Overview
overview
6Static
static
3PrismLaunc....2.exe
windows10-2004-x64
4PrismLaunc....2.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...rl.dll
windows10-2004-x64
3$PLUGINSDI...rl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3Qt6Core.dll
windows10-2004-x64
1Qt6Core.dll
windows11-ltsc_2024-x64
1Qt6Gui.dll
windows10-2004-x64
1Qt6Gui.dll
windows11-ltsc_2024-x64
1Qt6Network.dll
windows10-2004-x64
1Qt6Network.dll
windows11-ltsc_2024-x64
1Qt6NetworkAuth.dll
windows10-2004-x64
1Qt6NetworkAuth.dll
windows11-ltsc_2024-x64
1Qt6OpenGL.dll
windows10-2004-x64
1Qt6OpenGL.dll
windows11-ltsc_2024-x64
1Qt6Svg.dll
windows10-2004-x64
1Qt6Svg.dll
windows11-ltsc_2024-x64
1Qt6Widgets.dll
windows10-2004-x64
1Qt6Widgets.dll
windows11-ltsc_2024-x64
1Qt6Xml.dll
windows10-2004-x64
1Qt6Xml.dll
windows11-ltsc_2024-x64
6archive.dll
windows10-2004-x64
1archive.dll
windows11-ltsc_2024-x64
6bz2.dll
windows10-2004-x64
1bz2.dll
windows11-ltsc_2024-x64
1cmark.dll
windows10-2004-x64
1cmark.dll
windows11-ltsc_2024-x64
6Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 12:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PrismLauncher-Windows-MSVC-Setup-11.0.2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
PrismLauncher-Windows-MSVC-Setup-11.0.2.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NScurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NScurl.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Qt6Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Qt6Core.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Qt6Gui.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Qt6Gui.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Qt6Network.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Qt6Network.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Qt6NetworkAuth.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Qt6NetworkAuth.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Qt6OpenGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Qt6OpenGL.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Qt6Svg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Qt6Svg.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Qt6Widgets.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Qt6Widgets.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Qt6Xml.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Qt6Xml.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral27
Sample
archive.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
archive.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral29
Sample
bz2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
bz2.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
cmark.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
cmark.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target PrismLauncher-Windows-MSVC-Setup-11.0.2.exe
- Size 22.9MB
- Sample260629-pg6z6ac161
- SHA256 f747a500d5f320f03e6d586b7b02a2ad9b4e20e9e3c049560653921e5ed0e7e6
- MD5 c9e517768e6f765d72bce0bfa55d5540
- SHA1 0a578425ed863b4d0b971a90331ea4ae2d3aecac
- SHA512 d5703c2a7b5c4b5aa416f987ac2bf6e5e4759619b0d96a0d0c9e583a259c649c31552a96f6cd81486d974df3944f17cbde3d15a2a078822e6fe3a2948ce5b694
- SSDEEP 393216:+bKjTvdjxZcD3Oj/6E2aHd/08sNkkdgxe6Vzu/cUGRoPeN2L3vaqNACcspokbGrs:+YTtmLE1SbNVKxe/8qg2mCcsaiPGAgdg
- TLSH T1323723DE73740044C18E0F749A9A51C0790E6D6727F0E87BEA76F4CAACB4ACA45DE91C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
pid Process 6492 prismlauncher.exe - Loads dropped DLL 28 IoCs
pid Process 6048 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 6048 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 6048 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 6048 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe 6492 prismlauncher.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier PrismLauncher-Windows-MSVC-Setup-11.0.2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe - Kills process with taskkill 1 IoCs
pid Process 5708 TaskKill.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\prismlauncher\shell PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\prismlauncher\URL Protocol PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Key created \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\prismlauncher\shell\open\command PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Key created \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\prismlauncher\shell\open PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\prismlauncher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PrismLauncher\\prismlauncher.exe\" \"%1\"" PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Key created \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\curseforge PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\curseforge\URL Protocol PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Key created \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\curseforge\shell\open\command PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Key created \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\curseforge\shell PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Key created \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\curseforge\shell\open PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\curseforge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PrismLauncher\\prismlauncher.exe\" \"%1\"" PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Key created \REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\prismlauncher PrismLauncher-Windows-MSVC-Setup-11.0.2.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier PrismLauncher-Windows-MSVC-Setup-11.0.2.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 6492 prismlauncher.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5708 TaskKill.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 6048 wrote to memory of 5708 6048 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 91 PID 6048 wrote to memory of 6492 6048 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.2.exe"C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.2.exe"1⤵
- Loads dropped DLL
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\TaskKill.exeTaskKill /IM prismlauncher.exe /F2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5708
-
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:6492
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Core.dll
- Size 9.8MB
- SHA256 f9040715d72532f35a1cdd418b7c9cac8b2ca4aab22e6e098d7849a9ffea5620
- MD5 6d3ad600618f8faddff23897dd2b77ff
- SHA1 ab63324286795450aad3dc3b9cdca366dcbd3ad6
- SHA512 397fd2f86851b3494b2d4b8ef25357e2572f0ac82f533d8ca11990c2ed5bc6517f1f15f2049f3795e8c28bca20258a920baf0635c8852ca5c74755aa586be7eb
- SSDEEP 98304:8VLKyLebAofeVMKFdu9CwJsv6t6mJMSKgVcC/3cQ:yWPBSMKFdu9CwJsv6t6mSStZ/3Z
- TLSH T102A6390766FA0011FAFBDA34DAB75112DBB27C466B3496DF025861185E337F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll
- Size 9.1MB
- SHA256 ab8e16ca1f087753b216490b217e6edf13754e5a303c577fe6475150e3706ef4
- MD5 3e7556d434872f7337cdbd9c6c3bb4b8
- SHA1 b3a3591e9b6605bc4b2bf33eaae18a9cef6ddd1d
- SHA512 3e89a3afdf219ee73de2535e7e453eee6ba29fb860757857318614e2e286cf66ed788744681ff468d7158f0c8f564bc21b2aab79cd2ce72a8ee266d7fca3421d
- SSDEEP 98304:/17B8zKQ16be6OAZl5XWv7StQiYBNXcqQYOPTmex:v6ie6ZZTdtQiYBNMVPTmC
- TLSH T13FA68D57A2A911D8D57BD13CCB9B9517EBB2701503629BDB02A0CA152F33BF12ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Network.dll
- Size 1.7MB
- SHA256 440d4a640216b6ce66d5d7c1229f741619b5eec17b78aec5be2c31aab36b3419
- MD5 e4e52b0c7e90a7711f8596ee429d8a85
- SHA1 8e2b0cb78d6e2bb6271eab4aa8ef582946119521
- SHA512 1c4f4aff0d7369eb04ea4a897394f7e1a0b0ea0a0177b7bdbc6d267e857b75f44e9788012bea7966679967bffd984b476d45785e697be2603b7b4afbd96a61bc
- SSDEEP 12288:Q9onO5TLgx8PlBYyrw3hutJJ5za2rJq9OeBEd4yhexi9TQ75L3EXpX1m1:h83gxGmFRiJJ51rJq9OvdDhOi+75mXI1
- TLSH T1F8856C57A3A441D6D46ED139CB4B8A0BF772700583669BDF02658E152F73BE22B3E360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6NetworkAuth.dll
- Size 289KB
- SHA256 81d0b91e4a4742cf1247e97ac70cbb95ce5f10c1c8ea20c8d06153d6148372d4
- MD5 3055ae403f7f9bf557f903ed348fa723
- SHA1 0ef7dcf68e1abfaa8c721c453f67a0f821fef8c6
- SHA512 28e9fbf352eaa70a4166be59bc142737da5a52a7adbe2e629a8b472e5f55fcc5a168ab535b643bf993002bca4743cefb38a9f51dc3473d9674ad63674c05c3bf
- SSDEEP 3072:2PntlHGgash+B1RBKQ5NSuxBqcKu215Pdp8CqhwoLW1kJERAXWBJnuo1kIuxmwBA:I/+B5N5Bqcf215PdpToyyiuGux9BEB
- TLSH T166542857A3A20DC2DC2BC179C65B8613E6B3B4004752CBEF46658B4A1F677E2BE3D244
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6OpenGL.dll
- Size 1.9MB
- SHA256 220587b7473d8698d98119250a8f3d11aba0d4545f0a2a245513100a65e5574c
- MD5 97b1482c09c0318e709ba1b1dcd0a849
- SHA1 ae57cfc7a6df4f9cb1d4702b7314ca2c0dd770b1
- SHA512 2336e1c5b83e2e5c80d420fc44bed80cec9a0564057c6a24fc4e9aec621fba699630fe16e6147aa9aef22e9613aa48736069404e80ab73975272b3f026104fe4
- SSDEEP 12288:PyA2ngdKBJuEum86y+TjfI1CkX9RDYXKI297FcVlE/LY9Q2:4aYum9V/feRzDYucGLY9T
- TLSH T1F295FFD5624AB622C976E2BE934F057E60F3AD53C3424BC388155B490AB57EE0B7FC06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll
- Size 6.3MB
- SHA256 b0b0786a526c2b8cee270ba663323b6d039bf97acb68bf66b072fb5737759244
- MD5 b6410aa11ec4d685997e0b8ee11e299c
- SHA1 77a764ce1636c69834bed2f08631bca588e25d48
- SHA512 8e5c1eae1cfa6faee61d6e5dedf281a789cc53c5cff05ce52551f649feda2e97d1dab8163ab31cc60f15b50157a50d5d5c39f2ce790214ec8807dd8d23be4509
- SSDEEP 98304:RLNqD/uTGvqxgiJaj4mxHJpd9tozE2XJHTYm:hNqDaGvqxgiJajFxHJpd9tozE2XJzl
- TLSH T143667B5763EA0185C5AFD13DCB0B8A17E6B2700443229BCB1169CE592F73BE16E7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Xml.dll
- Size 159KB
- SHA256 1ab2179c16cc54db8702791cbe323aca0a4681ecbc5a8214a5e580eb2e62a7cd
- MD5 fc36f5ef938f3553889c19e4618a0840
- SHA1 8f9fb2c35731b00f81105b0344dee8d918153f3b
- SHA512 0f76b59fef859d5db077f5b37ac7df3c551c2af0d3c5ec8481663a4b1d57d3abd4dcf5718863e911ab159512f978fd79cc638242ce396456950d7a779e5cc67f
- SSDEEP 1536:O7LLdm+5hICv8Q0wCslIfO80V+NFu4jRcDXIDlvxe2obYTQj9sYpxABNqEd3S9c4:OrfA7QIm/VWRcDXIDa29YjAPqbTl
- TLSH T198F34B8773684286D56AC278CA0B490EFB73709197129BEF81658A352F63FC27E7D350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\archive.dll
- Size 731KB
- SHA256 6ec07b7234d4cee6bae528f2ac619e3f2ac21c5570f0432276c795678eb3456e
- MD5 9801865f09659312a00d59d3d0531b3b
- SHA1 3d5dca77bd61a723dbe6790f48364fbb14d2a817
- SHA512 47800b36307049a86a3d74e62728544965de4421b0d4d6769358ff3105069db88db6d40a0a850b2a48970bbc45b244eb2f3bf0ae18046e1a1b7db028bace6d47
- SSDEEP 12288:GMSFVwT75qJOwJXSD46qTzWftKgQNjVEcNjzxwPuqCcSzicsd:DSFVwT75qEtXm8KgQNjVTNjzxwjncri
- TLSH T1E6F48D82BBF40669E977C1348546AA27F3F1F0551760DBDF06A483653F23EE22A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\bz2.dll
- Size 90KB
- SHA256 d984e746b33f24f531e2263ff69e80a126005a1f578d6c28f59dd2036c73c2e4
- MD5 d684863de5f0d90db4be1257ab2c065b
- SHA1 001b08f129104c9b34308de347e8f5b8acd7a45b
- SHA512 13667f196d5965dab1567232da486a271227aad71ef263a3247f7c31a9b9d0c5dd79275ecaf8b3f16c35292297fad063219e8cd2f0524997f967a55755dcd45d
- SSDEEP 1536:eBVEJbODux1isWQ2d/ZGl3Ta5c/aBPEDDc3hTLv+ti8y8d3S9ufIk9s:+uxAUhbrYVLvGVyh5
- TLSH T101936C44B6A6FB7EDE9BC43492620747FF34BE690B1117BB3560C2BA2B127D10E7411A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\cmark.dll
- Size 155KB
- SHA256 068156a998f79b1a815411bafad2af5369a109276cefba6517a72f28d56bbfa7
- MD5 8b74d6e906f91ec2d459fc58aabb7bdb
- SHA1 6ed805ded7c29feb55fb64707d64201b2094952e
- SHA512 48172de9ce9f92c1aee526257afb309bbfaa063109ef42a2c8654abd8d3ff8e9a58a5d0d87907739bb73ea983f53f3a8548b046c1253ebfd93f5bc6b2a8d1fd0
- SSDEEP 3072:H5FnWcwoMEnY4Js2CVskFVtTmjq8yKEsj0oCLIit+Bm:fWcBSGsvVlFVtaOmROEit+I
- TLSH T14AF35B86E5BC0066CD1BE07C4D6EE586E3BAF2173310C2E716404E65B9E7BE27635352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\icuuc.dll
- Size 51KB
- SHA256 33324e7fd0c14be10a5411ec6c8162def947b5e7e0c8e2ee89985066ce10c217
- MD5 e61c7267d96f7a129389fbaadf301ed7
- SHA1 132acf3af4c264401910bb5c5cfa683f6e276a0b
- SHA512 5ac4ab24b45101d52ae2a80d359caaba656bbe2e9bb9f33c40a190a88c8adc7cecd171adfc1d113c9a26605ae36253976a986c2df9d5ed6628e6571d04127813
- SSDEEP 768:aCFRHyCpCB+GgU77TuVnsDh7tm8T9T0qjT6IAqla1c3pmYj96mrKduegc2Ip4gAN:v/prGPh7tm8T9ZKd3S9gMfIkEk
- TLSH T190332A4DC8184F52D3A3DF3EA6B8B92F69314AD7BE68FB74ADA4C58001C538D12B4356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\liblzma.dll
- Size 199KB
- SHA256 56840943bcd48d9e7960f1495dfce153bdce10f0f3e25b95c7d82c662dfe5723
- MD5 8eb454bb23b9356c2453703f5ff68be5
- SHA1 3fbbdeaacd852ab9786dc9202c095989498a95df
- SHA512 0944600b8733bb0b97a53eb5aba6e018cbb85c51b2d7fb7a056882c2947319f987ff3def92ce21b8c67629ac2e880abb3af5d91e19386121828df06644617a9e
- SSDEEP 3072:Q9w3e7cqOlgA0xUaotDWg+/rXaHaA1HRg7GWUs9mNo+sowfXisTS:Q9wuf45dsgka1HudYO+3wf7S
- TLSH T15D1439A562A5F0D2E2678C34C6678B17E7F678040310A6EF05DC93BD262FBE4563A317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\lz4.dll
- Size 138KB
- SHA256 3bc341550859d446aeb213b53af4f1107583c2ca11201172088a2062ab3d6a0d
- MD5 9d1a0f650d348ab1fdc66cc23df5c48e
- SHA1 949c8ec502842f3d84e9f1fc5a38c6fc86ee7133
- SHA512 fcdbd7a9e07a2867812a6f5b8c6362f6bd6ede7e07fc16ee34bb3f4546c6cbcf68b6e55c57e20418822e54ad6963f8b6103524bc77a3286aaf6f75543a51c905
- SSDEEP 3072:Xs8r+jQPM8eFnR6bWuzTy0A58gY1glRr5d:Xr+j78eFnUbnTy78S/n
- TLSH T180D37C87F7A4109DE153D0BA96D6864BF674B9522311AFE743E8CE712E13E908E33352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\lzo2.dll
- Size 127KB
- SHA256 a145665acf1ae5ff753b67422d890b593f0328def3ce5929c68bee043716f010
- MD5 a43ed98f0330c248977b4cbd83b7a259
- SHA1 adb1026af6a4adb1e2f5bb71b160593e1a88dada
- SHA512 58cda4ea75c8b2cc0f8da6323ebf2cc6153acc779aa664c64c277124090114e4baee4d87ca32b2d16f2332246a81d2305dc181196ec402d3bca2a1c2accb5a77
- SSDEEP 3072:BsSxM+h7JWygE0lE6OEb/Ex0JgxiLxKkv8wrGdTo:R7MdEiE/ELES2xiLxKkvRGNo
- TLSH T13BD38E59F1C65068DDE7C2388A9AD2C6F676B4480310ABEF16D1E97A2F43FC58E35324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\platforms\qwindows.dll
- Size 977KB
- SHA256 1c0a55d290a19d44b002f0e34b92cd112dec54af30a283ba15ff103f14376a60
- MD5 d004a943d6dd3baaea3b1e32d93ac257
- SHA1 b832667c806cfd07a6be82fce04ebc99e4c13e7b
- SHA512 59337d227fc9df84e0a52b3270ab0bd554212c1a5fc3bfa16f95e4a0bf2c8758f3b6d95cb3f396e637bc0ec85fda913d58a71ef91af6cb290a13b0e8d31ccbe2
- SSDEEP 12288:sEhqYCXtrx8ASfukqEZ8l4382P3Q464RSQivRYt/3:sEh5aOXfukqNl43Nh64z8W3
- TLSH T187256C1F63A80255E83AC17ECE5B8713D6B2746903A186DB0161CE197F337E32A3DB59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
- Size 9.2MB
- SHA256 ba72817825e0bfcba7633a607eba38611929446dda6ad47ef38bb432b5b66cd6
- MD5 ec4eeae9225be174e71b33e8fe7f5716
- SHA1 f767d93ccc317515f69a3f907cacb2fb278b4476
- SHA512 46a3119d5527fe6dbdc103a9708783de50f61b913ac9aae6c18920b726bebcb05ecd38ef5712a3ecb68b1242d0d93c3d63ab6e9d9291756977f5910b6d88d415
- SSDEEP 49152:gzegKRVRDGGrrozp1C5UF3Ozhja4IJvW6yj0g9/Qb96wED4ZZgVi3X9fUVNdrdlC:jDj4wBrYpgb3z6cn+HPiNklsndxa
- TLSH T181A6AE5F677802E0D139C278DB4A1593E27578234320D9EB711DEEA69F335E22E3DA48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\qrencode.dll
- Size 62KB
- SHA256 8b3fbbdad47c3b8ab98422968e28c134beefa2e78b01e1b8c3618981ed417b99
- MD5 446ef55022ff2c5ed026f13ad1c4d4e0
- SHA1 8ca230231b0b851451da46133f5e04e4bc1d0024
- SHA512 4caded094e70b566c21084955200cf8e7d22bf3c1c1aef0fa25863a97a56280f0f4f099bbd48c4726644681d42afc95298e5dac99e427d1f530f76564226e6a7
- SSDEEP 768:cyXjbYUZqkAvg5Lv/xiHrWlvKUYX5VAdPTLSriqWsmeS2duegc2Ip4D1oTxf1mlE:cWnJZv7gLP3GPTLSvnS2d3S9CfIbHnnA
- TLSH T166537DCA7A6C0189E6574634C2D7CA87F57176931B419BCF1790A7960B33BC2AB7A30C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\qt.conf
- Size 1B
- SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
- MD5 7215ee9c7d9dc229d2921a40e899ec5f
- SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
- SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\qtlogging.ini
- Size 609B
- SHA256 64e1b2dbf14930ad0fc05cd756654aeb9126e61a87a45ce862b49457691c2a64
- MD5 1eddd2468899e23d221ad133ad72987c
- SHA1 3a78cef07375961a9eef061aeb602b08764ada70
- SHA512 bdbadf26761b7bcee91b83992dc58a2f3a083aa305dc13546856f477b66f309088f1ce57107a582dda58cdea173e3d9de5d17e21b55ba0cb8ad380e33089d039
- TLSH T112F078889ACB20B814E217D0EFEFE123D0B030332A4EA3B1E8204919721CD483831E22
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\styles\qmodernwindowsstyle.dll
- Size 219KB
- SHA256 6e67cb13cfecd187574747c7a04a3d56ebc1143dcb91d553a52d4a23be5c637e
- MD5 0a19eda2b9daf5a3d9f1f327c667e95b
- SHA1 ac2b87738db8c766512b89a7f69a591a08c3d8d7
- SHA512 8dd0cc37658b1012901c3108562285dfa0c24ef1190716bf175173e8b28f28b5af1887eb11b6c61af50068f956298d90aec9be6d50170078dcc5551b04a6ed11
- SSDEEP 6144:C4vKeYVVMifp1yq9uT/ocMIhw5oL5bQ/Z/P9tlJaH9TpIF:C4vSVOihh
- TLSH T15D244943329612C6C967D2B8C90B5613F67330A8032696FF4167DEB42F633E2BD39661
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\tomlplusplus-3.dll
- Size 391KB
- SHA256 0267a2177a1824ada67eb32ca0ee72481309977264c57a6a61f73771306eff56
- MD5 4a115e67d8767dbdc3f8fe647df222f1
- SHA1 d5199214bccd5fb58482cec0f86d57b02d63e771
- SHA512 0c3183fca7687838cb7312f201f87627e9afd34d2ef52b1f0dc4c0ee16a5a37b3dc6681a641895c961fc47370a0c51ef2cce1a8f226b75a88ef416c70202be67
- SSDEEP 6144:bv80P99pO6Zds36KshHf2rHDf0oTph0lhSMXlBXBWfXvjd4J8M6:tPHdVQ9Tph0lhSMXl+XAk
- TLSH T10D849E17FB152076C16AC2BCEAEE4641E7B2BC85834167CF17D995A25F13BC06E3BA04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\zlib1.dll
- Size 103KB
- SHA256 445934e9afce00dde9d49de424f08114ecf9bb27c9a9261576d3be60738ef082
- MD5 49a1eeecb25ef4879ba30feb262a2ba5
- SHA1 2c7926d3c31c72a201b2f42b8ebb618d77856241
- SHA512 f2ba2d45fbe1dd75f1c37a6bee2d7faf7640091743ed38ed13b2eb5993ca41d84afb1f5cba8f5e2574d4bea99300bfd8735303d69394f4a11919d43fa4c338bf
- SSDEEP 1536:6vEyaXGzTqbvqRfSOzhppf/ISUaYuOlqjebaIOcIOZFdGULmd3S9KfIbHhnJd:tdXozVhppnURkeboSZFdGULzTh
- TLSH T1C2A3AF896A7412A6D6F38570D4D28B9EE334B15507A04BDF5188A39A1F13BE02F393FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\zstd.dll
- Size 657KB
- SHA256 932e4b1429ec5ae2185fabb195f0293c0ef006bdcb754b5a769af4b6454d1183
- MD5 30595f661acdb3de8c215ff336bf8c81
- SHA1 363fca913674a1f43a3717e86ad643e492695876
- SHA512 8884fabf1d39c6bff3a5dcac41e9aa02722f0a8dc590292c81f281426b83832cd66fc2debebd9f1d94a67885ae47299bd80648158c02434b1439915ac55e0fa3
- SSDEEP 12288:0kY/0hUaFMJEOQzB8JGKnBxc1+yOdu5Io6H0LokbT:0b/0hlKnBxc1+yOdO7Lokn
- TLSH T1C3E49E83F29992EDC13FC579C5564363EBB2380613046AEB83A4EF642F13AE55B35385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm4969.tmp\NScurl.dll
- Size 6.0MB
- SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
- MD5 bf43de0fb8a2c38abcf7b1cf6be7e7ce
- SHA1 5c14855ddbf563da3bc14af40ea5650d627ab81d
- SHA512 145388afde1367253d723ea78501dfd61ebcfb17d440d324dbceb5d9b1c50dbd5a69946209722396f1d0f3699dc967bedab690dd670eedc9910b75a4e7d13830
- SSDEEP 196608:ohFz25oFKhmagHDetua42OOMoMy+Tgt/VqiWWO+ac88vdPkR:oXmSLTgtDqU
- TLSH T1DA563994FECB44F1E91384B0D8DBA37F9B349B118021D6BAFE4C5E56F933701252A25A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm4969.tmp\System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm4969.tmp\modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm4969.tmp\nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm4969.tmp\nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH