hxxps://github[.]com/Diegiwg/PrismLauncher-Cracked/releases/

Analysis

user interaction
yes
max time kernel
767s
max time network
769s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Diegiwg/PrismLauncher-Cracked/releases/
Sample260601-p2schaew2r

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 64 IoCs

flow	pid	Process
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe
345	5968	prismlauncher.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	prismlauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	prismlauncher_updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	javaw.exe

Executes dropped EXE 10 IoCs

pid	Process
5616	prismlauncher.exe
4776	prismlauncher.exe
5108	prismlauncher.exe
4388	prismlauncher.exe
5476	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
5968	prismlauncher.exe
5324	prismlauncher_updater.exe
2268	prismlauncher.exe
4632	javaw.exe
5748	javaw.exe

Loads dropped DLL 64 IoCs

pid	Process
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
5616	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
4776	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe
5108	prismlauncher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
263	raw.githubusercontent.com
265	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3196_1143949643\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3196_631755294\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3196_631755294\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3196_2060667728\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3196_1143949643\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3180	msedge.exe
5408	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	prismlauncher.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	prismlauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	prismlauncher.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	prismlauncher.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	javaw.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3540	TaskKill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247918102975132"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{5413AC37-1D34-4D13-9FCF-4B84F746595F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\shell	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\shell\open	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\prismlauncher\URL Protocol	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PrismLauncher\\prismlauncher.exe\" \"%1\""	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\prismlauncher	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\prismlauncher\shell\open	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{A901E383-6C68-4A52-8236-D33DB8815831}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\shell\open\command	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\prismlauncher\shell	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\curseforge\URL Protocol	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\prismlauncher\shell\open\command	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\prismlauncher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PrismLauncher\\prismlauncher.exe\" \"%1\""	PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe

Suspicious behavior: AddClipboardFormatListener 7 IoCs

pid	Process
5616	prismlauncher.exe
4776	prismlauncher.exe
5108	prismlauncher.exe
4388	prismlauncher.exe
5968	prismlauncher.exe
5324	prismlauncher_updater.exe
2268	prismlauncher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5428	msedge.exe
5428	msedge.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3200	taskmgr.exe
5968	prismlauncher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe
2636	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4544	7zG.exe
Token: 35	4544	7zG.exe
Token: SeSecurityPrivilege	4544	7zG.exe
Token: SeSecurityPrivilege	4544	7zG.exe
Token: SeDebugPrivilege	3200	taskmgr.exe
Token: SeSystemProfilePrivilege	3200	taskmgr.exe
Token: SeCreateGlobalPrivilege	3200	taskmgr.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe
Token: SeCreatePagefilePrivilege	2636	chrome.exe
Token: SeShutdownPrivilege	2636	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
4544	7zG.exe
3196	msedge.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe
3200	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5748	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4304	3196	msedge.exe	90
PID 3196 wrote to memory of 3180	3196	msedge.exe	91
PID 3196 wrote to memory of 2556	3196	msedge.exe	92
PID 3196 wrote to memory of 2556	3196	msedge.exe	92
PID 3196 wrote to memory of 2556	3196	msedge.exe	92
PID 3196 wrote to memory of 3832	3196	msedge.exe	93
PID 3196 wrote to memory of 3832	3196	msedge.exe	93
PID 3196 wrote to memory of 388	3196	msedge.exe	94
PID 3196 wrote to memory of 388	3196	msedge.exe	94
PID 3196 wrote to memory of 388	3196	msedge.exe	94
PID 3196 wrote to memory of 224	3196	msedge.exe	95
PID 3196 wrote to memory of 224	3196	msedge.exe	95
PID 3196 wrote to memory of 224	3196	msedge.exe	95
PID 3196 wrote to memory of 2632	3196	msedge.exe	97
PID 3196 wrote to memory of 1148	3196	msedge.exe	98
PID 3196 wrote to memory of 2632	3196	msedge.exe	97
PID 3196 wrote to memory of 2632	3196	msedge.exe	97
PID 3196 wrote to memory of 1148	3196	msedge.exe	98
PID 3196 wrote to memory of 1148	3196	msedge.exe	98
PID 3196 wrote to memory of 2560	3196	msedge.exe	101
PID 3196 wrote to memory of 5104	3196	msedge.exe	102
PID 3196 wrote to memory of 2560	3196	msedge.exe	101
PID 3196 wrote to memory of 5104	3196	msedge.exe	102
PID 3196 wrote to memory of 4428	3196	msedge.exe	105
PID 3196 wrote to memory of 5520	3196	msedge.exe	109
PID 3196 wrote to memory of 5520	3196	msedge.exe	109
PID 3196 wrote to memory of 5624	3196	msedge.exe	112
PID 3196 wrote to memory of 5624	3196	msedge.exe	112
PID 3196 wrote to memory of 5728	3196	msedge.exe	113
PID 3196 wrote to memory of 5728	3196	msedge.exe	113
PID 3196 wrote to memory of 5780	3196	msedge.exe	114
PID 3196 wrote to memory of 5780	3196	msedge.exe	114
PID 3196 wrote to memory of 5024	3196	msedge.exe	116
PID 3196 wrote to memory of 5024	3196	msedge.exe	116
PID 3196 wrote to memory of 4440	3196	msedge.exe	117
PID 3196 wrote to memory of 4440	3196	msedge.exe	117
PID 3196 wrote to memory of 5152	3196	msedge.exe	118
PID 3196 wrote to memory of 5152	3196	msedge.exe	118
PID 3196 wrote to memory of 6020	3196	msedge.exe	124
PID 3196 wrote to memory of 6036	3196	msedge.exe	125
PID 3196 wrote to memory of 6052	3196	msedge.exe	126
PID 3196 wrote to memory of 5228	3196	msedge.exe	131
PID 3196 wrote to memory of 5232	3196	msedge.exe	132
PID 3196 wrote to memory of 5228	3196	msedge.exe	131
PID 3196 wrote to memory of 5232	3196	msedge.exe	132
PID 3196 wrote to memory of 5232	3196	msedge.exe	132
PID 3196 wrote to memory of 5128	3196	msedge.exe	133
PID 3196 wrote to memory of 1856	3196	msedge.exe	136
PID 3196 wrote to memory of 1856	3196	msedge.exe	136
PID 3196 wrote to memory of 6124	3196	msedge.exe	138
PID 3196 wrote to memory of 6124	3196	msedge.exe	138
PID 3196 wrote to memory of 5468	3196	msedge.exe	140
PID 3196 wrote to memory of 5468	3196	msedge.exe	140
PID 3196 wrote to memory of 5496	3196	msedge.exe	146
PID 3196 wrote to memory of 5496	3196	msedge.exe	146
PID 3196 wrote to memory of 5428	3196	msedge.exe	149
PID 2636 wrote to memory of 1172	2636	chrome.exe	161
PID 2636 wrote to memory of 3312	2636	chrome.exe	162
PID 2636 wrote to memory of 3312	2636	chrome.exe	162
PID 2636 wrote to memory of 5408	2636	chrome.exe	163
PID 2636 wrote to memory of 4992	2636	chrome.exe	164
PID 2636 wrote to memory of 4992	2636	chrome.exe	164
PID 2636 wrote to memory of 220	2636	chrome.exe	165
PID 2636 wrote to memory of 2528	2636	chrome.exe	166

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Diegiwg/PrismLauncher-Cracked/releases/
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffc333ec188,0x7ffc333ec194,0x7ffc333ec1a0
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,4959154218176480975,5975495924777800901,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,8733873297050958652,8688215613445376346,262144 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,16717343942222605996,1194843042788041485,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12900309665313724374,1993233730015419729,2097152 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,8599375146351916576,6096717427043733669,2097152 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,12717431493227087067,15942285738957544939,2097152 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,12623937230279677310,17960117337873760380,2097152 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,11801127797491595173,17174689693623225107,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5446154543096907133,16852757906482365860,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16594035638050624219,14547326323054496337,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16594035638050624219,14547326323054496337,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,3094805991636291886,2770478659253493731,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,9777480078267610685,536069290450430610,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10713183746531726078,15335526168913799477,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,6240191370466526131,9885878124948182111,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,8490144733660639628,15907795325917785199,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,8696244906127912164,13746089834016813056,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,13796221220877043536,18379248449248460536,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,18060924317686905063,7953112660954116796,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,15200390312430847259,8411669686234637505,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,390589268957216103,3270615771773556103,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,15416927535892887057,15005078699575466960,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4720,i,550091393744724824,10542312849032548827,2097152 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,2642251245952768138,14767380801074308409,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,18044227410266884342,16371576967677574760,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,4210854933263720987,6512597935906987804,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,6217591700653337369,8052032542740129973,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3669931614994736027,951994511394235657,524288 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6408,i,16684856914492744058,728817164620114732,262144 --field-trial-handle=2296,i,16528691553990722860,17281849533921184710,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2680

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\" -spe -an -ai#7zMap14594:146:7zEvent15239
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4544

C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\prismlauncher.exe
"C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\prismlauncher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:5616

C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\prismlauncher.exe
"C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\prismlauncher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:4776

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3200

C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\prismlauncher.exe
"C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\prismlauncher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:5108

C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\prismlauncher.exe
"C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\prismlauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:4388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc3292c728,0x7ffc3292c734,0x7ffc3292c740
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,6588444732915385892,1004650582415024334,262144 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,3728933299601517079,12564840823888150026,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,13709639000559576464,1050379954427847654,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,2428017521501536415,1292370373144510287,2097152 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,8045424975658556127,5980362041360291668,2097152 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,14426408490351690996,13669082759468372168,2097152 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,10289912359044239299,17758883974108623551,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5856,i,10485472931621523539,1455230731757367631,2097152 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3308,i,16613449219063546308,6088819743551978717,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,14415646694159728677,9580667728485178788,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6104,i,7719777098526396588,4566281486591943347,2097152 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,15330839147064160155,146876512510486346,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,11939058918708539720,13450179198312298224,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,2926783216561158019,8092603732427627555,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3348,i,2999248446891671246,8215332719897215958,262144 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1148,i,876185399656943893,11236634909362946001,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3056 /prefetch:8
  2⤵
  PID:5876
- C:\Users\Admin\Downloads\PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
  "C:\Users\Admin\Downloads\PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5476
- - C:\Windows\SysWOW64\TaskKill.exe
    TaskKill /IM prismlauncher.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3540
- - C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5968
  - - C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe
      C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe --check-only --dir C:/Users/Admin/AppData/Roaming/PrismLauncher --debug
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      PID:5324
    - - C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
        
        C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe --version
        5⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:2268
  - - C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-delta\bin\javaw.exe
      C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-delta\bin\javaw.exe -jar C:/Users/Admin/AppData/Local/Programs/PrismLauncher/jars/JavaCheck.jar
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:4632
  - - C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-delta\bin\javaw.exe
      C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-delta\bin\javaw.exe -Duser.language=en -Dminecraft.api.auth.host=https://nope.invalid -Dminecraft.api.account.host=https://nope.invalid -Dminecraft.api.session.host=https://nope.invalid -Dminecraft.api.services.host=https://nope.invalid -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xms512m -Xmx4096m -Djava.library.path=C:/Users/Admin/AppData/Roaming/PrismLauncher/instances/1.21.3/natives -cp C:/Users/Admin/AppData/Local/Programs/PrismLauncher/jars/NewLaunch.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype-natives-windows-arm64/3.3.3/lwjgl-freetype-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype-natives-windows-x86/3.3.3/lwjgl-freetype-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype-natives-windows/3.3.3/lwjgl-freetype-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype/3.3.3/lwjgl-freetype-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw-natives-windows-arm64/3.3.3/lwjgl-glfw-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw-natives-windows-x86/3.3.3/lwjgl-glfw-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw-natives-windows/3.3.3/lwjgl-glfw-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw/3.3.3/lwjgl-glfw-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-arm64/3.3.3/lwjgl-jemalloc-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-x86/3.3.3/lwjgl-jemalloc-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows/3.3.3/lwjgl-jemalloc-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc/3.3.3/lwjgl-jemalloc-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-natives-windows-arm64/3.3.3/lwjgl-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-natives-windows-x86/3.3.3/lwjgl-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-natives-windows/3.3.3/lwjgl-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal-natives-windows-arm64/3.3.3/lwjgl-openal-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal-natives-windows-x86/3.3.3/lwjgl-openal-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal-natives-windows/3.3.3/lwjgl-openal-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal/3.3.3/lwjgl-openal-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl-natives-windows-arm64/3.3.3/lwjgl-opengl-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl-natives-windows-x86/3.3.3/lwjgl-opengl-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl-natives-windows/3.3.3/lwjgl-opengl-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl/3.3.3/lwjgl-opengl-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb-natives-windows-arm64/3.3.3/lwjgl-stb-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb-natives-windows-x86/3.3.3/lwjgl-stb-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb-natives-windows/3.3.3/lwjgl-stb-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb/3.3.3/lwjgl-stb-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-arm64/3.3.3/lwjgl-tinyfd-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-x86/3.3.3/lwjgl-tinyfd-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows/3.3.3/lwjgl-tinyfd-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd/3.3.3/lwjgl-tinyfd-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl/3.3.3/lwjgl-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/fasterxml/jackson/core/jackson-annotations/2.13.4/jackson-annotations-2.13.4.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/fasterxml/jackson/core/jackson-core/2.13.4/jackson-core-2.13.4.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/fasterxml/jackson/core/jackson-databind/2.13.4.2/jackson-databind-2.13.4.2.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/github/oshi/oshi-core/6.4.10/oshi-core-6.4.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/github/stephenc/jcip/jcip-annotations/1.0-1/jcip-annotations-1.0-1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/code/gson/gson/2.10.1/gson-2.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/guava/guava/32.1.2-jre/guava-32.1.2-jre.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/ibm/icu/icu4j/73.2/icu4j-73.2.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/microsoft/azure/msal4j/1.15.0/msal4j-1.15.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/authlib/6.0.55/authlib-6.0.55.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/blocklist/1.0.10/blocklist-1.0.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/brigadier/1.3.10/brigadier-1.3.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/datafixerupper/8.0.16/datafixerupper-8.0.16.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/jtracy/1.0.29/jtracy-1.0.29.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/jtracy-natives-windows/1.0.29/jtracy-natives-windows-1.0.29.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/logging/1.4.9/logging-1.4.9.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/patchy/2.2.10/patchy-2.2.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/text2speech/1.17.9/text2speech-1.17.9.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/nimbusds/content-type/2.3/content-type-2.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/nimbusds/lang-tag/1.7/lang-tag-1.7.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/nimbusds/nimbus-jose-jwt/9.37.3/nimbus-jose-jwt-9.37.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/nimbusds/oauth2-oidc-sdk/11.9.1/oauth2-oidc-sdk-11.9.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-codec/commons-codec/1.16.0/commons-codec-1.16.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-io/commons-io/2.15.1/commons-io-2.15.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-logging/commons-logging/1.2/commons-logging-1.2.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-buffer/4.1.97.Final/netty-buffer-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-codec/4.1.97.Final/netty-codec-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-common/4.1.97.Final/netty-common-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-handler/4.1.97.Final/netty-handler-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-resolver/4.1.97.Final/netty-resolver-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport-classes-epoll/4.1.97.Final/netty-transport-classes-epoll-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport-native-unix-common/4.1.97.Final/netty-transport-native-unix-common-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport/4.1.97.Final/netty-transport-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/it/unimi/dsi/fastutil/8.5.12/fastutil-8.5.12.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna-platform/5.14.0/jna-platform-5.14.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna/5.14.0/jna-5.14.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/minidev/accessors-smart/2.5.0/accessors-smart-2.5.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/minidev/json-smart/2.5.0/json-smart-2.5.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/sf/jopt-simple/jopt-simple/5.0.4/jopt-simple-5.0.4.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/commons/commons-compress/1.26.0/commons-compress-1.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/httpcomponents/httpcore/4.4.16/httpcore-4.4.16.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-api/2.22.1/log4j-api-2.22.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-core/2.22.1/log4j-core-2.22.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-slf4j2-impl/2.22.1/log4j-slf4j2-impl-2.22.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/jcraft/jorbis/0.0.17/jorbis-0.0.17.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/joml/joml/1.10.5/joml-1.10.5.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lz4/lz4-java/1.8.0/lz4-java-1.8.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm/9.3/asm-9.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/minecraft/1.21.3/minecraft-1.21.3-client.jar org.prismlauncher.EntryPoint
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks processor information in registry
      Suspicious use of SetWindowsHookEx
      PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1148,i,9869737511885507293,16505547916730210276,524288 --field-trial-handle=1924,i,15569258777412231074,1903183559452890455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4828

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x38c 0x150
1⤵
PID:4444

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3196_1143949643\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3196_2060667728\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3196_631755294\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d51a2e633526ae64c749bf93e5c9f5087813c8ec8ac83eac3e96f08ecae7f417
MD5 1adf2c5f4dca29b935e2f82afe0d7691
SHA1 3c42e3aba56e1d9c5cbb773f74e02a1e4d7a283d
SHA512 2e5548a0aea9cab36608a84c3f50d294fac5378ade9fc2da4e2540487469fd500e1503df82fb9bcfc120fc2a86bdd3723f4eb1ff62cc3a17292035fbd4471a28
TLSH
T1B2F0F9B6D931AC3718FD576C20945B46E750135B2B40999F3A3C820D8FB5A3B464581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 35a8400f1fb21a261332f42f07e556055c05d825a8cabb13ee1fd1a86e9356e4
MD5 4c5b6f1a8eca9e029797539e29384de2
SHA1 0db4fa18e1d0a1e35edc802cde95adf8048b939c
SHA512 5abbca2666882035a54ca360fbda21a8c80e8dec837e826cab5c9927f359460aacdca3ddd8875333359f4b72180062a1facacdf4dd7c5d061307dee33c5c610b
TLSH
T14361F90899DCAD17CF64567E55E82D0632332BDA5A039F9BA3D80DBC74E77D38025C86
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d1746c09a3fa1d03111e0064143f6835d8146946facb717474d7aa7430953024
MD5 4951c9ca5d9eaca9e134547234e57354
SHA1 d6ec53c1d4e1db01f062a490ecf3bcf9de1286b6
SHA512 1f62b96403b32d6622010585688a3608bbc882a99fa1b619ee0f8337f0442baf1cd460a24bc70564a382dab4d575d0f99f08e1e3049ad266fe49af5cacfdf9ac
SSDEEP 192:DyGblM1ALnmKmkvDBj3iMM2rlvpe4KxKnQN1NmOtHmzmrmHmDmTamR:DyGblM1ALnmKmkvDRyB8ZYnYQTNmCHml
TLSH
T159D18BF7C3D9C56D8A1156F4AB15AE2FCE2A0A18431D3C26C8D4BF4B93E2972D21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 dd69c6eb64960b200c58eda38faf6facf8c39cfdfd5d9a043e7aa7474fe7f54c
MD5 e1d8f5efd2c1ffec647dd1cb5cc3327b
SHA1 c47def2a90cdbe30b882f309eac8a505ba001533
SHA512 979522eda6d3b3322e1bf2ec785e239f089e9e71f69bc19fa62cec1d3310e4147cd07eb3af8e2df68b94ae652038af179e05fdef34083f07690687ad6cb5051c
SSDEEP 192:DyGblM1ALnmKmbxvDBj3iMM2rlvpe4KxKnQN1NmDmGamwmDmtH/jhy0HmgmeCW:DyGblM1ALnmKmbxvDRyB8ZYnYQTNmDmt
TLSH
T17CF19CF7C3E5856D8A0256F4AB15AE2FCE290A18431D3C26C8D4AE4B93E2972D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a6d46aea41389e14f29e07b6420d090f6c21f200c01fb8b29d3c290bf0713462
MD5 352ee4e8202455158390ae27a4d65b25
SHA1 84704902b751f9548e0969d492d2bf518b4b59e1
SHA512 865acc62f974007877c14ad8160d0dc36230d6c69b0df787686388f8b8f55b4ef1ba86b279afb019ea4bb3e38a8bf9d63e3d6416ecb26c5751622b7e7387b2f9
SSDEEP 192:DOh1HGitHmjmHxvDaEd2rlvSZxKUmNmDmrmmmDmtH/jhyCbmgmesK:DOh1HGitHmjmHxvDaEd8ZSZYUmNmDmrt
TLSH
T132D1BCF783E5856D8A0196F4EB15AE1FCE290624431C3C7688D4BE4BD3E3972E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6512b65c9a4d14ae6dfc67011face789515488ebae49ffd5916f1cdcb0142257
MD5 df65ff72b148c3dcb6ca553a8fabb03b
SHA1 ba87ab2ff3761d4abada394b6f988d96d006f2f3
SHA512 540e728d73d00f85b629c642b7689adc570b881160dd2be3944779be9906e808592bfce1438962879aebdcb212bdf9cc76cef7b367f191394a517b88ab74088b
SSDEEP 192:MRCcBz0x7av7a5hAPRp2benu4ACb9DHsb+WNqwxf4n92lj2Le42+VyIsnAUgraJ:MRCmz0J2O8Xp5wJK2R2de
TLSH
T1CD52B62EAD24293B5DDBD259FD667757D3F61021A2D42E80EAFC8A2C14E75CC321710B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5cf4069fcb2f395c16d0dc7ff89022f2c5adcbf55ef1792b20fba55babfd9d80
MD5 459438ec97b7207e14a43a98898f63e7
SHA1 eae1cc7dedf5927e2da9677d6c991592d3781024
SHA512 9755c5a0fe9c63f3a8cabc45e87413c3b9571b562587463d0e24fb7099458241a284dd00f20e0c7ce2d1ad07438a1440a239a9e641c9dd6b946c0f12732d0e90
SSDEEP 192:MRCcBz0x7/v7a5hxPRpRbenu4ACb9DHsb+WNqwxfvDx+n92Yj2Le42YVyIsnAUge:MRCmz0JXO3XK5wJFg2O2xe
TLSH
T1FB52C72BAD24293B5DDBD259FD657B67D3F61421A2D42E80EAFD8A2C04E75CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 af5077240898ef04d4176684406ef9d19a5f1a684df07a22bffb2fbb7a237242
MD5 8ce354b15a624456f7341378422c6d87
SHA1 def5f1f78f50ea1004b1e4d90e097f37d4f95c79
SHA512 ec17826e734db05eb61f4946ebba71e74522f13043a15e3721a376c0717321667f9eaaf7f3921ae54ea648fddd1ca9ed3a00c9aa85fe2b1043d39b20b11f6c91
SSDEEP 192:MRy0x5Uv78hAPRp209DHsb+WNnxf0Qj2Le42oVyIsnAUgtaJ:MRy0HQ48XD5w9022D8
TLSH
T18C32C62EAD14693B6CDBD259FD657B53D3F6102161D42E80EAFC8A2C04EB5CC322710B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4c4683caaf8f6eff4ca3573d8a000948b67eabff6e2abbc21c085aa850b7c9c6
MD5 93af1f21a7e901de45c52cfe38874df4
SHA1 71e8b1defa821beabd6ff3b7c9b3f0d182cfee96
SHA512 7066d9dcb73fcb98999b877bca1d8f0e700a7437bdc087d84458fba5c114d618d7f62ef60b612880cf9ac3a20fd965de543adb87f0c766d550197af86367d9be
SSDEEP 192:MRCcBz0x7Uv78hAPRp2Zcb9DHsb+WNnxf4n92uj2Le42oVyIsnAUgtaJ:MRCmz0JQ48XZ5w9K2s2D8
TLSH
T13F42A52EAD24693B5CDBD259FD667B53D7F6102162D42E80EAFC8A2C14EB5CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3933fa54039e969ca31d062de05265f20d7e0e3351ef57403538ad758192ce30
MD5 d8badbe73ff9d90d9888c0fa1637b692
SHA1 22eb95fd1df6a38e7207484dab6356a93c808c08
SHA512 01161d85a08b1f6ba58e14b05af67e37fe83c19c708c61257e87892000688efc8788c6e3e066e01c86772d2a64c94d284765049e7272c1be23b5690c293c2540
SSDEEP 192:MRCcBzgx7bv7a5hxPRpRbenu4ACb9DHsb+WNqwxfvxWMn92Sj2Le42YVyIsnAUge:MRCmzgJjO3XK5wJkm2I2xe
TLSH
T17352C72BAD24293B9DDBD259FD657B67D3F61421A2D02E80EAFD8A1C04E75CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c1085739027bf8fe17af6c79c40dda751fe027173bd769bdafccf515fe58e9d7
MD5 48c90c85c7ab23b83fe4d596423093e0
SHA1 6cd6b02d4ddf2fe57fa3028ecd240310d530fba2
SHA512 4cd14e75506062157856e6b00ed11fd64287dbe39ed960bad1c82b5f3640298576a7efd0f5aec37ae53895645e432d1df3eef9a5f8b0ef811f77f03228ceff18
SSDEEP 192:MRCcBzgH7Hv7a5hxPRpRbenu4ACb9DHsb+WNqwxfvxWMn92Sj2Le42YVyIsnAUge:MRCmzgbPO3XK5wJkm2I2xe
TLSH
T15F52B72BAD24293B9DDBD259FD657B67D3F61421A2D42E80EAFD8A1C04E75CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 8f24097e23d1672f3e2a17de426101a693b4e9b82abeb4b7101821f7d0e0a1f2
MD5 369c28ee351a65c902d445cfd26197eb
SHA1 ecfcb0ba9516558f94a94956d0f96aafcb341d5d
SHA512 24994dfacc2ff510b23852b9a665c14e90f6b3685f173b6b5e40c782b44f55293cf19e6ec07e5856094e9410142fb030e8eb33f254ccf2140c0ba65b75e652d1
TLSH
T1ADA0022421C07C11CC0506F413C38284232169605186D783F6E421D48D5368446D1800
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 3ddfb8ac227ff1ba96062756256d06e01483419eb0ac32bbe855ce6746f1563c
MD5 563cf0fdd8f2fa733e5a17e9a9d9d7e3
SHA1 7fa4874b771f9c897dc8cac84cc22f67916de60f
SHA512 d4d308242a23ca0533d0604b834d9afe1fb066bbc394f78dd2a20969f92fb201707f0ac820bc67f438851117971c3d88731e8bd036868bf535ada6246a1872cc
SSDEEP 6144:e9bQXsXhVXVOK4Ps7AI5m7Rkm1tYpBeh2BAo+:ed13XS07Al9oBGcAo+
TLSH
T12C34122A8D663A738DBEA729714F1B1E39B09DF19C14FD5195E82E04768974C024AF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9abc87ffeaefb389ea78cc255c3eabed83e9934e07fbfd59801686202c6360cb
MD5 c53c0b9c9a85c974706e65512eba4373
SHA1 144a43dc7c5a9607d9a614a1d4be2482c997cad6
SHA512 ca5f75905d6753d9bdb5bbea17c39524dbc7b65b3266fb63a8bb23963acf9a1ee5781e23884355178f5418c297ea1405edfabbbf46586bcb28e4f61f4ae1d5dc
SSDEEP 6144:21G5bQXsXhVXVOK4Ps7AI5m7Rkm1tYpBeh2BAo+:6k13XS07Al9oBGcAo+
TLSH
T14C34123A9D653A738DBEBB1D714F2B1E2DB0AEF19C14FD41A4982E04769964C050AF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 82c5fe4ef349792a6258cba86ca2ae24ea9927d93d6c9ab108d76712960e27be
MD5 a2fe20716a24369a3f88723c0aabb3ee
SHA1 2df75329c5079c2d054650ffc7242380b8d3e30a
SHA512 a140fbac03ae8c12a3117d6473ead2573cf5756e555f01d7b704d88cd4d83003a38acf89eaa5df177f55373a881d1675d7632b10f302b69647e9cbe2843681e1
SSDEEP 6144:/9bQXsXhVXVOK4Ps7AI5m7Rkm1tYpBeh2BAo+:/d13XS07Al9oBGcAo+
TLSH
T1B734122A8D663A738DBEA729714F1B1E39B09DF19C14F95198E82E0476C974C024AF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 dc432c73bc8f795ecbe0be0cac4283eadbb4c4ac26373282196b5ccad625d64e
MD5 62098f85f15dfa09343ef20bae56da30
SHA1 9d56327e52cac0369f8aea553c85a672e1997fc3
SHA512 2d753f0343920aa66321f22eb977515a758351505f5619f43e492e1e96526973aafa469054e41c4f5573b2d88591adde8b1c8e82b74ea80b68cd35f15910fb2a
SSDEEP 6144:e1G5bQXsXhVXVOK4Ps7AI5m7Rkm1tYpBeh2BAo+:ik13XS07Al9oBGcAo+
TLSH
T1FF34123A9D653A738DBEBB1D714F2B1E2DB0AEF19C14FD41A4982E0476D964C050AE3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a25052d0bf500babae08f6360d849f2bd4ed6a200f82a854f02e6c0a248015a0
MD5 84c46ea28c46e33f5833838d53b0db71
SHA1 37e5b61888c65c179192584bcadf2c79304e47da
SHA512 e127b7766031bdf174cfbe52dfa496d8ac3a6162f7cab4c1a5548d715f64e725458206b2e40a50ba8b3a8b8052dc15a2dc30d99826cd56abc64cfcc95cbce5a8
SSDEEP 3072:VGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:8m7Rkm1tYpBeh2BAoO
TLSH
T128C3123B5D65E9375978A74EB48E0B1E1EF24DA6C920DE4288D86B0433FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9290f31943fea28c016e6ceaec332806f773a65990bba3d3ea4bd73961aad160
MD5 80a4128b7a2e569f38a74361ff44b2b1
SHA1 f070e5ca906b7a803e400cd6323666ff3f2d7695
SHA512 31f6f15bdd9ed0209aa73a9d7d612c5bcc86e5876cbd0d9d963a4d20eaf191b09425270cc4d6c0adb4e6b48940b5df5c5f20faa1bd2084b6755ca13ddd79e156
TLSH
T11DD02265BA379AEAF2B8243F28A2E507134CDAB257032223E3448C0C8CBB64748C08C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 820d58a5799118979a53b0fbc6041d0e87381570dc48b42b7ebf521eb27e0b7f
MD5 4095c20463eebc824b3048ec50b65a86
SHA1 5d819907427a2d5173873bf508eac324ab00754d
SHA512 48d9fbb535621699eb2e875f4ba423ec19621eaf4da719fe055f992638be2d61158fbe504d64c8eb0a637abe88d5ac9e33561fa9833a863ae81048fbd4bee7d3
SSDEEP 96:u+uZh66umUeVVM97jwRGVCxqP8DtA1VLyngWUZ:MCc+BkR3qAUZ
TLSH
T173B1613428926810DFC70233BAF3C574B77B44E8F91BAE260B07CA7639137A16D4D986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 ddc391963356fcad0b80fa3419042d8b83f858fbee775e188e99a7345b303723
MD5 9555b0f7947a4ebf0271b27b0f6c4f00
SHA1 f082b78e067e1791d9882e9abd4c17adad38204b
SHA512 69c347150bee757d0c03c1d2330538f13ba2156d1a644e1eb179059b302b8999c4b7d142340091792041a597529a05f970536ea19b6059c1408e4588217debc3
SSDEEP 3:MsEllllkEthXllkl2zExllMf:/M/xT02zrf
TLSH
T177440414FFC01507CD0050315013C3700370D51005115747357105537FDFD400C70300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 61bbcc36ef16b30a4209b752b7fd5711d1bb8fcd4e6c0d2274860d29814444f8
MD5 050d3b5ef6c5ef033ac0e3aaec1bd28b
SHA1 be0ac5ce032c38500f352e4073fb2c842733f071
SHA512 a8637eda6b9c150523105da67e240667ddcbda7fbd576fdc9721b28b49507dae43c990e9ec5c30bc389910dea1e2f66c093379bc1009b0829a192cfd667cab89
TLSH
T18961BEF783E5856DDA0196F0BA18AE1BCE2D0510831C3D6A85E4AF4BD3E3871E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 05b901bfc96d94b5a8b7a8580cee2dc166ca895a53fd3f4af99f2a7d100b5fed
MD5 e765d9db24cc75214efb795e4bcce7cc
SHA1 8a897da2fe239fd56ba5685854ed06ba3ca445ca
SHA512 ead97ea695e196a029648b9e88416b8fb850263be4cc127b95d303afd8571a24605778fe892081837b4324bad1e1b648ccb1310d8866c9727208c257ac23e152
TLSH
T14461BEF783E5856DDA0196F0BA18AE1BCE2D0510831C3D6A85E4AF4BD3E3871E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 946dfecafa38518dec54d825a1cebd38d30c3f09873b261ba215806c1d2693a9
MD5 28cf4ee2f549fbe3bcc1f568c54dd9d0
SHA1 755f1109685f8279aecda57f1b24cdf1cf7e7c4e
SHA512 36180ba50e9183d5541c7a19f016c8407c9969494ee40d952c2ce0fbf3f4b97f904733e623116ae2a3c16c05231cf57065f6f382e93670e532e4eb9bdddd6b79
SSDEEP 192:sxZvRIyM/jK1Ml8Mkq/fpsO4aIdp9OMHW6+WNYpn/YC8HemIg4J:sxZvSMq/fpsO4zRHbu/UDc
TLSH
T10E52B7126A385977CCCBD209F955BF53D7F94472A2940D48AAFC8A1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f78953d7d1297cfc38f1b1d34580084594b71486a6c3d212194fcec2015129c8
MD5 42368e5763890d2b06d182369404b13a
SHA1 2a039b3f2139f755b688c2507df23baffba8927b
SHA512 3201d5c6a035aec5a246d7266c37b9e7ecd3dff7a97780ed888fb1e8b0caee793c764abea53ac9cd4a2d63470b076a3044de516d4affa36b9ab4c0553135e0ef
SSDEEP 192:sxZvRIyM/jK1Ml8M9q/fps5lyT0YvIdp9OMHW6+WNY2IaZYf2IwpHemIg54J:sxZvS1q/fps5l/YARHbbZxDi
TLSH
T11562D8526A285977DCC7D219BA55BF53D7FD1432A2800E44AAFC8B1C00E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fd5f9f833a41a704d76b0c66de380fb24211ad90bc7527913f65890a2e23b115
MD5 5c83e035a553f57ac2a77d1e3f0a0889
SHA1 539ef67a785d01885633dad5e883acf40d15d0fa
SHA512 48215b74c7e3b88e97a9f1c60fdef15e07c701dc8ae0c45261767e3cf3c6a8d03b5c43eb338ca946df9e1e67c7f14f1123145856bbf51728a97f574ee61a8343
SSDEEP 192:sxZvRIyM/jK1Ml8UQtc9q/fpsCWpVxlyT0Y6IdpvOMHW6+WNLX2IaZYf2AmEHh4w:sxZvSqt6q/fpsCWvxl/YTjHbQZ0Kw
TLSH
T1EA72C612A928597BDDC7D219FA55BF53D7FD1422A2900E44AAFC8B1C00E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cb2a8812bf7a6d64e42229907495a5471638e572c84bc6bd7ad7339014b8abda
MD5 0ac26082fce1e27534d1ec19b5e79d3e
SHA1 c4810991b48ee3f040e9b68934333967a5527423
SHA512 5e793dcc1a0bad45347452815336ce816fd4061e1f0a8b666297e36a0dae8b42485f1b2922dc8981e0bfbf0df199395b55a1363dbbeb0fec9b756b0ffd804c03
SSDEEP 768:y38bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVNroE:y38bqn+WvSCt6u1jaCZLbWVmE
TLSH
T105D20A3B280CCB7E4F845E5CED266F962DD801CB67988D4447FA894C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 df601696b3666e4e5676e5ccb5f485559ee17fa6d0b1cdeca596f7bd3c4da028
MD5 02ca02e90ef00cf9566680f87e574a4d
SHA1 1676ed669029f64c933a3c71a039a3c2177cac18
SHA512 0f5d29dac0161f8f03111beb71e56cc5ef788d5273dd0d28937510752208a00eb79bcff04efa1689d2cd52c992c91bc520e490484db665a4712de1f884a4ec24
SSDEEP 96:KEIgKJB0QKp+ayoAKx2saZ0QSAUDZkTy/YDKXa/WDl:6uTTow
TLSH
T17F91F346B43E5243387D2898FBA696764F9531933065F4AF3FB810A20E66E214DFC4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592b3c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592b3c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ea078527414c3af4ee3a9c9531a2628594b5d8ca8c715a0ab46e65b19cfc3ccf
MD5 b8c1a41cbb731b8e635d037169b014e4
SHA1 d651080d7d030ba949984e263e00f1f282b929b8
SHA512 7cdccc5261fef49de6a3b56e62b3f003013a9e2035a4c5e000c751a7a93e25bbcb0d805f58781ab44a64bce74b0eb4fb983557e9b8d756af078b3704873aaf04
SSDEEP 384:yRtNnNnb9+sNOFN4EkEa+NOjlRa/hJMGaV:mjZbElfaIOjlRAxaV
TLSH
T1A7926D32293C6DB79AB79A59F54B3713AFE850A795852ED4EBC84F0D00D738C2347829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 125ff3b4442781b15613cb97459fe55bbd00ba932f6b443c93aac3ada3dee698
MD5 d023e73cfa44f68f2c17d9aa6f4a0c40
SHA1 6154f0b511ebdd543a01c67635a47346457ee981
SHA512 87d6edfe72ebbe2a1c3dac5263f6c38135939d2211d89ffb08050ac8b6f41dceb89bc86aa91b66b9b26e18695429ccefb55ccedd49c550ad39f1071f3cc9e363
SSDEEP 192:ylLsNOcSQgf2biADQmiU1BM74Ea+jROmDRkDamyqhU8:yZsNOcSN4EkEa+NOjlRU8
TLSH
T1E5321B32697C5C779EA3AA44F5473723AFE8106B96852E94D7D94F0C00C779C231783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b64d1ecd193f055ebf5774f45947f5a5f5494b04e016133aeab6154c765a223
MD5 4fa7738787d2e8f44c6ae5dd5dbc029a
SHA1 64e8984efa936cbb966fe87722cb15897d84369f
SHA512 e4ac73cf31b78a5e19590bb1fdc38f11ffd259bcd1e10cd6a7e177fcc64bf6b1cb3408f865769c8c45c16a6795ab1b3d034817bc47187e6585d42d57840282b2
SSDEEP 192:vONf6DbjQmiUyk7kBa+jROmDRkxNzyqhU6:vONf6drkBa+NOjHRU6
TLSH
T16F12FA36797C5CA79EA26E95F48737279FD8106BD6866E90D6C81F0C00D779C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 7911bd8e7e5e2995cdae8ca2f4a34766660ec3c15b0992cfdfd83c0f63299836
MD5 c93adace2fb7d53eb0569386323f5502
SHA1 c78e0b5f0cfc2d5573c680d52f5fa5db1de6f13c
SHA512 2f9df15aaba9a00c6d8c756ca6c48db240db13461c7cf6b1bf32a7607fafd659a63c4bcbdd0ede1c1db35748602481a0fb150b162e8c14daf39792d32ba6a918
SSDEEP 384:yRiFOtNnNnb9r7sNe8TUNTUlIlgNYekaDf4xa+NOjURa/hJMGaV:fFOjZb57wgQExaIOjURAxaV
TLSH
T1B0D294F698E79976E9AE4787A73E6E429EBCC15375845980F7840E0CCC832BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a1c05c7f1e5d27d448ad5d168ba48f7c98b2a38b92b724d98dee9f054398d678
MD5 8bdbf6a44bfdf8f15b37410efb863aef
SHA1 85e9d7f6d928b45afc91f6723f0be9eecc980973
SHA512 2060f83fc2b847f2658db5819a9bff7b425ff2c5c3c542723b8aa138003ab8ae8337dc0575ad9e3ef37e08cbad3843274852ee986940adf3efa4f58b5441f29c
SSDEEP 768:fFhjZb5mwg/XxaIOjh7EtSxqKsAR3AxaV:tFXFpqKDR3AMV
TLSH
T1DBF280F184D78DB6D4AE87C7A73DAD0259BCC063B4885888B7E4692DEC8B1BFD306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ae04e64916850a296571d195a13a2d85c7c10a146a79fa05d6ab793c87400867
MD5 91e27d0040b4a013171b79f4445f2057
SHA1 c7baa986cc2e0992749f2c8318c17abd404ca2ad
SHA512 8d9c424ddc1017455e091b97bb6d19329ceef3b5c86e8d830094c29fb054b3ec7200bf64c6dd2a9391b4d0ecc7e2afffed2ff56789a0e1de8b9a4ad941e55920
SSDEEP 384:yytNnNnb9ysNO0NYEkEa+NOjlRa/hJMGaV:tjZbsOfaIOjlRAxaV
TLSH
T185927D32293C6D779AB79A59F1463753AFA850A795852ED0EBC84F0D00D734C2347839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9f08a3a13a817b4446f0c811abdcbe06d0bbff51872e69e62cf75bcc44daa3fc
MD5 6dbba67fb5c90b08e435d6fac3155206
SHA1 896752d149b56ba815d9556f48096623a7d986af
SHA512 dd3033ea638236e4429f32efc80602c0e8742cdb549b481ce0144a63cf65f97a78a8bc427db84d6a896fe58680e3de8f294182cafa6b81d64cd47ee3e6edbad2
SSDEEP 384:yntNnNnb9ysNOgNYEkEa+NOjlRa/hJMGaV:mjZbsefaIOjlRAxaV
TLSH
T1CC927D32293C6D77AAB79A59F14A3753AFA850A795852ED0EBC84F0D00D774C234783E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6e3ccf0f54051cb62ca90ed41a2c9f7932e6d90b6f6f97a8d3effaa4025bc02a
MD5 eca9b7e4b6d61e230f50afb673f5d6c5
SHA1 c014db0a8ac49af008bc3103794fac75b21b4451
SHA512 30d07916acc9c45db46a5ee6f45708dc5c1cab74b38e1312b63a86b4df79cd64d41ce96c69a558486c6017d59924335fce132ec2ec3aa974acd7c5ce6523bb9a
SSDEEP 96:EqONkjQsjpf1bxX5ih/cIPURHl8h4otop5JnDFBfPgvE5BzatIRdy+88OmlmsR1y:vON76Db6QmiUy97HBa+jROmDRuRg5SU6
TLSH
T19402D735696C5CBB9EA26E48F88737276FD8103BDA966B44D6D81F0C00D764C234783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

a4d93bb6-c745-47da-a8d1-64f507410868.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a4d93bb6-c745-47da-a8d1-64f507410868.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7053ebe8d4b8c9747424f342176448909d9c3e916ca60fa1cbb058b46cbcb03f
MD5 c0a8a1a25add36dfb1ef22ec8c81cfab
SHA1 0d96586a4ae45b4c063dda524310032afd8ed497
SHA512 d40dc69c9f5433b8ff73011fd5adee63ca1022dc1aba2359ed083f78e4ef768072e21e288a43029f219c6a3b2b869dccb17df95c19a7eb49fd579fc990244609
TLSH
T18741F958B6FA1158B3B77E5A9BF7686D487FB8772E07D49D00110E4E0662B40C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.exe

Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
Size 19.8MB
SHA256 0024a331bcfb342bd2cda66e8381402692099a051556343f8431edbc733fdc5f
MD5 8327f61e4a7716edead1f0386fe6be15
SHA1 931d22b3ec438377e860a803594fe4a2b98610a6
SHA512 58ad0c3113d0569057ff52b81522bb92a41b831a0c64c5815d355d8eeec50d75da962ab22a8e495e6f43a70ae5029d99964a750f2b6b543510bbc2f1b390422a
SSDEEP 98304:/eKB8sI7EKbacc2VutFHwQofiFAyz3ikln6cn+HPiMizc0B4sohH/P:NWqckfofiFA4ikl6Bvt0K
TLSH
T10427E506A79085EAC412C57CA799A133F1717C8E5BB6E2E76B853B227FB57D0A03C740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cafa2183-8de4-4919-b40a-b3c9e4013e9a.tmp

Path C:\Users\Admin\AppData\Local\Temp\cafa2183-8de4-4919-b40a-b3c9e4013e9a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4568f60-75dd-4b64-9b39-426ddfa3cb10.tmp

Path C:\Users\Admin\AppData\Local\Temp\e4568f60-75dd-4b64-9b39-426ddfa3cb10.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

jna15050149682909267171.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna15050149682909267171.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glfw.dll

Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.3.3+5\x64\glfw.dll
Size 484KB
SHA256 affa7e54eb0dedce4a5721c327c1a16035edbbd039cd402e08107d6d2d55eb1a
MD5 8cabdbe3d67546771b02af5d42073cfe
SHA1 2e19147110b9872a52814956bab151a7aa80ce58
SHA512 b7f46feef779e5772fc7711fda601fdda6ee4bf41d4fb87735a0b8fdc5fdbbdab23ba1760989e15d66cf9ba65409933cbce858eda169d04f13f401198245ad1f
SSDEEP 6144:QHi9k9IQYWWS4JJbzxazY4czAHxOoThkaQo3:QHivQYWX0bzxazY4/3
TLSH
T100B4B61967B2060EDF2B4433C6CFF9219477B04C3FDBA59E7E9019E47E25BA140A9B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jemalloc.dll

Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.3.3+5\x64\jemalloc.dll
Size 389KB
SHA256 9abf0095066ebab37b78968e11370a8078313e48cb5be8eda01f67623c6a6248
MD5 e58d41175587d4355fe06bf8b8a1ab32
SHA1 6403f8243ea983a225b3bcda6c821a0029ad9ee2
SHA512 fc432ddb67dce8a672ac268d25f01d40c1d614e4ef34cbac6c4a2c01742ebab5d00c7ef5d9f0ef46ce0b3b6a4d5ace581fcf8c247d492c3882f561015d9e2ae4
SSDEEP 6144:hdyZEHDinptJzM3Ux7ZdxwZNvOseWJ2Pn/UReZ4U:3jIprtdxw3vBpH
TLSH
T122843A4AF3A844B5D497D038862B5747D3B2B9580721BBDB13A48B662F73FD96A3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl.dll

Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.3.3+5\x64\lwjgl.dll
Size 468KB
SHA256 a39adf52947fafd954c2a86ce031abb8c59825f7ee50337ac8c41e4280abe82d
MD5 d8ea3886d9f59b514bfa5b24ab69c0ab
SHA1 2bf57942dff5360889f0e89c58d5acdc54e5f1ea
SHA512 ba8af0415c7b0454dd8bdccf78ed59da3bb5cc5f631dd060d3cd0eaf74d8f55d7531248b6b8a995ba5b672dc0386d3fa198e8c761f2e1cc0304da0dc029bf29e
SSDEEP 6144:p997Xkbij3eAMVXiDiA36PFpIiThjnC/smb72NI:p997Xkbij37MVy+A3+J4bS+
TLSH
T132A4D931DE12C68CDCEB723960531001EA7778651B1216CB27ABDA5BB11ABF093F6F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl_tinyfd.dll

Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.3.3+5\x64\lwjgl_tinyfd.dll
Size 246KB
SHA256 ec7d76e6ef7a99628ef6f8b6e544294b700108c341837779e6e2c01c0bc3da9c
MD5 e7349669dee3093d266849685efecc60
SHA1 e7c3d94ad9d83f0762dfd82780d2a683d5d9b3c0
SHA512 41d772a4a9673db43a4584af78d5c128278b27efc01b7da47a9f8f629fd004aa8e4c63186d93b6cb7b664325272f0a291a1e80d9ae799910989171c1cdec34c8
SSDEEP 6144:njWq98VaFVuwSM5hFuixx8+iBKhTDdG6/ivF:njWq98VaFVu05h0ixx87Mb
TLSH
T170348C1873E408F9FDA7A23C88975586E7F278164770DB9F03B0862A6F23750653EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc874B.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc874B.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc874B.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc874B.tmp\nsExec.dll
Size 7KB
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
TLSH
T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c539830-85ae-48c9-ac2a-dab6b6eac3ae.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3196_1144054459\0c539830-85ae-48c9-ac2a-dab6b6eac3ae.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3196_2006016596\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18.json

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\assets\indexes\18.json
Size 447KB
SHA256 464546c63c4f7230c1414b89b85d7ad77b618895f8e22ee020499df7a62cac06
MD5 734bc6fb17940971e2daf6beb831fc7f
SHA1 cb0e5e5a5516b0ccececee2ed2404b4a4bdde7a8
SHA512 c191e0473f4d0c80c803322ace0f8b109cf85bfc7ffbd2eafcb3a1998f8c4e5d6e0961e103ae315d6bb6ad7443f6d6c80d9946c40778c5967973feb575d6bb86
SSDEEP 12288:039vNtcWui/Xr9b2+TQX0y8mBqmCsSM/zXIB7w+nAMMwvtAOxOzNtHe1mwUQxU5v:RVtq67lleX8J
TLSH
T131A4DF96DEDF37A7F809DD65B57F1A039320C21B9304C78CA66DB342A5899DF20227B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\1.21.3\instance.cfg
Size 1KB
SHA256 45367135ef3d3c83b6b5005c6f8a9562a6ccf037832e6b12de3fa52ebf2c85b8
MD5 9e76f271acf702c1a122dd784ff19532
SHA1 616ca40ae8b3d80e4c444a4370f736c1d841b766
SHA512 dcfb200e2fa60b0d0adb5e4f55b6a6edcb628335495ec29b78a9b6b8dee0a45c5371bf2a68b3d3bb71b2d127c0654fd6465f84b062cc859ac570ab23ce6125a3
TLSH
T1C631F1416F68A07F6419240F9F57F0332B0B7D5A54AF7492F339388EB159A6C12C9189
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\1.21.3\instance.cfg
Size 51B
SHA256 ea73fb793bcc1107859afc199952a3c90527bd1968410793a0567f514e10a90f
MD5 dcc3bad556fed4baabf1b7904c455b52
SHA1 635adddda4ab45e17163b33ff57201f271a8e1a6
SHA512 1e33f79edfc1774c45f9fc30556a9ec963bad3455dfc8c505c520b490584a5e5173856f590ba9afbe69582d3b2dd4c868458d27886719f89d5a7f015bc13137a
TLSH
T17690020B5311207A04990745C1425C414F7202409128002821696D87A748D4665DB529
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\1.21.3\instance.cfg
Size 183B
SHA256 8e76171c46b5bbf938060e55b21a9d159adb21dc6461075db22a3fbcdbff8870
MD5 31e2a763a4f9f9972809e54d8902973b
SHA1 3dfb5a04524d01e9bd8daee1fcb68e8224094151
SHA512 358384dafe603ba0661369f98f2c7d8e462c90937873992cd4e70af75ed8cfea281f7e67afdae8011060ae34ba64123131b0f545c443e19185ff573f3a56064a
TLSH
T14CC0C0072F32517C0C7D1AD40E03F5371B257800A06E4118F03C1C06F290A0A3ACF10F
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\1.21.3\instance.cfg
Size 1KB
SHA256 aad047be2dbf80d17c2e88fa2b25e4164c3985ae850ff5e44a80fb46f96f7b09
MD5 d9ffdb91eaa583cbba887a7cdea66697
SHA1 c6ad7734a2e5c1d4ae04bf8377fe96337b1598ca
SHA512 7b91177d3229171c8f0d2b3c63ec5a175a5dcef6b1ff1b3d17ff29f4ea08d31f7289d0744be419f8afb93265b3ffba939f6f89ffa92b4fd19b78697cf6c8adf3
TLSH
T16C21C1426F28507F7019650F5F47F033271B7D8A14EF68D2F235388E719DA6C11C9199
MD5 SHA1 SHA512 TLSH

Submit Download

instance.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\1.21.3\instance.cfg
Size 444B
SHA256 133293b09c56e270f4a65d8146ff6190ded6b5985adeeb92f6b84ee4c819d285
MD5 c5fc601aa0f15bfa1a3c3c6e693f6735
SHA1 365e6506f3e86811b493b2e372e910f04371d4e9
SHA512 b5c3765032f543e0ce7959a7014602d88de1ca08702dc6d7f6e957e41a521a51bfbbdb754233722db92b214d077e4dba43ce84da3f3bc179a82c3ccea09503f5
TLSH
T1A6F05C837B3160BC78AA4B5F4F47F5271329FD18A01E4074F1183D0971A1F45A1DA04A
MD5 SHA1 SHA512 TLSH

Submit Download

mmc-pack.json

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\1.21.3\mmc-pack.json
Size 647B
SHA256 2d2ddef61378bc6e6e338e2aa7b58ad87a69d82f10e9f32ca5dd6fcbe2705e1f
MD5 29e62c09019d777b3d7911fe6eb5aab5
SHA1 4026ebbc817bca269fd3bd9b38d912b5a5fbbd41
SHA512 304a2bafaab9a1f8581b3c97d099dbd7e1c410bb27376313365cec6ad73fd9281bc17817f95268eaf4bbdc3f794325dcd04edafd1caaac918428156f28e91691
TLSH
T1BEF0E5A0C2F41CF22064A37C087A00AB957040672FB43EACB21D810D0F1CAFF61753AA
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-delta\legal\java.logging\ADDITIONAL_LICENSE_INFO
Size 48B
SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
MD5 512f151af02b6bd258428b784b457531
SHA1 84d2102ad171863db04e7ee22a259d1f6c5de4a5
SHA512 1a305bc333c7c2055a334dc67734db587fd6fda457b46c8df8f17ded0a8982e3830970bee75cc17274aa0a4082f32792b5dbff88410fa43cc61b55c1dce4c129
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-delta\legal\java.logging\ASSEMBLY_EXCEPTION
Size 43B
SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
MD5 bd468da51b15a9f09778545b00265f34
SHA1 c80e4bab46e34d02826eab226a4441d0970f2aba
SHA512 2c1d43c3e17bb2fca24a77bea3d2b3954a47da92e0cdd0738509bffcdbe2935c11764cd5af50439061638bba8b8d59da29e97ea7404ea605f7575fc13395ca93
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-delta\legal\java.logging\LICENSE
Size 32B
SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
MD5 663f71c746cc2002aa53b066b06c88ab
SHA1 12976a6c2b227cbac58969c1455444596c894656
SHA512 507b7d09d3bcd9a24f0b4eeda67167595ac6ad37cd19fb31cd8f5ce8466826840c582cb5dc012a4bd51b55e01bb551e207e9da9e0d51948e89f962ba09606aab
MD5 SHA1 SHA512

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
Size 2KB
SHA256 bc78b03b471957b716dadc93314908095470318266b0a6ea035125e9316dd340
MD5 45014c85cb5a91c5bef0d19508da5d65
SHA1 a35f70a4a896c5fbda0afccbcbcfb7291b6a2e49
SHA512 652e79085e33065208c19cdf4a5641a06e596eab4146d6693bc18160bb8c9ca83849ae15abed455ba5cc7ee21f0154d12fcd7826c4bf5e2d6b3afa2688978fd4
TLSH
T1C341E7726F54B03C01B615618CB2FE2A0D573D67088F7094F12C3C8FF1169522F5A9A7
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
Size 30B
SHA256 e7bb8d933ad3397d35cf1706f0364ebab6b7c73b6b6846cdb0383db420c2cb25
MD5 412c51abbdcc110394940f8bfdee3d3f
SHA1 17df4e8360e0b635622dd12a6a36088cbb47b2ad
SHA512 77b3d41680d77ed7a29b3d0e1d07583bd1a29d0c3939f0eebb17639cf2e92447fc5eb784635d0b44ae0b58a5212b4d9ca6505a02d0d2c9a521089a8b33437440
MD5 SHA1 SHA512

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
Size 1KB
SHA256 fa0a4a19431d2f748414a669c555c367b97b21c5873040043a3b20e5e6debf8b
MD5 0021e37d3392f7574f8c7af6403ce006
SHA1 4ae04e098b1135298f2aa5d2525c2f9bf291df0d
SHA512 480cada7d2a520f31a64e027eead5b4e9ad120fe5341662705b7a0298a834512cdaee75a0e7f4620dbd94d48844a7ed57532f07b1b382c4cc486d7e95fb65fd3
TLSH
T19A2121139FE4B03E407259224EA3FA2B16D73912900F50A8F5383C8FF767D15796655B
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
Size 1KB
SHA256 dd30c73fae74d04551a3846009c8a91e63eb2f8eb17282248c8b16d376560579
MD5 425cab60072fe8bdccb28f62525e4b71
SHA1 0eb8b8fbe7e8ca0a5852fb59e3d1b578ad24a67b
SHA512 dbeea3e37c4bdd689c02bfe3976cfea2bfd11d28253eedc2e6b8eb6ffe53161963c956f382818a57079bbfca7328d2a2b07473c451eeebf7ea202a0f4f04062f
TLSH
T1FE3156829F94B03D50724622CCA3F61B0A973D22544F61D8F2283CCFF227D556766967
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
Size 1KB
SHA256 5d1f52c764e70a81e54f8867953c57452c42b30513d275b6dd218ecfc000ed53
MD5 8aa073ba796e52ea9acad1b83fa701b2
SHA1 c1150e7e1ddd39aba4589950a29375ed0a72128c
SHA512 0430b742b56541349e0a669fd7d19212dc85137d0489b66f1c42fefc6bff8be6e3728ecf49bd156ba51b514febdaa543e42f1fddee4bb2ff1ce55e4f9b9d9ac5
TLSH
T1C3317442AFD8B03D503259224DA7FA2B05A73E12608F60D8F1283C8FF227D556766927
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
Size 2KB
SHA256 3ac1599c293ecde7ad90febec647b658169ea930395954679cb1921be81d20a1
MD5 36f1ce5dcd59ef2c90c0fdda2f434eff
SHA1 84c41215463b3abd10113a69cd8dc91b36eeca43
SHA512 b346f369856aa57e2fab575626d77ca63651c912b906ee52aa13ef4d26e2fa8fd1bf74eabf10877419ddb3c5c2db381d9d981c14fd5a20afa8db21a95636e18e
TLSH
T19841B3726F54A03C40B919618CA2FD1B0D923E67488F6080F22C3C8FF2669126E99997
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
Size 2KB
SHA256 9dcd271310fd0a2dfbbd131d6c05d04e4e94b829e40643ec519758cedddfb6fc
MD5 7ffc6af493574ba70cd8479983feca15
SHA1 3b4df87b75ab2b5a2a996eb33d95054496209445
SHA512 d9389a3712fd0cd44be9cb69129d34971f7dda635fdbf238a0ed90a8478be360cf90973a6ba65b3a52a53843855210f4ae7c14a9bb6302244114c061aca585d5
TLSH
T1E851B3726B44E03C10B918518CA2BE1B0D523E13888F20C0F22C388FF2669565E95997
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
Size 2KB
SHA256 84eb71e19132f9c90270f768a6bc9127da85edb53c41400cb08f433efdfb363f
MD5 a72dc2b784888cc79b69a7cd17af020a
SHA1 27b07f628e9060fed31fa608c606cfb75405235c
SHA512 3f5b80ed24481cc6cd92b24ae4524811ba4d1ebabd7ecc460c2b384691f134672860fabe3e2279383947ca44407ebe118ae575a1852edcd5331bc926374c130a
TLSH
T1EA51D5726B94E03C60B919618C72BE5F0D523E1388CF20C4F22C3C8FF2569065E95AA7
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
Size 2KB
SHA256 229cf23a375761b661dcdd512762c1ee4c2255376552172bd12eccb8d53ca703
MD5 cf95a67049fc772e2ae88afd834e076a
SHA1 83eba9c9cd61ef8bf1fc46fdb4299fed6edb05b9
SHA512 0fc15a85da57c05669a2b29d24ff7c8f3c4daeabf2fc293a3cd58cd4daa617a8f19bd1493240c5a8049438f80506b091334d4ff3c034c6bd8688bf5c52a4379f
TLSH
T17251C4726B84E03C50B619608C72BE5F0D923E63848F21D4F22C388FF2569465E95AA7
MD5 SHA1 SHA512 TLSH

Submit Download

prismlauncher.cfg.lock

Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg.lock
Size 66B
SHA256 2f7a86c09f6a860b234542e3eb82542d3fee23e68876a3f430680d34f5b352a0
MD5 5784a10c97a23951f75cb2fbef5087f5
SHA1 1094afe0d20859c0400fdcdaa13b962cae523df2
SHA512 93e6371becd333d5c0b615d799e9800cce1fafe6ecd1ab76675a8a1542a344c40b585da53ce2bc993fadb76fcdba0650512959851dc5c5c017589441a8266a0f
TLSH
T1FCA0220B0A3C3202802C0C83200CA2F2C0F00000002002308C200EBA82AE2A83A20EA0
MD5 SHA1 SHA512 TLSH

Submit Download

PrismLauncher-Windows-MSVC-Portable-11.0.2.zip.crdownload

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2.zip.crdownload
Size 19.3MB
SHA256 fe72e7cf7436fe01e23bbbea99ebc7f3245c27431061c753dc2e601b69c1c58b
MD5 fd77f46c45b69ee919ca6b199f36c0af
SHA1 34d88f0b1339a02b9b16cfb859770f33bc3b7055
SHA512 f0f2a7d1c1db69245416fa24fa359c2c24a2bc4e09ce58e238fe44a7a95611f19c59b2a37170b020a801f0861dc6eb2063de5a5d74079ea5ab30c1baeb4a586a
SSDEEP 393216:4AwctLJf05OPU3vBIeQ4WnDllNEuvueiT7IAqjQyPTmPQ2lbety:PDtLJf05OP36uWen7Z2leg
TLSH
T16D173378D1FC8A4BED75C835FF1EA78813E500433B0728B665C069976285762A1BF1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\Qt6Core.dll
Size 9.8MB
SHA256 b98eea394a95563879b614dbd4432ce074b0fceeb154c3bae252f4e7a9376a40
MD5 8119eae4c693c51b6760094df8515a9c
SHA1 f7195e76416b8242c8d087a60f4ec9f9290672d6
SHA512 0a7a795ea6d781ed53609b696ab98f7789b993052697f991eef1c9d756d924a1b8a829d7fe9c0dd9e8f3ff6858cdfd3ed15d872c1c1e885b1cd270b031b2882b
SSDEEP 98304:4VLKyLebAofeVMKFdu9CwJsv6t6mJMSKgVcC/3c/:WWPBSMKFdu9CwJsv6t6mSStZ/3u
TLSH
T1E4A6390766FA0011FAFBDA34DAB75112DBB27C466B3496DF025861185E337F09E3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\Qt6Gui.dll
Size 9.1MB
SHA256 28ca8b9e7d3d1c4e3cfafd6fe63877a05cf10202a240134a11f98384f01c9e37
MD5 bf3ef92f9e109770a7effc3f623caa17
SHA1 3dca2e5b640731c88921b26380c3af740b9a9b44
SHA512 20ed40767f103a393e6ec7777d20bf484ccff1f08fbb698dc8d9b856e169d6cc31c2fe69893529d75feed6da5b6f82bc21a1a6b69a53096d0efd386daf1b29a2
SSDEEP 98304:n17B8zKQ16be6OAZl5XWv7StQiYBNXcqQYOPTmeL:36ie6ZZTdtQiYBNMVPTmE
TLSH
T192A68D57A2A911D8D57BD13CCB9B9517EBB2701503629BDB02A0CA152F33BF12ABF311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Network.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\Qt6Network.dll
Size 1.7MB
SHA256 905e1ce3947fadaad566b6deffe345daf7f6efbc57207ea7fcdbfa77669e3de6
MD5 db8f3337ef680c805b0c49504cea7ab2
SHA1 9348cfb2f237047c638b231faf7714ac97e919e3
SHA512 aaa0cda6c228b54a96c9c6d5b24f1345609f61627788f0e67329d68d515cb38393691aa78e140d1da34dcea1ee4a4ddf6074c31a199d6239ea2b34898ddc0f24
SSDEEP 12288:D9onO5TLgx8PlBYyrw3hutJJ5za2rJq9OeBEd4yhexi9TQ75L3EXpX1mil:+83gxGmFRiJJ51rJq9OvdDhOi+75mXIM
TLSH
T135856B57A3A441D6D46ED13DCB4B8A0BF772700483669BDF02658A152F73BE22B7E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6NetworkAuth.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\Qt6NetworkAuth.dll
Size 285KB
SHA256 2b2cee4bf6cd28c7c65cadc21089902062ac8c76b74340c7c205e2b5db79a4cd
MD5 489b1972f4c7b330515b4739de58ad95
SHA1 077934747efdf78732e1ac4a900ac1d03a091f0e
SHA512 1f2dc46edea7651a23493bed86154b0f8f87c51a36778fbd3862c87a8e3f2b3add3ec4e779a0b6a346b6da66587f49b98fae7342854ea0381ea28c21150b386b
SSDEEP 3072:nPntlHGgash+B1RBKQ5NSuxBqcKu215Pdp8CqhwoLW1kJERAXWBJnuo1kIuxmwBe:v/+B5N5Bqcf215PdpToyyiuGux9Bfm
TLSH
T1A1542917A3A20DC2DC2BC179CA5B8613E6B374004752DBEF46658B4A1F677E2BE3D244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6OpenGL.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\Qt6OpenGL.dll
Size 1.9MB
SHA256 a41b71127d07924ddda67e787e8765ebf60f217817199f1becdd63f3db88847e
MD5 a29a79ca0a5bd2a88c09b43c9a7f95d3
SHA1 98ba5b9b7a4493085603c5416419c6f3f397a3c6
SHA512 35868eca9195b3d8738a8e84e1263d067141ef3823499cda32e8a33902bd7f229bd06d0a57080e8bc1c8138f37d77f1432eb2f455b36927aa6437c28301f1a0a
SSDEEP 12288:XyA2ngdKBJuEum86y+TjfI1CkX9RDYXKI297FcVlE/LY9QS:QaYum9V/feRzDYucGLY93
TLSH
T19995FFD5624AB622C976E2BE930F057E60F3AD57C3424BC388155B490AB57EE0B7FC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\Qt6Widgets.dll
Size 6.3MB
SHA256 f383fb6b3f6996efe23327ff607e7298fc47ee76e8b8ef8a65f8d2e0a91707e4
MD5 10cae5e4a928d4f4c027a2a689916144
SHA1 b48b2719f4fefdbfece73addc2e3efb5f32bd3da
SHA512 5e4adcb58564346b38fccc96fb992d9069a9cbc2c5b47c6cd5781abbc718634e14237e219a58210e7e9bfc21a02bd1e35efa8321b5bfc0bdec0322cc8c560e8b
SSDEEP 98304:JLNqD/uTGvqxgiJaj4mxHJpd9tozE2XJHTY8:5NqDaGvqxgiJajFxHJpd9tozE2XJzr
TLSH
T1C3666B5763EA0185C5AFD13DCB0B8A17E6B2700443229BCB1169CE592F73BE16E7E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Xml.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\Qt6Xml.dll
Size 156KB
SHA256 c9d4c5c5dbf8d9ef3264f27c67bbaa0cd1aac98bee2f258b4a0a19664e9f18e5
MD5 6bb91e7ecb5b3cd133e6e91b9b6ccfaf
SHA1 b60655124cb6e94bc4fe2a856368d25bc4cd8c46
SHA512 473ddf110e42c592864777d9fc3344580a349336c820e4895fa42e90ef576f274e160946fe0019790d8835cf20f89736a77483ccb88015636da83888b62a88a4
SSDEEP 1536:Z7LLdm+5hICv8Q0wCslIfO80V+NFu4jRcDXIDlvxe2obYTQj9sYpxABNqN7ug:ZrfA7QIm/VWRcDXIDa29YjAPqNP
TLSH
T157F34B877368428AD46AC278C91B091EFB73705057629BEF82648A392F67FC27D7D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

archive.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\archive.dll
Size 716KB
SHA256 86787093cd7636df930eae15b5051206af4586caa08b8515ac203b555e762551
MD5 ddbfcb281265650170fc2a961c7674af
SHA1 e2b5475278961f4baef8657dc6e452ff72fc4798
SHA512 6cac08292d560b110148049f3770df41240725b9d0adfa36b9b64d38ea345019b8385c8cc33fff88e8e5d14314ea6f9454ac9ba52138d41df947f5777ae28011
SSDEEP 12288:MMSFVwT75qJOwJXSD46qTzWftKgQNjVEcNjzxwPuqCcrzics:lSFVwT75qEtXm8KgQNjVTNjzxwjn3r
TLSH
T1CBF48D82BBF40668E977C1348546AA27F3F1F0551760DBDF06A487653F23EE22A3A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bz2.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\bz2.dll
Size 75KB
SHA256 fa9247086987ea485e61e92b705857239f748370a382199cef3d91e9e116d782
MD5 821d15f02b6b766b8521ad853e234966
SHA1 8f196edbc6d08eb2c852c4d00cec6e7c657c3d5f
SHA512 6e7ed72effc4f83b2da438ff4986b03906758a6efa70eca1d13755fb6044ebfd588cbcadad3a700383204599e0422f98dd124048a2ef37216413559d455dc781
SSDEEP 1536:uBVEJbODux1isWQ2d/ZGl3Ta5c/aBPEDDc3hTLK+ti8y:uuxAUhbrYVLKGVy
TLSH
T11D734B40B6A3FBBDCAABC0395623074BFF35FD680B1117BF3560967A2B22A910D74516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmark.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\cmark.dll
Size 140KB
SHA256 4f9f235a8cb1f93e772564909afbe136d77a01ba727abcaf0b497eb875ef1afc
MD5 e0496d685c24f899051114e9cf26061b
SHA1 45c5c05b8c2764a3ddb85eb5553e16ba683d53b0
SHA512 88dcc6510b0c3688a1ba28ef827341749191b33e7dcc641d8fff788d4d73077d6dc49dc7167f367036fbcee5df51be84e6fd2641baf3e5b3656cd2c38c3dc252
SSDEEP 3072:x5FnWcwoMEnY4Js2CVskFVtTmjq8yKEsj0oCLIiq+:tWcBSGsvVlFVtaOmROEiq+
TLSH
T1D2E34A95F5BC0066CC1BE07D4D2EE596E3BAB2173310C2E716400E65B9E7BE27636352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icuuc.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\icuuc.dll
Size 36KB
SHA256 6febd789ff616dd6398ae2453adc1e7ccd7bbb6aee8c623a2638c1c00d51e003
MD5 e9f9397709df3528c75c1d19fd64767e
SHA1 2d392c946c58203679cd33aa463041639e9fcf91
SHA512 304a41711e6247f6dedf50697c8429a92732bd8104f94dbc5589eb60700d50a835643f16d391d11850d48bf3309ec8f4e170e2ddefe776b5459b2ba3682f8bd3
SSDEEP 768:/CFRHyCpCB+GgU77TuVnsDh7tm8T9T0qjT6IAqla1c3pmYj96mr:K/prGPh7tm8T9Z
TLSH
T1D3F2D60DC8084F61D3A7DB3F697D392F1922099ABF69FBB8EEB4C99441D520D20B5742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblzma.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\liblzma.dll
Size 184KB
SHA256 0c06d92f5a4befee85eeb3128c2d8ab1c37e139737ed83ccab3d6c56cf535000
MD5 e2bcaea1f12135469099f01c92238069
SHA1 a1d68a40311bd035b05685aae17a2133977f88fd
SHA512 e8932fc0f10b965893beefe9062ba3eaa83d8c0779c109c86f5c9c19d0ecda66275bbd5f54065d8276faf3136dc2d229e0d8a744423926efee2ec375cda81b26
SSDEEP 3072:69w3e7cqOlgA0xUaotDWg+/rXaHaA1HRg7GWUs9mNo+sowfXi:69wuf45dsgka1HudYO+3wf
TLSH
T1840418A572A5F0D5E2678C38C6678B27D3F678040310A6EB06DC937D262FBE4563A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lz4.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\lz4.dll
Size 123KB
SHA256 2cdca20dcc4f06d0df425ac452204e38337c654dd2d7519c68fe9b9a38b91cc5
MD5 d15f6546a85a83af61e7adf1e1ececb8
SHA1 16403b61046c1f8888c3044edaf7d904f6a8b591
SHA512 23df9fb1f67bbb828224c6965f80a4d95db5e52ace67b44871b813bc2522cec73a0a21c9ce0c5b9bd06df69f21497e5cabf8ed0e970ce72226cae98c2f5b2b57
SSDEEP 3072:/s8r+jQPM8eFnR6bWuzTy0A58eY1glRr:/r+j78eFnUbnTy78c/
TLSH
T1D5C36B46F7E114ACE163D0BA9ADB564BE274B8552305AFE743A8CE713E13D908E33352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lzo2.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\lzo2.dll
Size 112KB
SHA256 334d221d34252306f8694a197de45dfbbdd4a74a8bed465636aa706617c3f41d
MD5 7efcd01040e472e75bd4e9226a6811e6
SHA1 aefea77a7f8098a54fdfdfc66ee3b9fbcd6ba1bd
SHA512 b7674ad9be1fa6009072b03a2756635cd7602316d42d9cc22efd8773f6595f6b86f3e308a1565f0290e688e111cc5ffaf13987db97d47aeac91cb02e95640f1d
SSDEEP 3072:XsSxM+h7JWygE0lE6OEb/Ex0JgxiLxKkv8wdG:D7MdEiE/ELES2xiLxKkvrG
TLSH
T197B35D59F1C65078D8EBC2388A5FD2C9E676B4480310ABEF16D1E97A2F47ED58D35320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prismlauncher.exe

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\prismlauncher.exe
Size 9.2MB
SHA256 e582d162978642397a0b0e47d2066395118877a3bbbe5fa2ae02dafa41f18ea7
MD5 cc14a7a95434cc0298feb4783f2a5454
SHA1 ffd8a7e217deb31ed644517fbbc865c25896b10a
SHA512 7657a6cac956c66eca6f10a440d0e31ebf210531def685769d534f5ea0ed4cfe05ea6f39c5576298368d635f5579609613f4ce80d31587d6ea71da969608fb90
SSDEEP 49152:bQlyU/1/1iAVsk2Z+glqnpZbySUnQymWW7vSMsu0/wW6mBEo3eZgEL8f8v63YPqw:eQqswGB3e6cn+HPixklsuxkox
TLSH
T1BFA67C2B53B506E0D138C179DA4AD976E1727C2343204ADB319DBE677F336E26E38A14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qrencode.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\qrencode.dll
Size 47KB
SHA256 a8e118ac3ec31158e02b62464c312d4882c9eeb62d0b5b83864e9ac2f5be32df
MD5 138b44750ace9b2c28b4f1619a2dafac
SHA1 65c0c7203a9e5d8980a53bb8ec939b4e814095ac
SHA512 1df2ba6047df8870ab66fb78b8a4d6f1c78a0caff87140d3b03259264447bbca42e0eb65ea17f159b9be2747a5fb06f989cc155281985194d7e883fc7490b880
SSDEEP 768:MyXjbYUZqkAvg5Lv/xiHrWlvKUYX5VAdPTLSriqWsmeS:MWnJZv7gLP3GPTLSvnS
TLSH
T183236ECA7FAC01DDE1274138C197564BD2B174521B42ABCF0B90ABAA1B33FD26977348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomlplusplus-3.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\tomlplusplus-3.dll
Size 376KB
SHA256 6c9905961a2b60227d946dcf1c0ba1de0973f472cf51306ebb281c0c05fd05b8
MD5 fefb5dee1632cf81928a2858577d2684
SHA1 4f00641196777cd7cf6cf2efdd18d2f01373fc85
SHA512 183d330f0f5c57d3049e8dc1dde626b03373985336bb621376cc7fea36b9f1041907498ad415f24ed6e2dcfe2f9cd8998b6447c6e43e2eb9b5d56f663bde86f7
SSDEEP 6144:bt80P99pO6Zds36KshHf2rHDf0oTph0lhSMXlBXBWfsTjd4J8:nPHdVQ9Tph0lhSMXl+sc
TLSH
T169849E17FB152075C1AAC2BCEAEE4601D7B2BC89834167CF17D999A25F53BC06D3BA04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\zlib1.dll
Size 88KB
SHA256 9361aefc09170b1d4ef3da9bd237d52f9e4b3514a36d042d9bd05eee5345d51b
MD5 f3ff632561b9dd9d5bff7e025fac2603
SHA1 9f314a129858caf90a59f42bcb0c5198931769c0
SHA512 66e5b8057d8bcbe02c5a2e71f0c08e3ad5d6646fe6039ddfcca99f09a2dd970038243755b59a2f231fdef6c0fab9ced5fe642150516d4af4e2c9b069a144cea4
SSDEEP 1536:uvEyaXGzTqbvqRfSOzhppf/ISUaYuOlqjebaIOcIOZGdGUL:BdXozVhppnURkeboSZGdGUL
TLSH
T1DE936B4AAAB412A5D6F78174D8D3079DC335B01407A44BDF5248A7AA1F23AE41F363FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zstd.dll

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Portable-11.0.2\zstd.dll
Size 642KB
SHA256 62ef834e03acd25ff2ad62b599e4f0daa55b22042455d83cdcb8bc070b43352f
MD5 b418332029137d7468ad0a213eb6f6bb
SHA1 0ad4e2f1bdb51d456fab0cfafdb6fd6dd1769edb
SHA512 97befaabd7e9192c8a1e760266a90ef2b535de227273ff95c8c58d11b9ad62900c82f3a95750d5dcd96ca6ee970fddb396c24f0d08729695344e9be9ed2f401b
SSDEEP 12288:/kY/0hUaFMJEOQzB8JGKnBxc1+yOdu5Io6H0LoZb:/b/0hlKnBxc1+yOdO7LoZ
TLSH
T109E48D83F29992EDC13FD179C5564327EBB2380613046AEB83A4EF642F13AE55B35385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe

Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MinGW-w64-Setup-11.0.2-1.exe
Size 44.0MB
SHA256 b3b378b900a0ebc4e5da89286be9e0134730eedb47c90a7968dcb85ec708dc40
MD5 2f5e975a5a00a9ae4d51afc90d1f83f8
SHA1 07e8b8d7f4df67d9ab697cd677a2d29bc09cd796
SHA512 edbedd543521584db3cbafc4635c06d88af7fd23571e374825a7d7e1e8e5ea266bb5eb97baa28d93663a47dcafeeeb4f145a8b9bdd0f6fef31b0815ff0d46cb5
SSDEEP 786432:tz28FenRF5KDiYuXW3MHKSiFlWH9KmLPXTysELwzSHHe+o5U3TpLA05uNqZXg/3:tC8o3AeYuXW3M1SmfL/TysELwGH++o5z
TLSH
T108A73341D4701A89DA3FD23F99DBE2397AAA8D051817352DF1E63F9778F73D244AA800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-1974-0x00007FFC2E680000-0x00007FFC2ED09000-memory.dmp

Download

memory/2268-1971-0x00007FFC2F010000-0x00007FFC2F1DE000-memory.dmp

Download

memory/2268-1972-0x00007FFC2E3B0000-0x00007FFC2E67E000-memory.dmp

Download

memory/2268-1973-0x00007FFC2BF40000-0x00007FFC2C527000-memory.dmp

Download

memory/2268-1975-0x00007FFC2BD20000-0x00007FFC2BF3C000-memory.dmp

Download

memory/3200-1177-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/3200-1179-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/3200-1173-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/3200-1175-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/3200-1169-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/3200-1168-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/3200-1167-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/3200-1176-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/3200-1178-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/3200-1174-0x0000021A73630000-0x0000021A73631000-memory.dmp

Download

memory/4388-1184-0x00007FFC322F0000-0x00007FFC32937000-memory.dmp

Download

memory/4388-1183-0x00007FF6B80E0000-0x00007FF6B8A13000-memory.dmp

Download

memory/4776-1165-0x00007FF6B80E0000-0x00007FF6B8A13000-memory.dmp

Download

memory/4776-1166-0x00007FFC322F0000-0x00007FFC32937000-memory.dmp

Download

memory/5108-1181-0x00007FF6B80E0000-0x00007FF6B8A13000-memory.dmp

Download

memory/5108-1180-0x00007FFC322F0000-0x00007FFC32937000-memory.dmp

Download

memory/5324-1952-0x00007FFC2E680000-0x00007FFC2ED09000-memory.dmp

Download

memory/5324-1959-0x00007FFC2E2A0000-0x00007FFC2E2BE000-memory.dmp

Download

memory/5324-1950-0x00007FFC2E3B0000-0x00007FFC2E67E000-memory.dmp

Download

memory/5324-1949-0x00007FFC2F010000-0x00007FFC2F1DE000-memory.dmp

Download

memory/5324-1951-0x00007FFC2BF40000-0x00007FFC2C527000-memory.dmp

Download

memory/5616-1031-0x00007FFC2D7A0000-0x00007FFC2DDE7000-memory.dmp

Download

memory/5616-1029-0x00007FF6B80E0000-0x00007FF6B8A13000-memory.dmp

Download

memory/5616-1042-0x0000029C7EE40000-0x0000029C7F80A000-memory.dmp

Download

memory/5968-1894-0x00007FFC2E3B0000-0x00007FFC2E67E000-memory.dmp

Download

memory/5968-1896-0x00007FFC2E680000-0x00007FFC2ED09000-memory.dmp

Download

memory/5968-1897-0x00007FFC2BD20000-0x00007FFC2BF3C000-memory.dmp

Download

memory/5968-1888-0x00007FF6F4040000-0x00007FF6F51C0000-memory.dmp

Download

memory/5968-1895-0x00007FFC2BF40000-0x00007FFC2C527000-memory.dmp

Download

memory/5968-1893-0x00007FFC2F010000-0x00007FFC2F1DE000-memory.dmp

Download

memory/5968-1887-0x00007FFC2E680000-0x00007FFC2ED09000-memory.dmp

Download