Overview

overview

6

Static

static

3

GDLauncher...64.exe

windows10-2004-x64

5

GDLauncher...64.exe

windows11-ltsc_2024-x64

6

$PLUGINSDIR/app-64.7z

windows10-2004-x64

1

$PLUGINSDIR/app-64.7z

windows11-ltsc_2024-x64

1

GDLauncher.exe

windows10-2004-x64

5

resources/...le.exe

windows10-2004-x64

5

resources/...le.exe

windows11-ltsc_2024-x64

6

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

6

Resubmissions

12/07/2026, 04:52

260712-fhvtvacz4k5

12/07/2026, 04:35

260712-e7mn4aey4w6

12/07/2026, 04:15

260712-evnevsey3t5

Analysis

  • max time kernel
    901s
  • max time network
    549s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GDLauncher__2.0.30__win__x64.exe
  • Size 150.8MB
  • Sample260712-e7mn4aey4w
  • SHA256 1e2792d480967dcbfb85f0ce48f08da8054eab3e57972dcd48fe576c283b9461
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwarediscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 22 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 59 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\GDLauncher__2.0.30__win__x64.exe
    "C:\Users\Admin\AppData\Local\Temp\GDLauncher__2.0.30__win__x64.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq GDLauncher.exe" /FO csv | "C:\Windows\system32\find.exe" "GDLauncher.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq GDLauncher.exe" /FO csv
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5472
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "GDLauncher.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4204
  • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:472
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        3⤵
          PID:5560
      • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
        C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\gdlauncher_carbon /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Crashpad --url=https://f.a.k/e --annotation=_productName=GDLauncher --annotation=_version=2.0.30 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.7.0 --initial-client-data=0x510,0x514,0x518,0x508,0x51c,0x7ff7a1133184,0x7ff7a1133190,0x7ff7a11331a0
        2⤵
        • Executes dropped EXE
        PID:4856
      • C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\binaries\core_module.exe
        C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\binaries\core_module.exe --runtime_path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\data
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1128
        • C:\Program Files\Java\jdk-1.8\bin\java.exe
          "C:\Program Files\Java\jdk-1.8\bin\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
          3⤵
            PID:5628
          • C:\Program Files\Java\jre-1.8\bin\java.exe
            "C:\Program Files\Java\jre-1.8\bin\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
            3⤵
              PID:6080
            • C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe
              "C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
              3⤵
                PID:1364
              • C:\Program Files\Java\jdk-1.8\bin\java.exe
                "C:\Program Files\Java\jdk-1.8\bin\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
                3⤵
                  PID:5248
                • C:\Program Files\Java\jre-1.8\bin\java.exe
                  "C:\Program Files\Java\jre-1.8\bin\java.exe" -cp C:\Users\Admin\AppData\Local\Temp JavaCheck
                  3⤵
                    PID:4092
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3972
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe --type=cs --cs-app=GDLauncher --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --phase=85 --muid=1e876e56-848b-5501-234f-8af9b2241494 --muidv2=7adafcd0-7292-4051-9cae-903855747228 --version=37.7.0 --first-run
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1916
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
                  2⤵
                  • Executes dropped EXE
                  PID:5768
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1783830597504583 --launch-time-ticks=622264691 --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2796 --skip-intro-animation=false /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3664
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6012
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3980
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1783830597504583 --launch-time-ticks=623199343 --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3444
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1783830597504583 --launch-time-ticks=624245657 --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3900 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=1e876e56-848b-5501-234f-8af9b2241494 --phase=85 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1640
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1783830597504583 --launch-time-ticks=630773154 --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4004 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=1e876e56-848b-5501-234f-8af9b2241494 --phase=85 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:5080
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1783830597504583 --launch-time-ticks=637324119 --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4036 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=1e876e56-848b-5501-234f-8af9b2241494 --phase=85 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:5652
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1783830597504583 --launch-time-ticks=643865885 --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3716 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=1e876e56-848b-5501-234f-8af9b2241494 --phase=85 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4580
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1783830597504583 --launch-time-ticks=650414648 --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4012 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=1e876e56-848b-5501-234f-8af9b2241494 --phase=85 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2360
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --standard-schemes=owepm --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=owepm --app-user-model-id=GDLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --node-integration-in-worker --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1783830597504583 --launch-time-ticks=656949070 --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4020 --uid=dibeihhdinofpmiennjkclnoidpjakanhclfmpmo --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\@gddesktop\resources\app.asar" --muid=1e876e56-848b-5501-234f-8af9b2241494 --phase=85 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2412
                • C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe
                  "C:\Users\Admin\AppData\Local\Programs\@gddesktop\GDLauncher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\gdlauncher_carbon" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1860,i,8913784636772037209,9417299504339637568,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:10
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3128
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k GPSvcGroup
                1⤵
                  PID:568
                • C:\Windows\system32\sihost.exe
                  sihost.exe
                  1⤵
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:4052
                  • C:\Windows\explorer.exe
                    explorer.exe /LOADSAVEDWINDOWS
                    2⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Enumerates connected drives
                    • Checks SCSI registry key(s)
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:4428
                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:5048
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:5056
                • C:\Windows\System32\SecurityHealthHost.exe
                  \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                  1⤵
                    PID:5840

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        3903daac9bc4a3b7.timestamp
                        • Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
                        • Size 46B
                        • SHA256 f794182d1e3cf106814df8c84e8e4f7c7e08fa4428e57d39440eff917e0aeae7
                        • MD5 SHA1 SHA512
                        Submit Download

                        3903daac9bc4a3b7.timestamp
                        • Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
                        • Size 46B
                        • SHA256 f02751cb5178fb474fdca1c4e77694411def93bb7920cd3c66d5efea631881d6
                        • MD5 SHA1 SHA512
                        Submit Download

                        905ebba3a8fc8cc.timestamp
                        • Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp
                        • Size 50B
                        • SHA256 64293d30502d693cafca29d4c6d693ce83914808f79e565650fcd6fdb60c3cbc
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-Interactive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        • Size 1KB
                        • SHA256 32cb9de8f353647667b7f924bb30db77f8f0fb89be6c64bcdafe6ae2081e4f65
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        prep_Activatable Class_Hermes_perf.cache
                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                        • Size 599B
                        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        JavaCheck.class
                        • Path C:\Users\Admin\AppData\Local\Temp\JavaCheck.class
                        • Size 1013B
                        • SHA256 c607f5871610bf9240c75f4abe947469496570b380f670e9d8d09f9c785978b5
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        __PSScriptPolicyTest_agcehw5u.230.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_agcehw5u.230.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        LICENSE.electron.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\LICENSE.electron.txt
                        • Size 1KB
                        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        LICENSES.chromium.html
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\LICENSES.chromium.html
                        • Size 14.6MB
                        • SHA256 798583ab2464d3602a63a328c95aec829329a5253b3b2b9cea59979d38fb350a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        chrome_100_percent.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\chrome_100_percent.pak
                        • Size 163KB
                        • SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        chrome_200_percent.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\chrome_200_percent.pak
                        • Size 252KB
                        • SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        d3dcompiler_47.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\d3dcompiler_47.dll
                        • Size 4.7MB
                        • SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ffmpeg.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\ffmpeg.dll
                        • Size 2.9MB
                        • SHA256 d68a77d0e0e09e7c63e8304fee8d2f6fb71a070352a90b0b9c7c097f6a446774
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        icudtl.dat
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\icudtl.dat
                        • Size 10.0MB
                        • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libEGL.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\libEGL.dll
                        • Size 503KB
                        • SHA256 f1521023210cbb2bf4b8341c77369e278ff18b6218619faf902a77864c1b9554
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libGLESv2.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\libGLESv2.dll
                        • Size 7.7MB
                        • SHA256 574337d1d39eb5ff0c2eb88fe4b96ab161b1e0054e6b5ff94b94cefe19bc04ce
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        af.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\af.pak
                        • Size 546KB
                        • SHA256 5f3f662f860d0f319027e68d4fb1e68933b2bc3d1beff05bbcfd13f490623bab
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        am.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\am.pak
                        • Size 886KB
                        • SHA256 ca2e31cb035c8f48758c1181078edfce56127ee782198f8765cfd16b5163bf16
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ar.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ar.pak
                        • Size 980KB
                        • SHA256 a9bc6ec0e5d458468e0659e19641b52ca371f03daa92b84c63bab38e4ce3bdcd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        bg.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\bg.pak
                        • Size 1011KB
                        • SHA256 5907a91c11524603f87bf474825d2f30562a89fd9a8e2595f2fb9003106e6201
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        bn.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\bn.pak
                        • Size 1.3MB
                        • SHA256 0a88efecf87d216bbb081d3d26f8ac91656642ab52a66ff9d91ee8e61673d7c0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ca.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ca.pak
                        • Size 615KB
                        • SHA256 74c25c05829be034b1ae6469205f07830f9733e28989a3e500322493536f0279
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cs.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\cs.pak
                        • Size 636KB
                        • SHA256 efb45cc491a3df934aee0eef9eeb147643823784d696a53036ff9c9c2eefeb47
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        da.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\da.pak
                        • Size 574KB
                        • SHA256 6380dcf390f08fba53019aede4b5b26754eeaaf6968147780d8f085a9f8c2631
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        de.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\de.pak
                        • Size 615KB
                        • SHA256 ae28e9e71aaf424c0323f2949f7426405ccf7509a2568c93bfe29690a7302094
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        el.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\el.pak
                        • Size 1.1MB
                        • SHA256 5e5f96c79a23c8c2a00efc76918594fa3c13d93d75effe5ff7df4cf78d820396
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        en-GB.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\en-GB.pak
                        • Size 498KB
                        • SHA256 2565bfd2216dd922c6d099e276c9c098cbbc0bb65d089c191b253ba592e74cec
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        en-US.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\en-US.pak
                        • Size 503KB
                        • SHA256 b9a2cccc13d7dac53210e37248dd70df32dbec43bd33d2c663c6290155fb751e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        es-419.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\es-419.pak
                        • Size 606KB
                        • SHA256 6cee6e9e899e7ee46dfacfc21ef78533e1b98907570d82fd58f1065e1efb645e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        es.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\es.pak
                        • Size 604KB
                        • SHA256 cf47d64bad26d12f6f39f56c4cef093aaec2ee4a1f7b4e88f6b08d34034865bf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        et.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\et.pak
                        • Size 551KB
                        • SHA256 20c0c24314c9e49011220ab545441efdb49780d9966285e48c79a9512665b7d8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        fa.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\fa.pak
                        • Size 907KB
                        • SHA256 9f687b6e3ab82e33ac72f866c101558aa49923ac98ca6e49c0daf5d2220b130b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        fi.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\fi.pak
                        • Size 562KB
                        • SHA256 e8ee33a17b25b64ba25c55d688eabb90f49d8f3ca29daed0d54ef693bab9bca0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        fil.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\fil.pak
                        • Size 636KB
                        • SHA256 5c2ec565f41cf4b2664054d52dfdf8db1782a13b97b5e227917941e7c5ae8887
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        fr.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\fr.pak
                        • Size 656KB
                        • SHA256 a33c1812a95c46fd03317620211bf1f2212b6f089d2520df30ffb1c116de95b5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gu.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\gu.pak
                        • Size 1.3MB
                        • SHA256 89ce115c7b2c5c4eba2640fcd5b11355224e1faaf3950d7a16de203db4b8ae08
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        he.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\he.pak
                        • Size 796KB
                        • SHA256 e91cc42a2e369914e6bd3535b5c15bcc95334974b6a059c585b995ee92143df9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        hi.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\hi.pak
                        • Size 1.3MB
                        • SHA256 b7b9c280c81b6e3ee3e5a8f7884602814740cf72983faaa57b43f6e369b240b9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        hr.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\hr.pak
                        • Size 613KB
                        • SHA256 bb05be3c417bbda1662a5fbb0ad411e5016b5be59e28ce466be6294908c6c961
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        hu.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\hu.pak
                        • Size 658KB
                        • SHA256 484a56e14cd1fdc0933f6c1b94a57af6f5fd774c729e100f10ff3406740d5184
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        id.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\id.pak
                        • Size 543KB
                        • SHA256 91cb6812b4e995189b1e2b61ae0565b92dac4ab3c34efd6e0920591dc005d82a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        it.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\it.pak
                        • Size 596KB
                        • SHA256 a71cbb5cc0336c0732e9781e6965b9080ff2f160be1696724da27d78b470262f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ja.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ja.pak
                        • Size 727KB
                        • SHA256 30a10162ef5b90e31fe708e7de992622b659c13e5fc4b7c691142fb3d959cc7d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kn.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\kn.pak
                        • Size 1.4MB
                        • SHA256 dfb1512aff3d9622b8f46be89d05d7927a74b984eb0213e84f27d248f75bcee4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ko.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ko.pak
                        • Size 615KB
                        • SHA256 aa78a00d77318d70a356f83ee5e9a0cbd579a560f8b8ffd05f9959ecb965b6a2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        lt.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\lt.pak
                        • Size 666KB
                        • SHA256 3e9afca6cb3cf70dce1c3b5a0becd2714aab49c9ceb5bbec39f313a063fb3d05
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        lv.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\lv.pak
                        • Size 664KB
                        • SHA256 28115981e00562f3028fb55dc0ebf6d9d2bdf4735bb0d4d2d90aea589d24c822
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ml.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ml.pak
                        • Size 1.5MB
                        • SHA256 3415158190b1d8880811a4f54a3998fb1f3f9f71ed913e1d3452f15f1495facf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mr.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\mr.pak
                        • Size 1.2MB
                        • SHA256 c0b1cdf0bba3e2762fc5afc89ac7d443f53f6c1079f40b7683ceedbe2ba58e65
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ms.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ms.pak
                        • Size 571KB
                        • SHA256 cd9a68fc1b1348b29e6c43adf5c94b9f6238146b8ec7d551e1e1997ae1773e8f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        nb.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\nb.pak
                        • Size 551KB
                        • SHA256 40277ff47002ca9e7a64c692c2e6b39667bae45ea3a411daaba16cb892e8dad0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        nl.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\nl.pak
                        • Size 572KB
                        • SHA256 114a11236f70de85330ed374e9658a4dfd21721f7e7cee80e746451bc68a5250
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        pl.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\pl.pak
                        • Size 637KB
                        • SHA256 d5179295319698755b51af402731a34b75b32b76b99ad92640319b65c4c52992
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        pt-BR.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\pt-BR.pak
                        • Size 597KB
                        • SHA256 b111cb265d59d861c8dac2ec37733bbb2df6c923236c79d99452535215fef58b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        pt-PT.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\pt-PT.pak
                        • Size 601KB
                        • SHA256 252ae86b97ed89e0cac7b9f581dbbae78e7041b28dd6b8be836048ea905dafd5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ro.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ro.pak
                        • Size 623KB
                        • SHA256 5094807f7e9fa04fb9eeb451c09542587e48ec432dde00c13ed3135b72df2309
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ru.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ru.pak
                        • Size 1.0MB
                        • SHA256 cc4307b19d0832b86cff809367f23346e9da41e3fc1155aa723b29542aea015b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sk.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\sk.pak
                        • Size 647KB
                        • SHA256 12b0f67bff228cf65c6f9f5a410c0758e4d52f0cdb9abbd4dd9ef828f99e07c4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sl.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\sl.pak
                        • Size 620KB
                        • SHA256 bf4846b38adeae6794d2565faeee093e9ea77febe1c2db3ac18193cc1e0e8d2f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sr.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\sr.pak
                        • Size 956KB
                        • SHA256 ae56d881a0f06647dbfe173f3cabedc734a8353d6183099c734570276f38e104
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sv.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\sv.pak
                        • Size 555KB
                        • SHA256 5e44c6ff9d4f432696c747fda111a7ad99df0b818254bbf251e578952ae06d36
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sw.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\sw.pak
                        • Size 586KB
                        • SHA256 bd6ab24cd929d6809dca3ea0a5105cc567e9c9c2bf65f8814b480def6cf1992e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ta.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ta.pak
                        • Size 1.5MB
                        • SHA256 ca560534ff3ca837cbcbbfc240af7dae12a82466bc16e99e7b79376cd102e342
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        te.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\te.pak
                        • Size 1.4MB
                        • SHA256 11a1d2d935b401bc9b24f158774310d73c31b1616bacc61a054c7ef4661618b4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        th.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\th.pak
                        • Size 1.2MB
                        • SHA256 d8f5800cb99e227287bdbed8d807380185e20d166901917b6b58dedc5fdafbf6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        tr.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\tr.pak
                        • Size 597KB
                        • SHA256 71b1b037ab44e6ed3f954b2c6318063d29e708dd87306c9051f1e48e43714322
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        uk.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\uk.pak
                        • Size 1.0MB
                        • SHA256 fff206f5f631d0dda9579cf806cde4de5848a7474bb1ac2b1239ab967a8ca88c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ur.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\ur.pak
                        • Size 898KB
                        • SHA256 0f3cc59fd6c706ae8d84a0cc50301a4929ea1f0204ad5e48250f1a354d6613e7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vi.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\vi.pak
                        • Size 709KB
                        • SHA256 f7df08dbb5ca133109ad809bdd89be82cc956a0518e6dee7e02fe4f65118d77d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        zh-CN.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\zh-CN.pak
                        • Size 508KB
                        • SHA256 e27395a6c73ac592f05e0de00f4c17efe181a4900c1f649e69d3a21dbb87cde5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        zh-TW.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\locales\zh-TW.pak
                        • Size 503KB
                        • SHA256 aee4d9c6230c5ae8257fecbccaba6b8668e5a34d6c44ef06e4574e12fed7fd8e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        owutility.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\owutility.dll
                        • Size 2.8MB
                        • SHA256 4b75969f28449b0a1115fafccf7b9bb26042d45c48e6bb7f829329caf2ccae8b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        resources.pak
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\resources.pak
                        • Size 5.8MB
                        • SHA256 71b305ddcea5bbe169b1fc1b7b7c039431da46e6fbdf9abb1e55848582859491
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        app-update.yml
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\resources\app-update.yml
                        • Size 133B
                        • SHA256 d7358a93f52b95baa21cd49d81bf22c3edcc2169f9d1728dd70a7af0af212f4a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        core_module.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\resources\binaries\core_module.exe
                        • Size 44.9MB
                        • SHA256 aefecb82a7493a420f5a6cd787323c6f5a47ea818cf09067ec5f253e94aadab9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        elevate.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\resources\elevate.exe
                        • Size 115KB
                        • SHA256 15f2fbcc376f78b61f927660810f66a476b2deb378270eaeff77993c9c1b0605
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        snapshot_blob.bin
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\snapshot_blob.bin
                        • Size 314KB
                        • SHA256 f5799826224d193037fb019e793f4e3cb03c28d18d25948239bf45fb0e640171
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        v8_context_snapshot.bin
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\v8_context_snapshot.bin
                        • Size 683KB
                        • SHA256 9537f5ad5847faf38a7030e0688b2b77d1582d196c034a9f2d5f19038f11b813
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vk_swiftshader.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\vk_swiftshader.dll
                        • Size 5.3MB
                        • SHA256 a52712b9545687582f8160013a03a6b362114a2579a0e4ad12f07a24a494fd81
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vk_swiftshader_icd.json
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\vk_swiftshader_icd.json
                        • Size 106B
                        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        vulkan-1.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\7z-out\vulkan-1.dll
                        • Size 910KB
                        • SHA256 d6222e3877379a4f967fc9a08286288cdbf3675cb94de474ef181a3b78e76daf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SpiderBanner.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\SpiderBanner.dll
                        • Size 9KB
                        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        StdUtils.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\StdUtils.dll
                        • Size 100KB
                        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\System.dll
                        • Size 12KB
                        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WinShell.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\WinShell.dll
                        • Size 3KB
                        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        nsExec.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\nsExec.dll
                        • Size 6KB
                        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        nsis7z.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nskC079.tmp\nsis7z.dll
                        • Size 424KB
                        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        default.exc
                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                        • Size 2B
                        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                        • MD5 SHA1 SHA512
                        Submit Download

                        data_0
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Cache\Cache_Data\data_0
                        • Size 44KB
                        • SHA256 142eb6763fc36cded647a1c91d3b7c4f5dfcb889eab80c9edd0a8d99c30bee6a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        data_2
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Cache\Cache_Data\data_2
                        • Size 8KB
                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_3
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Cache\Cache_Data\data_3
                        • Size 8KB
                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        Network Persistent State
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Network\Network Persistent State
                        • Size 702B
                        • SHA256 ebb581a4a4b8aa7965483fd12d6c3de4e7b99c7be3d6865556faa3cc2ea4d7ec
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        data_1
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Cache\Cache_Data\data_1
                        • Size 264KB
                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        CURRENT
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Local Storage\leveldb\CURRENT
                        • Size 16B
                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                        • MD5 SHA1 SHA512
                        Submit Download

                        Network Persistent State
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Network\Network Persistent State
                        • Size 59B
                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Network Persistent State
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Partitions\__owepm__\Network\Network Persistent State
                        • Size 196B
                        • SHA256 3affa42076b02185a6eb9ec02b9360e3451d200a964a91e406cf75a07052e414
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        MANIFEST-000001
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Session Storage\MANIFEST-000001
                        • Size 41B
                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                        • MD5 SHA1 SHA512
                        Submit Download

                        index
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\Shared Dictionary\cache\index
                        • Size 24B
                        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                        • MD5 SHA1 SHA512
                        Submit Download

                        gdl_conf.db
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\data\gdl_conf.db
                        • Size 252KB
                        • SHA256 24a964e4befb70d8b42a312740027132e884e3f47023f2491c856d2cf6622631
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        electron-log-preload.js
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\electron-log-preload.js
                        • Size 987B
                        • SHA256 bdc6bdfc1a4c4c42b430a4021b073b8e0c2c6a21bbac53a644b54ca2a7c47f52
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        main.log
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\main.log
                        • Size 1018B
                        • SHA256 f5c46ba65bd88fe29b534b25065627d659d1dd139c53a1ac79136b2cc3896195
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        main.log
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\main.log
                        • Size 1KB
                        • SHA256 0ef2a3d8c468ab53e06cb8f61512e1a94d4348aa4d09001feaa80610df582216
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        main.log
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\main.log
                        • Size 1KB
                        • SHA256 eabb22c8b1aec659fcb2d265b1e7d4fcfc2056949e9578cc1f43a4fa71e62222
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        main.log
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\main.log
                        • Size 2KB
                        • SHA256 00a264d6f52f3c40e0cc8f1dd099044d1158f1a4280e38e699f7fcfe9f199330
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        main.log
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\main.log
                        • Size 4KB
                        • SHA256 ae67891fa2210aa6feebb980421271416e41de9c24bc14380da267658c18b57f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        scope_v3.json
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\sentry\scope_v3.json
                        • Size 11KB
                        • SHA256 b3d71634f571017324f5e4059238e6fb0a2b1c25e7cff668b986022e38929368
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        session.json
                        • Path C:\Users\Admin\AppData\Roaming\gdlauncher_carbon\sentry\session.json
                        • Size 271B
                        • SHA256 ed6c3f3f9c05f499cd86429b32b812c95049e0d8045bc5a042686b9c6e9a601f
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        GDLauncher.lnk
                        • Path C:\Users\Admin\Desktop\GDLauncher.lnk
                        • Size 2KB
                        • SHA256 8ec77f19feb91e6cbc4f83b2e4def6080815d2b6b9a0c6fec33396a3236030d9
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/1364-850-0x0000022338E30000-0x0000022338E31000-memory.dmp
                        Download

                        memory/3128-1157-0x000001CC616D0000-0x000001CC616D1000-memory.dmp
                        Download

                        memory/3128-1149-0x000001CC616D0000-0x000001CC616D1000-memory.dmp
                        Download

                        memory/3128-1153-0x000001CC616D0000-0x000001CC616D1000-memory.dmp
                        Download

                        memory/3128-1154-0x000001CC616D0000-0x000001CC616D1000-memory.dmp
                        Download

                        memory/3128-1155-0x000001CC616D0000-0x000001CC616D1000-memory.dmp
                        Download

                        memory/3128-1156-0x000001CC616D0000-0x000001CC616D1000-memory.dmp
                        Download

                        memory/3128-1158-0x000001CC616D0000-0x000001CC616D1000-memory.dmp
                        Download

                        memory/3128-1147-0x000001CC616D0000-0x000001CC616D1000-memory.dmp
                        Download

                        memory/3664-627-0x00007FFEBE2F0000-0x00007FFEBE2F1000-memory.dmp
                        Download

                        memory/3664-628-0x00007FFEBDB70000-0x00007FFEBDB71000-memory.dmp
                        Download

                        memory/4092-874-0x0000026412610000-0x0000026412611000-memory.dmp
                        Download

                        memory/5048-1234-0x0000017684680000-0x00000176846A0000-memory.dmp
                        Download

                        memory/5048-1195-0x0000017684210000-0x0000017684230000-memory.dmp
                        Download

                        memory/5048-1194-0x00000176843D0000-0x00000176844D0000-memory.dmp
                        Download

                        memory/5048-1188-0x00000176801E0000-0x00000176802E0000-memory.dmp
                        Download

                        memory/5048-1193-0x0000017681FD0000-0x0000017681FF0000-memory.dmp
                        Download

                        memory/5248-862-0x0000020C1CB60000-0x0000020C1CB61000-memory.dmp
                        Download

                        memory/5628-815-0x00000246252C0000-0x00000246252C1000-memory.dmp
                        Download

                        memory/6012-826-0x000001DED4690000-0x000001DED46B4000-memory.dmp
                        Download

                        memory/6012-818-0x000001DED40C0000-0x000001DED40DE000-memory.dmp
                        Download

                        memory/6012-751-0x000001DED4450000-0x000001DED4498000-memory.dmp
                        Download

                        memory/6012-819-0x000001DED44A0000-0x000001DED4552000-memory.dmp
                        Download

                        memory/6012-822-0x000001DED40B0000-0x000001DED40BA000-memory.dmp
                        Download

                        memory/6012-823-0x000001DED4690000-0x000001DED46BA000-memory.dmp
                        Download

                        memory/6012-724-0x000001DED3FC0000-0x000001DED3FE2000-memory.dmp
                        Download

                        memory/6080-838-0x00000230C0810000-0x00000230C0811000-memory.dmp
                        Download