Overview

overview

7

Static

static

3

LegacyLauncher.exe

windows10-2004-x64

7

LegacyLauncher.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 11:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LegacyLauncher.exe
  • Size 111.9MB
  • Sample260930-n4rnbas1bv
  • SHA256 a092da5c6df6c6be4341846f43425006ee0da2ce96953cf98a4b947457824ac4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Network Service Discovery 1 TTPs 7 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LegacyLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\LegacyLauncher.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Users\Admin\AppData\Local\Temp\is-9WUTKCOJKS.tmp\LegacyLauncher.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-9WUTKCOJKS.tmp\LegacyLauncher.tmp" /SL5="$40168,115006833,1320448,C:\Users\Admin\AppData\Local\Temp\LegacyLauncher.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3672
      • C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\LL.exe
        "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\LL.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:704
        • C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\java.exe
          C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\java.exe -Dtlauncher.bootstrap.restartExec=LL.exe -Xmx64M -jar launcher/bootstrap.jar
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:204
          • C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\javaw.exe
            C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\javaw.exe -Xmx256m -Dfile.encoding=UTF-8 -Djava.net.useSystemProxies=true -Dtlauncher.systemCharset=UTF-8 -Dtlauncher.logFolder=C:\Users\Admin\AppData\Roaming\.tlauncher\logs --add-exports java.desktop/sun.awt=javafx.swing --add-exports javafx.graphics/com.sun.javafx.application=ALL-UNNAMED -Dtlauncher.bootstrap.restartExec=LL.exe -Dloader.main=net.legacylauncher.bootstrap.Bootstrap -classpath C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar org.springframework.boot.loader.PropertiesLauncher --packageMode windows --targetJar launcher/launcher.jar --targetLibFolder launcher/libraries -- --settings tl.properties
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:6004
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.live.com/oauth20_authorize.srf?client_id=a332a5f6-c4dc-45b6-9fe3-d881490252b2&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A46521&scope=Xboxlive.signin%20offline_access&state=-7019271649959238344&prompt=select_account
              6⤵
                PID:1796
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://login.live.com/oauth20_authorize.srf?client_id=a332a5f6-c4dc-45b6-9fe3-d881490252b2&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A46521&scope=Xboxlive.signin%20offline_access&state=-7019271649959238344&prompt=select_account
                  7⤵
                    PID:1904
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x260,0x264,0x230,0x2c0,0x7ffd020fc188,0x7ffd020fc194,0x7ffd020fc1a0
                      8⤵
                        PID:6072
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,12896102982497359944,16046064338956203277,262144 --field-trial-handle=2592,i,14105332160608093810,1591208037702095998,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
                        8⤵
                          PID:3748
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,12146268697180125211,9976452905577906923,524288 --field-trial-handle=2592,i,14105332160608093810,1591208037702095998,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
                          8⤵
                          • System Time Discovery
                          PID:1788
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,1301684354904392982,5164736044111265413,524288 --field-trial-handle=2592,i,14105332160608093810,1591208037702095998,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
                          8⤵
                            PID:5888
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,6971063751892081537,2957852003695744660,2097152 --field-trial-handle=2592,i,14105332160608093810,1591208037702095998,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                            8⤵
                              PID:5948
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,3924013299806553224,6623897990270585815,2097152 --field-trial-handle=2592,i,14105332160608093810,1591208037702095998,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
                              8⤵
                                PID:5764
                • C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\LL.exe
                  "C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\LL.exe"
                  1⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1768
                  • C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\java.exe
                    C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\java.exe -Dtlauncher.bootstrap.restartExec=LL.exe -Xmx64M -jar launcher/bootstrap.jar
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious use of WriteProcessMemory
                    PID:4504
                    • C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\javaw.exe
                      C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\javaw.exe -Xmx256m -Dfile.encoding=UTF-8 -Djava.net.useSystemProxies=true -Dtlauncher.systemCharset=UTF-8 -Dtlauncher.logFolder=C:\Users\Admin\AppData\Roaming\.tlauncher\logs --add-exports java.desktop/sun.awt=javafx.swing --add-exports javafx.graphics/com.sun.javafx.application=ALL-UNNAMED -Dtlauncher.bootstrap.restartExec=LL.exe -Dloader.main=net.legacylauncher.bootstrap.Bootstrap -classpath C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar org.springframework.boot.loader.PropertiesLauncher --packageMode windows --targetJar launcher/launcher.jar --targetLibFolder launcher/libraries -- --settings tl.properties
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Reads the TCP/IP host and domain name from the registry
                      • Checks processor information in registry
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:3500
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                  1⤵
                    PID:4532
                  • C:\Windows\System32\GameBarPresenceWriter.exe
                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                    1⤵
                    • Network Service Discovery
                    PID:4488
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4784
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                    1⤵
                    • Drops desktop.ini file(s)
                    • Checks processor information in registry
                    • Modifies registry class
                    PID:4780
                  • C:\Windows\System32\GameBarPresenceWriter.exe
                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                    1⤵
                    • Network Service Discovery
                    PID:5816
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4296
                  • C:\Windows\System32\GameBarPresenceWriter.exe
                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                    1⤵
                    • Network Service Discovery
                    PID:2608
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:5904
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                    1⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    PID:1960
                  • C:\Windows\System32\GameBarPresenceWriter.exe
                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                    1⤵
                    • Network Service Discovery
                    PID:1852
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1220
                  • C:\Windows\System32\GameBarPresenceWriter.exe
                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                    1⤵
                    • Network Service Discovery
                    PID:4440
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:3460
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                    1⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    PID:5876
                  • C:\Windows\System32\GameBarPresenceWriter.exe
                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                    1⤵
                    • Network Service Discovery
                    PID:5028
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4880
                  • C:\Windows\System32\GameBarPresenceWriter.exe
                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                    1⤵
                    • Network Service Discovery
                    PID:3732
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:3428
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                    1⤵
                      PID:2308
                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                      1⤵
                        PID:4432

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            settings.dat
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            settings.dat
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            • Size 37KB
                            • SHA256 0d653737212335e338e614d95d9bba224325da9cc9edda0195a9d1f15c5b56c7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            flatlaf-windows-x86_64-6389398394600.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-6389398394600.dll
                            • Size 22KB
                            • SHA256 6f1fd322c52bef87a624256e185bb88c4e6ccc6462cc036c6248ffd77cf787ff
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            LegacyLauncher.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\is-9WUTKCOJKS.tmp\LegacyLauncher.tmp
                            • Size 4.6MB
                            • SHA256 7cc60f1f36f6a1ed8218f60764a4c5ee83c76a92e80283da899fe265403c871a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            jna6090085328388465587.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna6090085328388465587.dll
                            • Size 267KB
                            • SHA256 5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libtmp12746490882657584413junixsocket-native-2.9.0.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\libtmp12746490882657584413junixsocket-native-2.9.0.dll
                            • Size 267KB
                            • SHA256 d3335e589bf1c3e2d2f55f6550e5de173b776cfaa077b235e4c69523f0071726
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            tlauncher-repo1599077682666469538.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\tlauncher-repo1599077682666469538.tmp
                            • Size 58KB
                            • SHA256 8c2dffc08e1e386f88c1a4450286b47e495a0f8e00167c1e186fdef7e3829529
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            legacy.properties
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy.properties
                            • Size 96B
                            • SHA256 b437d194ff3964d9ccb6584ecd0c6ff189e6f2f4d6e06e54f2a90670c6ef72ad
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            LL.exe
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\LL.exe
                            • Size 2.2MB
                            • SHA256 53c51cfd7ae8efa1c5a56d4c6ad19065b33cdf69ac40167447d5fb003770371e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            VCRUNTIME140.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\VCRUNTIME140.dll
                            • Size 95KB
                            • SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            awt.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\awt.dll
                            • Size 1.4MB
                            • SHA256 3cb9348a9c52fd61142f527dce9a737677cc39455d9d08ad799ca5631285e97d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            java.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\java.dll
                            • Size 118KB
                            • SHA256 2687613e5181a497209ff691ac99e35fee5f714bed27fbc466453594ab17dac9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            java.exe
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\java.exe
                            • Size 48KB
                            • SHA256 049426d0ed110e4c79348e1300f21479c90215d2c8267c20eee80b6f712617a2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            javaw.exe
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\javaw.exe
                            • Size 48KB
                            • SHA256 82c1146511bb20968c7b54bf710390a1ece90b88e56d956c34471539997a23ef
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            jimage.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\jimage.dll
                            • Size 32KB
                            • SHA256 872d3fc032be7c21e3dcf8500d76cedf705cf5c2d7332c531eb6a8c72af54745
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            jli.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\jli.dll
                            • Size 87KB
                            • SHA256 5fe5a6bd6422fad416512dd4cc91a22cfbf8d778841fe38159217737010ab12f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            jsvml.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\jsvml.dll
                            • Size 849KB
                            • SHA256 42f92f2db5cc5ddcb330041ead7b788fc60e14d7187298e28bd6eb9d70bec51c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            msvcp140.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\msvcp140.dll
                            • Size 558KB
                            • SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            net.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\net.dll
                            • Size 58KB
                            • SHA256 57ce82e948ea60284ae8e939e54dca2cba2d771e521e780dcf76dcca5e98e890
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            nio.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\nio.dll
                            • Size 78KB
                            • SHA256 c2976cf68536b8105ff9516f75f1bbefb5807994c655490071a4c411275f444a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            classes.jsa
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\server\classes.jsa
                            • Size 12.4MB
                            • SHA256 9a514aa116b46ec0a39c1f0974ecc5d3973f4fbbac140b17025704f089eda62a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            jvm.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\server\jvm.dll
                            • Size 13.2MB
                            • SHA256 bd4309a6f8acc7b1f717d681103492f5aa5751c047620b5fff430b186a226e45
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            sunmscapi.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\sunmscapi.dll
                            • Size 47KB
                            • SHA256 b474e012edab63f7c9025aed7ead5f2ef7b3d77cae3afc99cc985f594ec4d040
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            vcruntime140_1.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\vcruntime140_1.dll
                            • Size 36KB
                            • SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            zip.dll
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\bin\zip.dll
                            • Size 87KB
                            • SHA256 2d414932f2199d8be7ef856f768d64f24a143afd4f8ec4fc3cbe866a979f2cbb
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            logging.properties
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\conf\logging.properties
                            • Size 2KB
                            • SHA256 b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            java.security
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\conf\security\java.security
                            • Size 64KB
                            • SHA256 16fd39e6000518fd967a14ae45e2d2fa6e16bff9bfe202397907b71677101ec6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            is-BWFFA88NVG.tmp
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\legal\java.compiler\is-BWFFA88NVG.tmp
                            • Size 49B
                            • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
                            • MD5 SHA1 SHA512
                            Submit Download

                            is-FFOQUCI5E0.tmp
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\legal\java.compiler\is-FFOQUCI5E0.tmp
                            • Size 33B
                            • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                            • MD5 SHA1 SHA512
                            Submit Download

                            is-UJ8RSX5C9T.tmp
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\legal\java.compiler\is-UJ8RSX5C9T.tmp
                            • Size 44B
                            • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
                            • MD5 SHA1 SHA512
                            Submit Download

                            jvm.cfg
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\lib\jvm.cfg
                            • Size 29B
                            • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
                            • MD5 SHA1 SHA512
                            Submit Download

                            cacerts
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\lib\security\cacerts
                            • Size 192KB
                            • SHA256 b47e74bc755a776398b2ca115bc4a08ae157c3c8b0a6c00ba522c47653cf1e91
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            tzdb.dat
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\lib\tzdb.dat
                            • Size 101KB
                            • SHA256 b7dba25abdfee317daa042c89b01e5711f5781d020dd733ba411760b72addb93
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            tzmappings
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\jre\x64\lib\tzmappings
                            • Size 21KB
                            • SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            bootstrap.jar
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\launcher\bootstrap.jar
                            • Size 10.5MB
                            • SHA256 09ba7517c8a9b30780ff9a6de230b8905247835ae0da914d66991e2b3b4b6c4e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            stubLauncher.args
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\stubLauncher.args
                            • Size 77B
                            • SHA256 a88d6851999c9bac5dec26f23f694f684147530e5977c0d3ab19908dd10a236b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            tl.args
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\tl.args
                            • Size 125B
                            • SHA256 05fa49f9ffe7a22d1e3443fd8cc993e62b7f20a976162ce69d306ff9581f1d87
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            tl.properties
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\tl.properties
                            • Size 216B
                            • SHA256 693b916f8f75c010581295065fe42667875f53d5b4c7188eec3d71b94daf572b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            tl.properties
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\tl.properties
                            • Size 1KB
                            • SHA256 5b128e95f6829348e91f6e090ec04b3a22f9a17a9db69bacd4ad48e20acd7bc2
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            tl.properties
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\tl.properties
                            • Size 1KB
                            • SHA256 e0b1ccbe82eb1785191d0c6e7c96e1dd034557982c4305e55879c97ec754ef96
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            tl.properties
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\tl.properties
                            • Size 1KB
                            • SHA256 e185d4afa83cdba304d91554c4bc2de97395f003bb84c8f10eec482efbf6ce49
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            tl.properties.tmp
                            • Path C:\Users\Admin\AppData\Roaming\.tlauncher\legacy\Minecraft\tl.properties.tmp
                            • Size 1KB
                            • SHA256 45482af20946beea95b6933c22ffad9846358e4c725a00b4bed1f1a0b3158d2e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            desktop.ini
                            • Path C:\Users\Admin\Videos\Captures\desktop.ini
                            • Size 190B
                            • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/704-989-0x0000000000C00000-0x0000000000EED000-memory.dmp
                            Download

                            memory/704-1053-0x0000000000C00000-0x0000000000EED000-memory.dmp
                            Download

                            memory/1768-1093-0x0000000000C00000-0x0000000000EED000-memory.dmp
                            Download

                            memory/1768-1136-0x0000000000C00000-0x0000000000EED000-memory.dmp
                            Download

                            memory/3500-1369-0x0000014262780000-0x00000142627C1000-memory.dmp
                            Download

                            memory/3500-1575-0x0000014262780000-0x00000142627C1000-memory.dmp
                            Download

                            memory/3672-173-0x0000000000870000-0x0000000000D15000-memory.dmp
                            Download

                            memory/3672-17-0x0000000000870000-0x0000000000D15000-memory.dmp
                            Download

                            memory/3672-9-0x0000000000870000-0x0000000000D15000-memory.dmp
                            Download

                            memory/3672-982-0x0000000000870000-0x0000000000D15000-memory.dmp
                            Download

                            memory/3672-11-0x0000000000870000-0x0000000000D15000-memory.dmp
                            Download

                            memory/3672-1014-0x0000000000870000-0x0000000000D15000-memory.dmp
                            Download

                            memory/3672-8-0x0000000000870000-0x0000000000D15000-memory.dmp
                            Download

                            memory/4596-12-0x0000000000A90000-0x0000000000BE1000-memory.dmp
                            Download

                            memory/4596-0-0x0000000000B4F000-0x0000000000B50000-memory.dmp
                            Download

                            memory/4596-1-0x0000000000A90000-0x0000000000BE1000-memory.dmp
                            Download

                            memory/4596-1015-0x0000000000A90000-0x0000000000BE1000-memory.dmp
                            Download

                            memory/6004-1674-0x000002701B400000-0x000002701B451000-memory.dmp
                            Download

                            memory/6004-1721-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1722-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1723-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1720-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1724-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1717-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1718-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1719-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1733-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1732-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1731-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1730-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1728-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1727-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1726-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1725-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1737-0x000002701B400000-0x000002701B451000-memory.dmp
                            Download

                            memory/6004-1739-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1712-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1707-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download

                            memory/6004-1706-0x0000026FC1930000-0x0000026FC2930000-memory.dmp
                            Download