05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf

Resubmissions

24/06/2024, 16:32

240624-t2d74avfpj7

24/06/2024, 16:31

240624-t1p8zasakb4

Analysis

max time kernel
84s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SKlauncher-3.2.exe
Size 1.6MB
Sample240624-t2d74avfpj
SHA256 05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf
MD5 b63468dd118dfbca5ef7967ba344e0e3
SHA1 2ba4f0df5f3bd284bf2a89aba320e4440d8b8355
SHA512 007ecb7445dc0c01a802b5a2c91313aae59f9dc96e27455dd85e7a92a4e649d683fbc2ada5f48925d9ab3b4fdaea20aa89eeb442fde079902aecb5ca3454a548
SSDEEP 49152:HIBc3n9dRvwVlzhFAQ/ggUTPQjYEiim7V:oBaO/FAqMQjYEXm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3768	SKlauncher-3.2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3712	icacls.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
3872	msedge.exe
3872	msedge.exe
4504	identity_helper.exe
4504	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3768	SKlauncher-3.2.exe
3768	SKlauncher-3.2.exe
3768	SKlauncher-3.2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 3952	3768	SKlauncher-3.2.exe	82
PID 3768 wrote to memory of 3952	3768	SKlauncher-3.2.exe	82
PID 3952 wrote to memory of 3712	3952	java.exe	85
PID 3952 wrote to memory of 3712	3952	java.exe	85
PID 3768 wrote to memory of 1576	3768	SKlauncher-3.2.exe	87
PID 3768 wrote to memory of 1576	3768	SKlauncher-3.2.exe	87
PID 3768 wrote to memory of 904	3768	SKlauncher-3.2.exe	93
PID 3768 wrote to memory of 904	3768	SKlauncher-3.2.exe	93
PID 3768 wrote to memory of 3304	3768	SKlauncher-3.2.exe	104
PID 3768 wrote to memory of 3304	3768	SKlauncher-3.2.exe	104
PID 3304 wrote to memory of 3872	3304	rundll32.exe	105
PID 3304 wrote to memory of 3872	3304	rundll32.exe	105
PID 3872 wrote to memory of 3004	3872	msedge.exe	106
PID 3872 wrote to memory of 3004	3872	msedge.exe	106
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 2248	3872	msedge.exe	107
PID 3872 wrote to memory of 4400	3872	msedge.exe	108
PID 3872 wrote to memory of 4400	3872	msedge.exe	108
PID 3872 wrote to memory of 1640	3872	msedge.exe	109
PID 3872 wrote to memory of 1640	3872	msedge.exe	109
PID 3872 wrote to memory of 1640	3872	msedge.exe	109
PID 3872 wrote to memory of 1640	3872	msedge.exe	109
PID 3872 wrote to memory of 1640	3872	msedge.exe	109
PID 3872 wrote to memory of 1640	3872	msedge.exe	109
PID 3872 wrote to memory of 1640	3872	msedge.exe	109
PID 3872 wrote to memory of 1640	3872	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768
- \??\c:\PROGRA~1\java\jre-1.8\bin\java.exe
  "c:\PROGRA~1\java\jre-1.8\bin\java.exe" -version
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:3712
- \??\c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe
  "c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe" -version
  2⤵
  PID:1576
- C:\Windows\SYSTEM32\reg.exe
  reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
  2⤵
  PID:904
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe url.dll,FileProtocolHandler https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa49a346f8,0x7ffa49a34708,0x7ffa49a34718
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12950600486647670716,7624651067912604859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
      4⤵
      PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 57659e16a460115c06feba16a7d1f971c9b356e8cf980c70e9c0503dbfcbfe94
MD5 745980da7b919e61a46740fed81fbf65
SHA1 a7c662372feb3d4af887eef2ce32d74e2cdab485
SHA512 ca637561d3935996d28ef5782c15a0fcc7408a2475cdc8ee5a979bc9c8a8c0cacf85f3637a13eece6a6bee60a1f7c43569dd6efcec8fb1ba4b126bc919f77140
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
MD5 3a09f853479af373691d131247040276
SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
MD5 db9081c34e133c32d02f593df88f047a
SHA1 a0da007c14fd0591091924edc44bee90456700c6
SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 22160bdafc473d17fb168aefe4edb215047968e21ea292c80935e207a64229f4
MD5 9450a0649b5f902fbb0a10326452b892
SHA1 b8e48e749f8fee5e1b03c4fcf040e42dfbd493fc
SHA512 d8a7c4c0510d1fa55eadc5f8d3b0a4683f170c82b177e9722adeaf343da0e681f5bdfac3784cbcea69394751337ebcc8d01be55496e871228159285ebe031588
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 223bea0dce511eb553ba4aaac51001fa0b711db17852d6aad9771689ec6d7cab
MD5 b00737ee4031ab32cf59a4fa9b3c8a65
SHA1 938617a840723b876c20bc509a49da88dfa011e8
SHA512 cf760c834b68cd1e354299c417f9bba4403113fe1a49a46898f4ef8e9c9e1220d56f56962ce8ba264d5bf5000eb393b655fde47d225388a3e5c1f5a060482604
SSDEEP 96:nLkVOO12W/wpvWMoiVmdeHgiEawUWQyV+VDCziEwb:nLkzAYGWMXEPro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5e717065639e78734f1fef78204fa4687ba51b76ccb18f5254e0f49ee2f7237c
MD5 cff95351f9b4f2f702242d5097426643
SHA1 61a01642aba6d95a099605857cdfa4d01873fea4
SHA512 a2a48e1e4aafe2af0b4129f7c82e9d2400ffacfbc2b86c0d5c26fa0d648db22682358d5021ac800a560761a23f9ef521bd9f2a0eede6c79091f99d1234e660c1
SSDEEP 96:nLkVcO12W/wpvWMoiVmde9uhS1jgwEawUWQyV+VD7AiEwb:nLktAYGWMtuwhwPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 eae0a1c02b5242c12aafe1465fc39f64da5d38fb002c16beaca09404c61b95c6
MD5 eb161aa8047930287443fa15701db761
SHA1 6b3aa2a9583e058955b166ad0ecdeeb9ecfa901d
SHA512 a3d617cd236806b86e033c78fe17fcd116fe2a2cc213401abad9b5f52b4ffab93641ef4daf485a32dc2e538dabe7ee3751846861d0d0f21aa04cc0bfa4545456
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRAe2RU92ke3z2OMDCRHqlx:A9iIxuERzA83h09RZxYReceaOMWRHqlx
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF1433512921422012161.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF1433512921422012161.tmp
Size 405KB
SHA256 0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1
MD5 8f2869a84ad71f156a17bb66611ebe22
SHA1 0325b9b3992fa2fdc9c715730a33135696c68a39
SHA512 3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834
SSDEEP 12288:k9zC2w597PziK+bSvkK3sgUN8HkC48AeIVMhQ/8:e4iK+6I/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF4518630781320243274.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF4518630781320243274.tmp
Size 398KB
SHA256 1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1
MD5 ff5fdc6f42c720a3ebd7b60f6d605888
SHA1 460c18ddf24846e3d8792d440fd9a750503aef1b
SHA512 d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3
SSDEEP 6144:oeroPfXwF22mZ8JWPziKSQYfW0LXYveHt+47O3YqF5nxeU2h8jjXVymj3k4yhb18:ovw22mZzPziKYW0jYves4I2n8
MD5 SHA1 SHA512 SSDEEP

Submit Download

+JXF7790732848649195738.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF7790732848649195738.tmp
Size 397KB
SHA256 64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123
MD5 fdb50e0d48cdcf775fa1ac0dc3c33bd4
SHA1 5c95e5d66572aeca303512ba41a8dde0cea92c80
SHA512 20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53
SSDEEP 6144:sSnv4lXwF22mZ8JWPziKSQUmeKGVOOxAdgwH9evDFDynor51EOO2UAGbzxSr1w7b:sSvJ22mZzPziKwLOOkvH9IQoUf7P08
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKlauncher-3.2.jar

Path C:\Users\Admin\AppData\Local\Temp\e4j376B.tmp_dir1719246792\SKlauncher-3.2.jar
Size 1.1MB
SHA256 f7d3e01dcfc001cc80a988c518d4358955842d140054214d1367972c5c543350
MD5 4d653e61ba01a521c56b9a70a9c9814e
SHA1 de855dc3dbc914b497b58da92e0c21fff660796d
SHA512 e6a7db6e2893b5b01dd0c84a230d88abf50da63ceb1af5754a2c4c1fbd307a799a74f3f368430d3beb33590cda2e0a3cf509fef11c4477b76e8d3c4a582b5def
SSDEEP 24576:cABupJWa7eXYJ4FCDzQvrmqBqAXxKhd1ODQZ3z0IH8obxOaHmez6Im:JgxzIvrWphdcDQZ3jH8olVGezFm
MD5 SHA1 SHA512 SSDEEP

Submit Download

flatlaf-windows-x86_64-4534717418300.dll

Path C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4534717418300.dll
Size 22KB
SHA256 ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c
MD5 dcd68a87b7e6edbcfde48150403b22eb
SHA1 28e4839a29725075772fccc39b44e194eb91e477
SHA512 ac2a6bc0afcd08c56090536a937772edd54f35505c9a5837d9bc8e91c31edb6137cf5191986b3473e9e2f512950b4dbfe4088598bfd1faf47088124c70aeba71
SSDEEP 384:6pPX3l1FuqkXq3NhzDuWik7DPObNpwKNsOfJ8APxh8E9VF0NyXKss:Ydiq4UzQkG2eJ/PxWERc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sklauncher-fx.jar

Path C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar
Size 14.1MB
SHA256 a163ebc83ed564ed60fcf502b852857249dfa55ea1a3f77cec257080001d1200
MD5 6010422686c1a1fd08bd2a3099de8680
SHA1 67203beb715a7f47ea9fa5ac023a0a7aef793bab
SHA512 b2e277dc0753684c8e69070022dad91c24f957c83203175a3e555b19ced10a94a6d1fadc2272c803640ec7e0cff9f9c304061920a34297e1b63be0276db371b9
SSDEEP 196608:CFZuorKDjIMjwyOImoZIcBH9XewAZ9bZq3dQvMpOBy9CyVo2jD1rVKSBFpj/EF:CCxXLwHyIcfru9bZkQvM+y62lr4sjw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1576-20-0x000001D41C460000-0x000001D41C6D0000-memory.dmp

Download

memory/1576-30-0x000001D41AC40000-0x000001D41AC41000-memory.dmp

Download

memory/1576-31-0x000001D41C460000-0x000001D41C6D0000-memory.dmp

Download

memory/3768-121-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-300-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-215-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-218-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-220-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-221-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-233-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-232-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-239-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-123-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-291-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-214-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-82-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-136-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-49-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-764-0x00000000026B0000-0x0000000002920000-memory.dmp

Download

memory/3768-45-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-207-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-34-0x00000000026B0000-0x0000000002920000-memory.dmp

Download

memory/3768-173-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3768-147-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/3952-5-0x000001A821230000-0x000001A8214A0000-memory.dmp

Download

memory/3952-16-0x000001A821230000-0x000001A8214A0000-memory.dmp

Download

memory/3952-15-0x000001A81FA50000-0x000001A81FA51000-memory.dmp

Download