                Filesize

                                3KB

                                MD5

                                13952c46b3867103ad7d1e9c6c9e906c

                                SHA1

                                4bf3f9908314b05f3b0f6e27be2c1fb7e25fffbb

                                SHA256

                                6686e8877667584a3a7c07344baadca1a03e29f677162d87c3c0811e990d1148

                                SHA512

                                8c71f226f0f07b471aea6b8e715434b5eaa6b4a59a653ec22c2489e743e9288a0c4537f479719f9d58737d0257470c9cceff9ce647a96e79fd757a4cdcfed499

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\java.xml\jcup.md

                                Filesize

                                1KB

                                MD5

                                d19594fbf6eab2242dc29257905d8ded

                                SHA1

                                fbdcbe5a7e7d91d440c200f5fb00e0cf6a81976c

                                SHA256

                                8d5dcfdf50455a3c34c753a98f21e953248af200415a9084e3f102cb6c43b8bf

                                SHA512

                                7ed3e58f189f2922f7543d4617308d0c35f8adc2e7cbbb6fbba49d33cdd5da64c6edc022ae9842c28e58d97b056a245245c816003978f1e0152236636ca72ba5

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md

                                Filesize

                                3KB

                                MD5

                                fa24b7e2a61a7045cb0c6c385000681b

                                SHA1

                                869fc0b687986ea26b8ff63c137e03c92234a5c8

                                SHA256

                                262802e081760b38b3748c8b194353d340e39bc936ac22e17abbb7158d895811

                                SHA512

                                2676cfdfd61762c7b6171985e8cfe1068c36683ca43753a1ffb10241ac61a74c9be1c00be22903df85ba6954fd908d77de60903c316506fd88b9679672ada968

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.crypto.cryptoki\pkcs11wrapper.md

                                Filesize

                                2KB

                                MD5

                                b77d1951df7a8488eb84ce1d25486a14

                                SHA1

                                e35415235ec3bbcb92beeceb03a9a8e7c13a6fce

                                SHA256

                                371974b1fca3744a3892c7ee1fcc593b8b4281fc218f4cafd2f709e9df5fd81d

                                SHA512

                                759c75f87309b67c56a5b7088045e04be7c023ecdbaea80842e22b81b0bfb36026191070471f8b08fef47ec73664611ce0453b4a9818f7708c95663733ee5ce9

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.internal.opt\jopt-simple.md

                                Filesize

                                1KB

                                MD5

                                4f3f190fd212329afc39442174ca4b3a

                                SHA1

                                d7e25adf223e68d06276ae7666bbc96590dda442

                                SHA256

                                99bc67f93cf57d6d20e6047731c93fbb267d70fbdd4115d119e0f85c6efe5c05

                                SHA512

                                fdd3d2fcfd865f62dad0ba2617ea816c78a3dc9d99d8991ffb5eb479fda37317dc3f70b0dcdb1847ffe4432947690436ad4046bfb056c37e2991e6fefa8b70c0

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.javadoc\jquery.md

                                Filesize

                                2KB

                                MD5

                                8ef4ab67241efd69eaa3df9871fa0dbd

                                SHA1

                                a20a019c3b06d4263b00f5e89ed394a52b8c1981

                                SHA256

                                0716943682c624fd2f49b3a718a2ed4d6386e872fe741f1c759573ae24509d3e

                                SHA512

                                1f85e70e166146d81457f05be906f18b9b16ed82bed5f544f090d894b8d0cb1ff4fe5fffd90022f06f2024b2dbf74a30f2940a21941871358469b1f9a1a19998

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.javadoc\jqueryUI.md

                                Filesize

                                1KB

                                MD5

                                86bfe7b4e5cbedc085060a2c3f13febe

                                SHA1

                                a98cfdc7d73e016ce8b23c1d00daa3d2d3c03a3d

                                SHA256

                                bb0a0e89ebd824df714516bf64b9101c62081e4b376f00f929a58c09555bf111

                                SHA512

                                2656ab0100db997c9306be156af613861c9071a3be1b26f2882a68424e37d1b17674183729c1ba1024302011d42658058f024ce98db5bbb4d528c498ddd21d6e

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\legal\jdk.localedata\thaidict.md

                                Filesize

                                1KB

                                MD5

                                2ea6eb55ca40902554aaf2fd20a76ba8

                                SHA1

                                e5b9e88e174c797c313d6739e7e34772b723bc4b

                                SHA256

                                c326144a2351c9608fa708b5d7d3c5a3da03e82b66479b128e9db4969539824a

                                SHA512

                                5221112cd8ef83b636dc4364f53b72c5484a5885acb55c2c071c88d23058093caee38578f7e424ecafdb483ccc0bc8e78d7ac13add536ec824a8eac171a576cb

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\lib\jvm.cfg

                                Filesize

                                29B

                                MD5

                                7ce21bdcfa333c231d74a77394206302

                                SHA1

                                c5a940d2dee8e7bfc01a87d585ddca420d37e226

                                SHA256

                                aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0

                                SHA512

                                8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\lib\security\blocked.certs.tlauncherdownload

                                Filesize

                                2KB

                                MD5

                                8273f70416f494f7fa5b6c70a101e00e

                                SHA1

                                aeaebb14fbf146fbb0aaf347446c08766c86ca7f

                                SHA256

                                583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58

                                SHA512

                                e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\lib\tzdb.dat.tlauncherdownload

                                Filesize

                                101KB

                                MD5

                                2fd920c56de68f65493ba6962fd079e1

                                SHA1

                                1e79bff02711d3dab3c75e90d4bb08f8086c9626

                                SHA256

                                b7dba25abdfee317daa042c89b01e5711f5781d020dd733ba411760b72addb93

                                SHA512

                                958f835407e4a10a268bf76bc2ef0196ecd5fa92e139de4c3760544dbdf76f95e67865bac22406aef8ac5ae7508fe63cd1a688c8328e46b73a5867efa4f18d47

                              • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\lib\tzmappings

                                Filesize

                                21KB

                                MD5

                                4c30d7867505379a18a27d0e8f03198c

                                SHA1

                                0cc871d5bd91e061d676a861749af68bbc0ca9c6

                                SHA256

                                b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab

                                SHA512

                                873d329682ce67267f438b88eee0fc25cecbbcc1f7d694118417ad12756ec2b6ae7502ec4eea0cc9b4ae8b9e68f5f8877762fa13dea89c4a6dcd54fd8bf82c56

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG1.PNG

                                Filesize

                                45KB

                                MD5

                                8d3ab0397e7ba9efa2846eeef91fadb9

                                SHA1

                                b4cf2276b49eea398f235eb31ee2a4cf0164ddcc

                                SHA256

                                5c27f4cc28f3b669cb5451a8409cd4e29e33602e88069c3cd1d8c665817a6d86

                                SHA512

                                31823f9228b0a2fd92f53ac9bfee6d7bd7875728a5fd460185a94be61d1b2561191a8045da0c0ced531584db6adb2ef3cb9e012ea45eba0ef12418a04036829e

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG12.PNG

                                Filesize

                                22KB

                                MD5

                                6e040558ab4d86db9d6b58aa116f65c6

                                SHA1

                                fce17cede4b509099f1a52c3ac4e047253377619

                                SHA256

                                388b06a9890ad0d80aa3620e5d5853cb467d3d5a7ea7b200897efa6b6153b49d

                                SHA512

                                a5e77e570b0759424142e2badb76951201af795f38f753820a7474929618cb851559f041d46e3a71494bd10c35a99e9169a17768c4948d1aa037fa94e6edd06e

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG13.BMP

                                Filesize

                                451KB

                                MD5

                                2d8d4b541d3df569c36b6e98a4be59d0

                                SHA1

                                8c875bbc8e0a397fc7e06fa37623cfcdbed88761

                                SHA256

                                e04c2dfbcc8701b8a5c64f0657a97e0251436c17b2fa29c58d554e8c5219b9a7

                                SHA512

                                6d83b7fc796e58f68aac35f54e3912c54e306b7587ed926b4193553be0d86b929ad8ac4dd513a3a3452f6a849b6fc730e5fd417427190392c94c22b42935e33c

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG13.PNG

                                Filesize

                                40KB

                                MD5

                                ba6defc25ef1ccdcc057928b48c22e1d

                                SHA1

                                72bbb71e57cb3968eaa900384b81922df7609091

                                SHA256

                                ea2720f1479ee4f30b247d62dd1c651490f7bb7b0b70a9e1fc842caa1be0ff36

                                SHA512

                                319e4fe82803cc90fbdedacbc557767d068a446ff1fd849c0df2691553c3bbc75916458a92f17a29de21d869cd29d82324fd8f75e9b4fdd41e5dc4d0f00019eb

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG14.PNG

                                Filesize

                                41KB

                                MD5

                                d3131c8c7da096272bcc268678e15220

                                SHA1

                                a9b29220df37778dba60c01106dfd273fe39747c

                                SHA256

                                f0302843a75c970983da062efda4ab15b543d7eab9144397e0f5ab79b2afe7e5

                                SHA512

                                b97032c7dd764d0aa7821cc71e75119dcf8caf546f573cd34b4e9f014bba4e4a875b3d92810cdb8eeacf1329b0bc869ab82f12fb8a5f8dbae2c96eff780449c5

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG3.PNG

                                Filesize

                                475B

                                MD5

                                acb28002101f619758b078ea59ae43af

                                SHA1

                                bb4ba45f34d4322373024314b5f907ad3c4df951

                                SHA256

                                883cdd488bcf9430a0a528ab243749a0d8bcc1b76ea07baacad156c58ada374c

                                SHA512

                                6d7493216dc1ac3b576ad7c294756d68678394de15f60039e81cc53ab6804fb616620aa37218b16afb2a5ec3175e1cd914fa2c0ce9ca8ac2f0539d641b23d2ef

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\IRIMG4.PNG

                                Filesize

                                368B

                                MD5

                                2caa7c010df8b7f1dae4000801f13e10

                                SHA1

                                c550373cdf64262baea708ec3c975ff5067db357

                                SHA256

                                1625e6fe0ae1521dae012445b1c7f83f5c453e343371b4336f4437da03a00b61

                                SHA512

                                b5defb1bac181070a9e93e6fddce5efebd391e91d7f180dafe1d2ed8e8761463ab18e4d601c30ba2dc1116e97ac4576a93c0c085a22a433df2a18fc43ea15eb0

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

                                Filesize

                                4KB

                                MD5

                                697c1feea0e855bcb5c314d82957d94e

                                SHA1

                                ceb2cf8f56e487e9167b9ddb8986650393c31eb4

                                SHA256

                                6fc1a5bd5060ec18de017982b583264a6ac1c6086e4e63b85f673e07549b0559

                                SHA512

                                00b27882cdf71b9eb860ec94277939abf661d902dfb4a3d904a5b2836e2b7e428f623df1a42045a84ca1f1acf5c6fddbd8b5be709484e138b3602c13f77b4037

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

                                Filesize

                                4KB

                                MD5

                                be86357bb4b48e3b2687409808619ec3

                                SHA1

                                6bedffe72b163aa0871684c5c8280baae1e72798

                                SHA256

                                a87d4857b5199ad2ecb626d366f0b678e73d31acf8d89f9ec4cae4edca430da7

                                SHA512

                                873eb6ddea3fd5c53990bd08d95f9f91d3d29bc0890698f72d372839a260b20b91d8465751f584971d2dd07d24f16107a09ab87791768624f9aaa65d4c5251d3

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

                                Filesize

                                6KB

                                MD5

                                10f09c6af8f21d07c848db96817955ce

                                SHA1

                                b7eb780acd9c4465ac80576f0a4d9e1a2f9ee8ad

                                SHA256

                                a8b36cb775031e9f657f7dea5b035781ffa5b4c57dfe1817e1e56a64ead34f0f

                                SHA512

                                a618ed152434dd5cba32ab68c49da6edac3012708bceb62856a983d62b111991d6c333282519ebf3ce861e0150410bb7a6be139e39a333dc2bc2ee2b18d5b8c8

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

                                Filesize

                                23KB

                                MD5

                                45e5c8fae86a286bd723186b45441ad8

                                SHA1

                                11cb8f461e23cb26edd435a45cf70f4757ebd181

                                SHA256

                                5da46895ab27df3741c1c7c2d3af074bddfae7c16bfacc6a68df39416b70cea9

                                SHA512

                                30fbf69f90689a418abec3c8446621854aedb96a886f78bd32d013d0a65dd33cff3a62b3cc4e1d64a565e0b005032333cd1c4b4fbff4eaef690cf23a97ce69da

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\Uninstall\uninstall.xml

                                Filesize

                                2KB

                                MD5

                                4a3382a1e888b8b0b32c5db6090c624d

                                SHA1

                                71f7ab8820c43a9787f8e630b48621512506b312

                                SHA256

                                a231adf5fb8de9fcc5c3577247952faf54037ab1492e029e380a0faae7fffc72

                                SHA512

                                e7bd012ddffc2c998489241f2a0a74256f4ada154336b5aeac4d5ed2c605888603d32bd34d94279d48a20fab4a73d5dcec40d02c2c4e416e37af416148ede9a0

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9289\dependencies.json

                                Filesize

                                17KB

                                MD5

                                6d566646f2f374692a6a8b76ff23f59e

                                SHA1

                                43025f5b97daa38aeec3407cc20bf60740a319db

                                SHA256

                                b700139641a3d5493cb28c9ce00408f70e4e48083c80ed5693c6ae840ee93dd9

                                SHA512

                                0e949c4f50656bdbe4bd2ff47661ac62c942b5744d316242e68306bb751bcfe778037ebbcbcd31188125cc88cc243a497fbea6ccf96701668555df5a35586e34

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\2.9289\resources.json

                                Filesize

                                18KB

                                MD5

                                f24f4282f4dbdc650884bd55033d7df3

                                SHA1

                                5c1aeb01a17701d7b35dd3454b4088dcd82f396d

                                SHA256

                                5690815ca9ad02021f49c1df8fd360a1ac29ef3781c15cb074a064b8669d12a2

                                SHA512

                                9d02cad4043de8c09498ed629c5d0c7763f8f4c35166919879acfb3670961e2b943234d0e721cd6b28485af477905437ec4743b41b2dbf8622d7831b0a62801e

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\appConfig.json

                                Filesize

                                3KB

                                MD5

                                aba7fce4661d0d6ea8c40eb63f4718b0

                                SHA1

                                0fefed36b06f8a784736dbd504450b1574ada129

                                SHA256

                                551d3edbcbea195bc37a1ad887a21452131c132123d1a643be43411932403fee

                                SHA512

                                6fee54c2a174743342165846811e39c32eca318b424d1f8a138951cd1c5b0a9c033e5490921b943b84bf47197ede9bbf9c052292295032413abc54c8d63e806d

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\cache\https_repo.tlauncher.org\tlauncher-sources\prod\release\tlauncher\javaConfig.json

                                Filesize

                                3KB

                                MD5

                                e2cbea0a8a22b79e63558273dded5e6c

                                SHA1

                                bfbbbba0679adcbcf9e079ed3c7c7a60cb0b2d61

                                SHA256

                                10d0f3646be0a7d73942d7bdd1e55c4b8df0c34cad7ad15a9dc23b2932155007

                                SHA512

                                a6aa26ff49c911fb4705df1e8e434c72e206b20fdaae0abc529e2734f5db49c75da35c3d75769e0ac1b6795de540de4c7e1089b387217fc58f8b19b023064e5a

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\COPYRIGHT

                                Filesize

                                35B

                                MD5

                                4586c3797f538d41b7b2e30e8afebbc9

                                SHA1

                                3419ebac878fa53a9f0ff1617045ddaafb43dce0

                                SHA256

                                7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018

                                SHA512

                                f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\java.logging\LICENSE

                                Filesize

                                33B

                                MD5

                                16989bab922811e28b64ac30449a5d05

                                SHA1

                                51ab20e8c19ee570bf6c496ec7346b7cf17bd04a

                                SHA256

                                86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192

                                SHA512

                                86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ADDITIONAL_LICENSE_INFO

                                Filesize

                                51B

                                MD5

                                494903d6add168a732e73d7b0ba059a0

                                SHA1

                                f85c0fd9f8b04c4de25d85de56d4db11881e08ca

                                SHA256

                                0a256a7133bd2146482018ba6204a4ecc75836c139c8792da53536a9b67071d4

                                SHA512

                                b6e0968c9fd9464623bfa595bf47faf8f6bc1c55b09a415724c709ef8a3bcf8a954079cce1e0e6c91d34c607da2cecc2a6454d08c370a618fb9a4d7d9a078b24

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\ASSEMBLY_EXCEPTION

                                Filesize

                                46B

                                MD5

                                c62a00c3520dc7970a526025a5977c34

                                SHA1

                                f81a2bcb42ccbf898d92f59a4dc4b63fef6c2848

                                SHA256

                                a4b7ad48df36316ddd7d47fcecc1d7a2c59cbfe22728930220ef63517fd58cb0

                                SHA512

                                60907d1910b6999b8210b450c6695b7cc35a0c50c25d6569cf8bb975a5967ca4e53f0985bee474b20379df88bb0891068347ecf3e9c42900ed19a1dcbc2d56ec

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-17.0.10-windows-x64\legal\javafx.web\LICENSE

                                Filesize

                                35B

                                MD5

                                f815ea85f3b4676874e42320d4b8cfd7

                                SHA1

                                3a2ddf103552fefe391f67263b393509eee3e807

                                SHA256

                                01a4ebd2a3b2671d913582f1241a176a13e9be98f4e3d5f2f04813e122b88105

                                SHA512

                                ddf09f482536966ac17313179552a5efc1b230fa5f270ebde5df6adebf07ee911b9ef433dfbfcb4e5236922da390f44e355709ecaf390c741648dd2a17084950

                              • C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties

                                Filesize

                                1KB

                                MD5

                                311c065bb27c314cbbf5e7ac58783e0b

                                SHA1

                                acf13541498d35415d0edd3bac0369288bb05868

                                SHA256

                                b8696d74815795ceed46b4bfbb83d29ef4bf0c1cb153137b1df9ee69b7a3169e

                                SHA512

                                b3a5c61ab1fe63665d600b08528d4c1b7d4226ffda8ccbb5710e292edf5a66b24c14ffde5aab1bf4f6da91c0b2d4b0aca03a9671098cea53e73d2ac474017be1

                              • C:\Windows\Installer\MSI2AAF.tmp

                                Filesize

                                953KB

                                MD5

                                64a261a6056e5d2396e3eb6651134bee

                                SHA1

                                32a34baf051b514f12b3e3733f70e608083500f9

                                SHA256

                                15c1007015be7356e422050ed6fa39ba836d0dd7fbf1aa7d2b823e6754c442a0

                                SHA512

                                d3f95e0c8b5d76b10b61b0ef1453f8d90af90f97848cad3cb22f73878a3c48ea0132ecc300bfb79d2801500d5390e5962fb86a853695d4f661b9ea9aae6b8be8

                              • C:\Windows\Installer\MSIA4B2.tmp

                                Filesize

                                235KB

                                MD5

                                16cae7c3dce97c9ab1c1519383109141

                                SHA1

                                10e29384e2df609caea7a3ce9f63724b1c248479

                                SHA256

                                8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

                                SHA512

                                5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

                              • C:\Windows\Installer\f77295d.msi

                                Filesize

                                1.0MB

                                MD5

                                d7390d55b7462787b910a8db0744c1e0

                                SHA1

                                b0c70c3ec91d92d51d52d4f205b5a261027ba80c

                                SHA256

                                4a2f7d9d33e4ad643bf72722587f2b268d92dab3bb1d9bc56af316672e34728a

                                SHA512

                                64f3837dd6099561ce9be97d6fae0b11f3f6cc08281f1a3266d5a6f3ca8baf13bbd780735ef62b449b577d62d086f942b48519671226c60f0e1480f9dbdde434

                              • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

                                Filesize

                                1.7MB

                                MD5

                                dabd469bae99f6f2ada08cd2dd3139c3

                                SHA1

                                6714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b

                                SHA256

                                89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606

                                SHA512

                                9c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915

                              • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

                                Filesize

                                97KB

                                MD5

                                da1d0cd400e0b6ad6415fd4d90f69666

                                SHA1

                                de9083d2902906cacf57259cf581b1466400b799

                                SHA256

                                7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

                                SHA512

                                f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

                              • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                                Filesize

                                1.2MB

                                MD5

                                9f2cbab656781156f02719d178f03397

                                SHA1

                                76314dae18fe0a180741092dd6d92e2e482d7189

                                SHA256

                                d598a49b789c47ca2187a42b24ac9b00d16021865110649bc5b5022742f6856f

                                SHA512

                                30480de042c8ef4c09da126a3bfd00aee794bbc0ecedf153542dd9395a74378e1a65d3df51ee877be1e875ff8f86bcb4988fa067aac4f7b35098bb9c896e8d47

                              • memory/1828-2636-0x0000000000440000-0x0000000000441000-memory.dmp

                                Filesize

                                4KB

                              • memory/1828-2611-0x0000000000440000-0x0000000000441000-memory.dmp

                                Filesize

                                4KB

                              • memory/1828-2608-0x0000000000440000-0x0000000000441000-memory.dmp

                                Filesize

                                4KB

                              • memory/1828-2595-0x0000000000440000-0x0000000000441000-memory.dmp

                                Filesize

                                4KB

                              • memory/2020-2691-0x0000000000140000-0x0000000000141000-memory.dmp

                                Filesize

                                4KB

                              • memory/2020-2667-0x0000000000140000-0x0000000000141000-memory.dmp

                                Filesize

                                4KB

                              • memory/2020-2663-0x0000000000140000-0x0000000000141000-memory.dmp

                                Filesize

                                4KB

                              • memory/2020-2650-0x0000000000140000-0x0000000000141000-memory.dmp

                                Filesize

                                4KB

                              • memory/2128-3010-0x0000000000240000-0x0000000000241000-memory.dmp

                                Filesize

                                4KB

                              • memory/2128-3012-0x0000000000240000-0x0000000000241000-memory.dmp

                                Filesize

                                4KB

                              • memory/2280-3829-0x0000000000330000-0x0000000000331000-memory.dmp

                                Filesize

                                4KB

                              • memory/2280-3783-0x0000000000330000-0x0000000000331000-memory.dmp

                                Filesize

                                4KB

                              • memory/2280-3826-0x0000000000380000-0x000000000038A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2280-3827-0x0000000000380000-0x000000000038A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2280-5635-0x0000000000380000-0x0000000000382000-memory.dmp

                                Filesize

                                8KB

                              • memory/2280-3845-0x0000000000330000-0x0000000000331000-memory.dmp

                                Filesize

                                4KB

                              • memory/2280-3851-0x0000000000330000-0x0000000000331000-memory.dmp

                                Filesize

                                4KB

                              • memory/2280-3872-0x0000000000330000-0x0000000000331000-memory.dmp

                                Filesize

                                4KB

                              • memory/2352-2994-0x00000000002B0000-0x00000000002B1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2352-2999-0x00000000002B0000-0x00000000002B1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2364-2424-0x0000000000230000-0x0000000000231000-memory.dmp

                                Filesize

                                4KB

                              • memory/2392-3191-0x0000000000400000-0x0000000000420000-memory.dmp

                                Filesize

                                128KB

                              • memory/2496-5675-0x0000000002170000-0x000000000219A000-memory.dmp

                                Filesize

                                168KB

                              • memory/2496-5674-0x00000000003A0000-0x00000000003AA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2496-5663-0x00000000003A0000-0x00000000003AA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2496-5669-0x00000000003A0000-0x00000000003AA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2496-5668-0x00000000003A0000-0x00000000003AA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2496-5672-0x0000000002090000-0x00000000020EC000-memory.dmp

                                Filesize

                                368KB

                              • memory/2496-5671-0x0000000002090000-0x00000000020EC000-memory.dmp

                                Filesize

                                368KB

                              • memory/2496-5670-0x0000000002090000-0x00000000020EC000-memory.dmp

                                Filesize

                                368KB

                              • memory/2496-5676-0x0000000002170000-0x000000000219A000-memory.dmp

                                Filesize

                                168KB

                              • memory/2668-2757-0x000007FFFFF70000-0x000007FFFFF80000-memory.dmp

                                Filesize

                                64KB

                              • memory/2672-2831-0x0000000010000000-0x0000000010051000-memory.dmp

                                Filesize

                                324KB

                              • memory/2672-1683-0x00000000001F0000-0x00000000005D9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2672-5160-0x000000001BB50000-0x000000001BB5A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-5229-0x000000001E4C0000-0x000000001E4CA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-5228-0x000000001E4C0000-0x000000001E4CA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-5227-0x000000001E4C0000-0x000000001E4CA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-3776-0x00000000001F0000-0x00000000005D9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2672-5226-0x000000001E4C0000-0x000000001E4CA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-3040-0x00000000001F0000-0x00000000005D9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2672-5664-0x000000001E4C0000-0x000000001E4CA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-5665-0x000000001E4C0000-0x000000001E4CA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-5666-0x000000001E4C0000-0x000000001E4CA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-2830-0x00000000001F0000-0x00000000005D9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2672-5650-0x000000001BB50000-0x000000001BB5A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-5649-0x000000001BB50000-0x000000001BB5A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-2622-0x00000000001F0000-0x00000000005D9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2672-5667-0x000000001E4C0000-0x000000001E4CA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-5161-0x000000001BB50000-0x000000001BB5A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2672-1684-0x0000000010000000-0x0000000010051000-memory.dmp

                                Filesize

                                324KB

                              • memory/2672-1662-0x00000000001F0000-0x00000000005D9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2672-1661-0x0000000003280000-0x0000000003290000-memory.dmp

                                Filesize

                                64KB

                              • memory/2672-19-0x00000000001F0000-0x00000000005D9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2672-687-0x0000000000E30000-0x0000000000E33000-memory.dmp

                                Filesize

                                12KB

                              • memory/2672-686-0x0000000010000000-0x0000000010051000-memory.dmp

                                Filesize

                                324KB

                              • memory/2672-765-0x00000000001F0000-0x00000000005D9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2672-811-0x00000000001F0000-0x00000000005D9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2672-813-0x0000000003280000-0x0000000003290000-memory.dmp

                                Filesize

                                64KB

                              • memory/2672-768-0x0000000000E30000-0x0000000000E33000-memory.dmp

                                Filesize

                                12KB

                              • memory/2672-767-0x0000000010000000-0x0000000010051000-memory.dmp

                                Filesize

                                324KB

                              • memory/2688-20-0x0000000003020000-0x0000000003409000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2688-18-0x0000000003020000-0x0000000003409000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/2688-5-0x0000000003020000-0x0000000003409000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/3004-864-0x0000000001000000-0x00000000013E9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/3004-927-0x0000000001000000-0x00000000013E9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/3068-862-0x0000000002DD0000-0x00000000031B9000-memory.dmp

                                Filesize

                                3.9MB

                              • memory/3068-863-0x0000000002DD0000-0x00000000031B9000-memory.dmp

                                Filesize

                                3.9MB