bb0ac5d11db7c4d1816e3bf0ccd55c066b8087f7a651912a4d9575e919b1a903

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 11.3MB
Sample260802-2y95csha49
SHA256 bb0ac5d11db7c4d1816e3bf0ccd55c066b8087f7a651912a4d9575e919b1a903
MD5 b85d53ca44bb3c957d486a17a7fb342a
SHA1 f350e95a9fdc288a58d6d651c07326237663c203
SHA512 443a4c9a887408cb19e62856a3622b9231353d1c5aff8eb502c41e29133c96392da473c58fd68b3cb7b9266e8735d459c73305aa404483cf4b57c25254dd1bca
SSDEEP 196608:PFv/g29JBwHTcaJ9tnTXXJ1SLXPDx4c0pCtY3M:Px/g29jy37tnTnJ1Srt4jpD3M
TLSH
T1D5C6DF03F695C0FCD0ABC076C2569673EA32B88D4925B39F07E01E011F66F526B6D79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3248	javaw.exe

Loads dropped DLL 64 IoCs

pid	Process
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe
3248	javaw.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Launcher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Launcher.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438\Blob = 0f00000001000000300000003f13d09d3d9c0e34359655f0e5825a21518c69617ac82a5c65d17cfe8e8958df5d328ac40821fb5116703b7601e9abfb0b000000010000005c0000005300650063007400690067006f0020005000750062006c006900630020005300650072007600650072002000410075007400680065006e007400690063006100740069006f006e00200052006f006f0074002000520034003600000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c06200000001000000200000007bb647a62aeeac88bf257aa522d01ffea395e0ab45c73f93f65654ec38f25a06090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000005673586495f9921ab0122a046279a140158821491d00000001000000100000001e1771e068b859b9d2e89ea3a6db0e28030000000100000014000000ad98f9f3e47d753b65d482b3a45217bb6ef5e43820000000010000008e0500003082058a30820372a0030201020210758dfd8bae7c0700faa925a7e1c7ad14300d06092a864886f70d01010c0500305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a028202010093bed5365275d80123a01c474249ee63b6b721fdc495d5482b267c145310da79fd2bb72da4d42cfaea32dd49c2b9bd0f483d7b5a9854af9e5d31744f07fc5021dda4cf684f1b12636d25994c2a99f3483061fa817c1ea7084adc3e2b1c1f184c71aa358cadf86ee83b4ad9e59402d6898413aa6dc84f33cc5096379233dc5f88e79f54d948f09843d666fd9f173843c501510bd7e3230f145d5b14e74bbeddf4c8da0337d1d639a121513083b06dd7304e965b91f07024abbf458164430dbd213a2f3ce99e0dcb20b54227ccda6f9bee64309039cd9365812131b52350333722e338edf83130cc45fe62f9d15d32794287df6acc5619404dceaabbf9b5764994f127f891a583e506b3630e80dce0125580a63b66b439872dc8f0d0d114e9e40d4d0ef65d5772c53b1c47569de2d5fb81618ccc4d8090345bb7d71475dcd804489fc0c12888b4e91ccaa7b1f156b77b494c59e52015a8840229fa3894699a49068fcd1f791417120c837ade1fb197eef9977828a4c84492e97d2605a658729b7913d8115faec538623468b286308ef890619e326cf50736cda24c6eec8a36edf2e699154470c37cbc9c39c0b4e16bf783252357d91280e549f0750fef8deb1c9b5428b4213cfc7c0affef7b6b75ff8b1da01905abfaf82b8142e838babbfbaafd3de0f3cadf4e979729edf31856e9a596acbdc39098b2e0f9a2d4a647437c6dcf0203010001a3423040301d0603551d0e041604145673586495f9921ab0122a046279a14015882149300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201002f5c993cfc065e8c942e70ead232318db4f051d5bc0af3649f075ed5c17368647aa2b90ee8f95d852da83745aa28f496055060a9497e9fe29936291344476a9d55203cd89bf10332bada40a173ea83a1b744a60e99019be4bc7fbe13947ecaa61e7680363d84068b3326656dca7e9efe1f8c58387b1a83b10fbc1711bbe606cc63fa81f2814cda0b106ba1fad528a5cf064016ff7b7d185e3912a4539e7e324210a62191a91c4e177c84bc9f8cd1e8dfe651b936473f90b9c7bc02dc5b1c4f0e48c125839c0a3f9eb10333121a27acf7226c24d10141f85803fe2568221f9a5a3c7c6c9e7548f381f166676e4c82c0eeba570e18ef2e9af712d8a06be905a5a1e968f8bc4c3f121e45e852c0a3bf122779b9cc313cc3f63a221603a0c98f66a45ba24dd6812506e976a4000a3ecbcd359be0e138cb6053862842411c4457e8a8adab45e32510bcdb3e6541fb1ba6970febb97479f91ebc1d570d47afc32f9f8746a7eb265a0f5663b562606e00fbe3271122e7fe998f34f5b9e8c39172bdd8c31eb92ef2914451d057cd0c34d54821bfdb13f166254352d2702236cd9fc41c7520ad637263060f0e27ced26a0dbcb5391ae9d1767ad15ce4e749492d553768f01a3a983e54178754e9a62750897b202f3fffbfa18b4a4798ff2b7b493ec32946601842ab3329bac029b91389d3888a39413bc9fda6ed1ff46063dfd22d55018b	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438\Blob = 190000000100000010000000d21153f3125a7dbce915d41563f733f40f00000001000000300000003f13d09d3d9c0e34359655f0e5825a21518c69617ac82a5c65d17cfe8e8958df5d328ac40821fb5116703b7601e9abfb0b000000010000005c0000005300650063007400690067006f0020005000750062006c006900630020005300650072007600650072002000410075007400680065006e007400690063006100740069006f006e00200052006f006f0074002000520034003600000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c06200000001000000200000007bb647a62aeeac88bf257aa522d01ffea395e0ab45c73f93f65654ec38f25a06090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000005673586495f9921ab0122a046279a140158821491d00000001000000100000001e1771e068b859b9d2e89ea3a6db0e28030000000100000014000000ad98f9f3e47d753b65d482b3a45217bb6ef5e43820000000010000008e0500003082058a30820372a0030201020210758dfd8bae7c0700faa925a7e1c7ad14300d06092a864886f70d01010c0500305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a028202010093bed5365275d80123a01c474249ee63b6b721fdc495d5482b267c145310da79fd2bb72da4d42cfaea32dd49c2b9bd0f483d7b5a9854af9e5d31744f07fc5021dda4cf684f1b12636d25994c2a99f3483061fa817c1ea7084adc3e2b1c1f184c71aa358cadf86ee83b4ad9e59402d6898413aa6dc84f33cc5096379233dc5f88e79f54d948f09843d666fd9f173843c501510bd7e3230f145d5b14e74bbeddf4c8da0337d1d639a121513083b06dd7304e965b91f07024abbf458164430dbd213a2f3ce99e0dcb20b54227ccda6f9bee64309039cd9365812131b52350333722e338edf83130cc45fe62f9d15d32794287df6acc5619404dceaabbf9b5764994f127f891a583e506b3630e80dce0125580a63b66b439872dc8f0d0d114e9e40d4d0ef65d5772c53b1c47569de2d5fb81618ccc4d8090345bb7d71475dcd804489fc0c12888b4e91ccaa7b1f156b77b494c59e52015a8840229fa3894699a49068fcd1f791417120c837ade1fb197eef9977828a4c84492e97d2605a658729b7913d8115faec538623468b286308ef890619e326cf50736cda24c6eec8a36edf2e699154470c37cbc9c39c0b4e16bf783252357d91280e549f0750fef8deb1c9b5428b4213cfc7c0affef7b6b75ff8b1da01905abfaf82b8142e838babbfbaafd3de0f3cadf4e979729edf31856e9a596acbdc39098b2e0f9a2d4a647437c6dcf0203010001a3423040301d0603551d0e041604145673586495f9921ab0122a046279a14015882149300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201002f5c993cfc065e8c942e70ead232318db4f051d5bc0af3649f075ed5c17368647aa2b90ee8f95d852da83745aa28f496055060a9497e9fe29936291344476a9d55203cd89bf10332bada40a173ea83a1b744a60e99019be4bc7fbe13947ecaa61e7680363d84068b3326656dca7e9efe1f8c58387b1a83b10fbc1711bbe606cc63fa81f2814cda0b106ba1fad528a5cf064016ff7b7d185e3912a4539e7e324210a62191a91c4e177c84bc9f8cd1e8dfe651b936473f90b9c7bc02dc5b1c4f0e48c125839c0a3f9eb10333121a27acf7226c24d10141f85803fe2568221f9a5a3c7c6c9e7548f381f166676e4c82c0eeba570e18ef2e9af712d8a06be905a5a1e968f8bc4c3f121e45e852c0a3bf122779b9cc313cc3f63a221603a0c98f66a45ba24dd6812506e976a4000a3ecbcd359be0e138cb6053862842411c4457e8a8adab45e32510bcdb3e6541fb1ba6970febb97479f91ebc1d570d47afc32f9f8746a7eb265a0f5663b562606e00fbe3271122e7fe998f34f5b9e8c39172bdd8c31eb92ef2914451d057cd0c34d54821bfdb13f166254352d2702236cd9fc41c7520ad637263060f0e27ced26a0dbcb5391ae9d1767ad15ce4e749492d553768f01a3a983e54178754e9a62750897b202f3fffbfa18b4a4798ff2b7b493ec32946601842ab3329bac029b91389d3888a39413bc9fda6ed1ff46063dfd22d55018b	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1956	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4140	Launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3248	javaw.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 1956	4140	Launcher.exe	89
PID 1956 wrote to memory of 4620	1956	msedgewebview2.exe	90
PID 1956 wrote to memory of 4348	1956	msedgewebview2.exe	91
PID 1956 wrote to memory of 4348	1956	msedgewebview2.exe	91
PID 1956 wrote to memory of 4348	1956	msedgewebview2.exe	91
PID 1956 wrote to memory of 4348	1956	msedgewebview2.exe	91
PID 1956 wrote to memory of 2896	1956	msedgewebview2.exe	92
PID 1956 wrote to memory of 4760	1956	msedgewebview2.exe	93
PID 1956 wrote to memory of 4760	1956	msedgewebview2.exe	93
PID 1956 wrote to memory of 4760	1956	msedgewebview2.exe	93
PID 1956 wrote to memory of 4696	1956	msedgewebview2.exe	94
PID 1956 wrote to memory of 4696	1956	msedgewebview2.exe	94
PID 1956 wrote to memory of 4696	1956	msedgewebview2.exe	94
PID 1956 wrote to memory of 4696	1956	msedgewebview2.exe	94
PID 1956 wrote to memory of 4696	1956	msedgewebview2.exe	94
PID 4140 wrote to memory of 3248	4140	Launcher.exe	98

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Launcher.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4140.5160.6367998001679486835 /pfhostedapp:c269087d5c212e293806036c6e2b63a1d0a9acec
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView /prefetch:4 /pfhostedapp:c269087d5c212e293806036c6e2b63a1d0a9acec --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffa4c2b5fd8,0x7ffa4c2b5fe4,0x7ffa4c2b5ff0
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView" --webview-exe-name=Launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1704 --field-trial-handle=1708,i,674296039250937515,1357508138612733939,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:c269087d5c212e293806036c6e2b63a1d0a9acec
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView" --webview-exe-name=Launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1708,i,674296039250937515,1357508138612733939,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:c269087d5c212e293806036c6e2b63a1d0a9acec
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView" --webview-exe-name=Launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2420 --field-trial-handle=1708,i,674296039250937515,1357508138612733939,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c269087d5c212e293806036c6e2b63a1d0a9acec
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView" --webview-exe-name=Launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3124 --field-trial-handle=1708,i,674296039250937515,1357508138612733939,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c269087d5c212e293806036c6e2b63a1d0a9acec /prefetch:1
    3⤵
    PID:4696
- C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\javaw.exe
  "C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin/javaw.exe" -Dlauncher.noJavaCheck=true -jar C:\Users\Admin\AppData\Local\Temp\Launcher.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

+JXF10472267343917243901.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF10472267343917243901.tmp
Size 108KB
SHA256 91a58fc70179ec6243c958f67042b0e2a4e447ca89afbc29ba1e270f1047a3b1
MD5 281df342e6f73c20ebc6526f130e00b3
SHA1 160e0e5a1010cd45ea124f08a894156e02236551
SHA512 5bbda3d2240f15c9eb53a42b0fb73b8938c946b454ce8c93ac557a568e4f18d5fa284f76f31b4b75be33f2d6c84f8d251e7644efe99d269d8a06bc8c26092867
SSDEEP 1536:GdUXZs3Yaa8X0lLhLSZB/HBrhBOYhCRwzPP7ODiBsqShNpCqu5f:GdebaVklVqB/HBrhBOx+n7O2Bw/gquV
TLSH
T1A2B33A57E392C7C6CE0B5CF95261D3A41FF97C38993DC15FA8B3A8BAE8AB5410C21508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

+JXF7683052137381979164.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF7683052137381979164.tmp
Size 108KB
SHA256 6bebcf9adcdbcb063954a41eb5751ac782b30110888ec9658066e786995fac8f
MD5 53f695dbfc6f703f86ed88bddde527b6
SHA1 fb5a258452921a7f710d1913777ae6f48a0b6089
SHA512 594c67612e7188423165a907797e490b735683e62757257089c77a853daa71314239ce6a048bd11ba4a2da8531917ed439c89eff37d5b3dcbd3bd83f5b47e45c
SSDEEP 1536:J3GmydXDNYa60lLhLvzrfuQnP7GXGlRHxCiQ7U:J3GoaplVbzrfRP3lRHqg
TLSH
T1EBB33856E382CBD9DE4A9DFC7231E7501FB97E38583CD24AA8B2B97BE65F5410C20205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8c568036baef65101d044cad3167c749b7265a99b4ce5272f848a5b8ef2e7e42
MD5 34138b812a03dbb06d231d3c9e5991aa
SHA1 d016de06f439f559350daf5194955a47fb5e496e
SHA512 701b5d0aea8b75533618830c3957a9e2c93da5f3ef4588fb6a4f3f67f9ddd934cc3d9e69396d6089eeb684aac95a4624549caf4d2bc58f4bcc9dac8b09936586
TLSH
T1BED01213330105B4C0502473112362891814C22F400A80049429D55E2A080500D52851
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 88b4ed74fec7565d7aa21d560dfefccc4b99d708d69c0b60dedadb8250ffd2ab
MD5 8e9c17f63f07772a2fe40020039946f9
SHA1 9e96d43ec789cb9523278782665f602a628cca03
SHA512 959243ae89d80344815d582e25974911d8b4a13a5a9ae60c47be29a65a073e5b2d5c8c97fa94e0765193f90883372c5e9647a5ddfb5fba604602da8a2ae9d131
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

268c20aa-dd7a-425b-a178-93f4d9ca40a4.tmp

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\268c20aa-dd7a-425b-a178-93f4d9ca40a4.tmp
Size 4KB
SHA256 c861c65033d30290b4be2d85f032325f039b0bff29a113741cf2c0c452a8d990
MD5 5959d5f0dd8d37043518cd489136570e
SHA1 e1a9571141fc18e2277a30615881e650fc83fb04
SHA512 cfd10719f14889885fc44612d98118f944793a19f7fc549120efea0b5303623ecbbccfbdf4bf1c2de3121d5cd257b39c3669356645b122bdd41b368bc1403093
SSDEEP 96:std5W3mqL035h16ZZs7/x+6MhmuecmjewSK+gO428XMZCB:stdsjg3+sV+FijLNG8
TLSH
T1FEA198025F28797B4CC7E2197E357E42E2F9107235D51A58EBF8865C089A5DD221390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 258c641873cfe1b8615cdd024998a0ccf6d73a990f3831a545cd2f33aac63b74
MD5 8c39a06d79c3589017678b881fa5140c
SHA1 3aecc80d60c4830274dd30c997fb9ea7cc487b58
SHA512 a23335ea84e04afdf7987d4dc88d871dc45347b2e66fdc589b5f8a0cfcb79130bb9d4320df4b4a1b64bacaa0aa9506419bde66b1fbc499f394a1b11a2ec98917
SSDEEP 3:MsEllllkEthXllkl2zE/l9:/M/xT02z8
TLSH
T1A24404147FC0044FC511113040D1D7501370D4104773F74374510477DCD57400D50100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa818.TMP

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\Network\Network Persistent State~RFe5aa818.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Local State
Size 2KB
SHA256 3b3946a5a1454ea06d935b9a954d4375ab22c48e2ba4d59d6f5bb38c0493745e
MD5 6f3d015719e0d55a530382625313d007
SHA1 0c4c08094da4fb34d8c17fbf3e5ac0e78a550756
SHA512 d799b1890e05da7482974137756f5092413855afc301dc13a2aaf221ec872d4b77fd22015c1fab72ac8cce1408cb4970382c2b4dc5b04982cd9185cb52271812
TLSH
T13351B8736820AB77CEB64605784A3F23CF7D9166D6526F60DADD1B0804DB66C2382C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Local State
Size 15KB
SHA256 eaf7bfe67b15383ab32f47a5bde94750b8a40d2bedb278324e53e3be7b05da38
MD5 045ef69964ca06f4aa28ac7c8a5b9059
SHA1 6b5b387adf045a4e7420ae01be845fc4e786161a
SHA512 e568c037a4fa7ca7eeb0ef86bd07a2e6a4d853b77a4322ca38fabf75558d22ed29c6b58a149773335a193014af8f8703c432c88bafc3b64d5ef82a53b33c94b8
SSDEEP 384:m+aQikB+z/xvxjg/qhEPNBSNsda4dVlM3em9zs:x/UxvxjgC+a+a8lwRFs
TLSH
T12B72AF2B58787D2396F3E9057949174BCFBC987290C17EB44EAC5F0A0ADB7D80342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Local State
Size 3KB
SHA256 bc0376678bf8949629c087f77e29891df1ca9c0c9c55955c57d25ee04bf0d74a
MD5 5edadb7361d5edab8cbb5380500a5b56
SHA1 3139b2e1e993129b7dd499567ee7016548790b24
SHA512 5a0edd28e58042ac394d4601584dc6944fb57c83ede6854f67a358461d91e8aabc003e95f00d05aaadafd4bbf4e0d39e4f7a972e42595f0578f26cdde19df157
TLSH
T1CC61B9766930A5378EF39A05B8863B16ABB95027D5917FA4DAEC1F0C04DB39C1381C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Local State
Size 17KB
SHA256 e41ef5547b6811590ce0b78a1aff7ea2b3a9c53ee31bdc18989862d93a2e67bd
MD5 14242f9f742cc978015e9955700fb027
SHA1 9053c64a0e6dda09a40218ca64829aa82ed5fd02
SHA512 1a73d6bb0e91c9d77122858bc3d91b7d806b71a0eea631faedff2039e6da1c24112e6338c6aa1663cd2b617d55dbdfe9793b9e946ba4a88bbb42e1f4d0feba1d
SSDEEP 384:O+aQikB+z/xvxjg/qhEE3NlNsdz4cxoVRM3em9zs:Z/UxvxjgC+Ep+zv2RwRFs
TLSH
T1D3729E3AD864BA2799F3E645750A678BCFF8556290C16EE44DEC2F0D0AC77DD0342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59791e.TMP

Path C:\Users\Admin\AppData\Local\com.gravitlauncher.prestarter\EBWebView\Local State~RFe59791e.TMP
Size 1KB
SHA256 5a541feb35645dab6b235981f313084ded615f0044806a226009a79a2c95f30d
MD5 c6e788d54088ea36b911e098dd52e225
SHA1 53e1d1d005534fb3df5c152857c3866e46804236
SHA512 0d8e8c7b153f6fe351d6b6bc27df6eb88c1d3d7ef2684b485c28f958acd0a373d87673751b3782e26bb8d456a475b3bc367252ebc0809f1dd3d7e51e8fa59689
TLSH
T12921B7F2D4305733ED55124770023A6B9F74606BC211CF40B5CE5B09099A5ACA7BAC33
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\VCRUNTIME140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
TLSH
T174936C4677A542B7D06AD278C2E35A06F770B844877063CF03B64AA94F23BE19E3E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 cb3f7b194d220004ffa6eef1305849bcef38033c49cb1b16c5ab3c3d60bd9d20
MD5 93b762fed6eabf7be765a190e2cec0ad
SHA1 05a80f2df21b73c859e133d78a93a0ae54a3aa95
SHA512 99b493ffef75d55437a3b547c3f489c59ae8d3c3b96b171d932d06fe223b479422cea9cd6de54928bdbcc87f03434ea146337668e8fd68b1f292e77dfbcb8b93
SSDEEP 192:nFOhgWRhWhnQWJ7KXHVWQ4mWrUCxgV8FGecX01k9z3A0HkNVWPG:nFJWRhWxGXHHHR9zzHIqG
TLSH
T1B1A21A838EF85502F99AACB006E8D5537C3DAFC75940E16922A9F11C18E73D0EB14B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\api-ms-win-core-console-l1-2-0.dll
Size 21KB
SHA256 10fcfff7576ee04217b535a62c36b7f844e7af1684ab6adfc33112fffc6495b8
MD5 ee94db52dd6a765eab7b7c3521a96dbd
SHA1 3ad2b73ba419711f809ca67f3bc495bb455c7624
SHA512 a1c91c35115dfaf6907a82bdb11af3bf44d950a1f0888b4cc452c97e0251623fec15d979f3237894acd36ae8ddf48e384dbbd6cd0c1c4f8c4a4fddff9131fbb0
SSDEEP 192:yGWRhWql5W+VpKKVWQ4+WG1RfpF+nasu+JX01k9z3Azs3wdW:pWRhWq31fpUad+JR9zus3wdW
TLSH
T152A21AD38EFC9043F8AAAD701699C9437C3D6F9A2501A05A65E9F25C2CE33C5DB2072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 2161c0add0ee0a312e12d0346a1b24b6e5e1356a5a7e264911650a8e1d017e1c
MD5 9c145aa4eb0f18ad768988612cb56d03
SHA1 e4f41a8e6e731df9a14ee2217612095ed7f3449a
SHA512 4e8aa7cc1996d75d5a85b3b5a4f2101650f3654bdd31e374257faa314f630553d497ca8347745945887bf3bf173463c167d310129d1bc1d0f9df8c0d8fc5a544
SSDEEP 192:IWRhW85W+VpKKVWQ46WGufYKKWDKHjj3SX01k9z3A6okUm:IWRhW+U+Hj+R9zahm
TLSH
T19EA24B939ABC9047FDABADB052E8DD437C3D57DB5D50A02606A4F1482C93785EB10B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 cf7dc6f5abe58e31b41912b4a84cabd106eecf7cad7f5a1942c4befaca703536
MD5 6f5c5015c4e74602f582c21f54cecbec
SHA1 499e6c2b6614f02b6eb347980822967f5ecf8d71
SHA512 9d064c3dbe12386fac41bde379d378a81f77ed44ebd441089b42329438953a08d41eaf9d11d4f7e1df81aab29b87f70deefcf5d2e70f4ba4d487dab49eb3b3f2
SSDEEP 192:8WRhWTWJ7KXHVWQ4mWPFuKQTb8o+X01k9z3Ax/tDxd50:8WRhW9XHUI+R9z2/D0
TLSH
T1C5A23BD2CABCD183FDAB6C7052E8D9837C3D67D65950906A1AD4F4482C933C1EB20A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 41dd8451c6b25a7a924a7a42a3d466350bcd2820fca4177ef5f6305e6eadb97a
MD5 a3d85e6ac7c84d25e288bead48197b9e
SHA1 9118b030e65e185d9310d4304f97baa01fd963eb
SHA512 e8df636bcdf42adabee1dc33dfdb9e17b9e9f126c0769fba0b4e6e11579908fa905144c3782f96259589ecdde5e929dd3d13f47fc3e3952fa713fb73285e6053
SSDEEP 192:dGzmxD3T4q/WRhWpWJ7KXHVWQ4mW4wxgV8FGecX01k9z3A0HkFEVgzR:kzQZWRhWrXHJHR9zzHPQ
TLSH
T1D4A23BC28BBC5043FDAB6DB002A8E6537C3D6BD65D40906A15A8F51828973C0EF20B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 a198091842029a252e0112120b93bf7323b04ed647a3d2bd27fde72637385a7b
MD5 de7b537e3ad4bbd23bc1aa1461da7893
SHA1 36b23a5889358108e9c5723aa2394da62975ca4c
SHA512 cef2c7a73a9948538d27fd4724f66760bda2788f8f2e23d9437d9460452e9f898603d7a8d705f7b67ba96a5bedb4d11c8e9870f548bb169be8975453fdc10d5a
SSDEEP 192:KaNYPvVX8rFTs2WRhWv5W+VpKKVWQ4mWGW18Mf0H+BEg7X01k9z3AAOTx94:QPvVXAWRhWZkfTR9zfOVu
TLSH
T1A3C22C83D9B4F24BFDCEEE715196C8436C394386042450861BD8E79C3CE738AE7986AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extnet.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\extnet.dll
Size 24KB
SHA256 f29d19518eebbde879c028306fa240bbbc39400c16aeec45aa167df185806511
MD5 63be19920e71f1a4c44cb3338130264d
SHA1 e74893464b0790fe9fe936d193f27178d2407010
SHA512 948c86f42ac28c5b895f6ad9d170cc9c2a11ea52a828feccf9c1f88137af9ba8e367f10a1321ddec6705d199dffef6770f9b38c9d804f23a16e409fddda2ab40
SSDEEP 384:iwcAduLfSA7LAGrwgNQjUepwKANynsykmL4/y8RgZpd4Yh:GLn7zNQYyVLk5ehh
TLSH
T17AB28F4BEB5048CAED67887064DA0B17ED71B7203BA1A6DB0324D1184F763D23B6D75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\java.dll
Size 114KB
SHA256 1d576a2a4743a539fb1e3335dc1679431834cbddf775b98922facb39d9350568
MD5 1695e5e564447fa09bfaa5c824a5feb7
SHA1 5f5b6a9dde4bdf1657ce2b91755f784c54e36fa9
SHA512 3ca26d39654a5a294af8fdf99659bc2567296c9bf2c3d32d7db8d3b96c249c3c2d0e0eb40687ccceb257cc40765f886a67dba9ec024fc9644736ebf3d37dc400
SSDEEP 3072:V7DJ7kUD/qh/QMF9ryNGebL8J+rV0V9rIB/FbBJKNVMyp:VXJA7+cOyp
TLSH
T110B34C1B771A8095F45AAABCC0664E0BD373B4711241E70E03B6CA9E9F8FB713D19792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\javaw.exe
Size 49KB
SHA256 2bd7b24e7f3e425e4a79d7bdd5128c3bb8182adacda7fabbdd7b425b2d06cd0a
MD5 1905d71b0495efbc5282e2f92d9bae29
SHA1 c16cf97ced2f12a139cbb75de61d5c4653703587
SHA512 47f4110d07d5ce975a058d9711e35b16c5a2100dfbf43cc4178036ffe3070b9053d092387c5bda0f578bd597435261f69eb55cae39e0d6f79137647d8281dde4
SSDEEP 768:vPh32lM5R2TyJ5R3s8D/bkt5Ruz3Vb3hd5SyVLk53:3hCM5RdJ5R3sozkt5RA3hd5SyM
TLSH
T1EF337D47AA043C82F42F84F158A7392655B4BD132BD176FA7DC6B21E4C70392582B6DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\jimage.dll
Size 33KB
SHA256 7e5512a16db2410869b83b69e651e76fc739da4a661b5b10c355d44396afb89d
MD5 b44bc9a4463fb6a4974ea10f746bc735
SHA1 bf6a2b2ef1a5fb793d76940ec34a7de36a9cfef5
SHA512 f03ccfbef43335da059e3702585ed45e6b9b746ef770ae12477ecaddc21a295fc3042bab38e4c6c1c944ce7c70730e06ddd5ba8352fcd52422d2e565ec7a1814
SSDEEP 384:qzQ4ilKszr7Z1V+uJq2i9OLyOv6X1ipGv5pZchqpwKANynsykmL4/y8RETvlQ:CCn7Z17J29uyOv6XE8v5pZcZyVLk5iK
TLSH
T19CF28C17AB905896EE56D538C4DB4E2BEAB2F9626F5183CB0721424E0F733D12B2D317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\jli.dll
Size 82KB
SHA256 99f7b71d1cb5715942735c30112cdab042aa3e0ba31be7734958ebd1388ab96d
MD5 a802860196d32a86e50295163fb08acd
SHA1 35bd4645d3370b31fbbb85e74098e32cedfc16ac
SHA512 40e1ea15d569ab33c498efb96d1c628906d7916dddd712fd46aa5dc71bc3c5585e7dc7c8461fcc779c2b337662a699eba5602788ef6e76f67bf575a0fdf0c537
SSDEEP 1536:2BpUsDOFdbFvcBOQvhLTjcx1oHOz5IOrOt6tWDy0C:2tQbFYOUhz01oHOzTrOEtWDy0C
TLSH
T17E837C9A539021F1DEB38478D5B45A0FD3F2B0263761834F13AC85AA0F636A53E197DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\management.dll
Size 29KB
SHA256 317f24ccbb13d64ec472e170fbb64409a7f9be3eb4e0c60ffb40af09900858f3
MD5 fd718d2e8237a53ceeae1c6de14a4e24
SHA1 aba6abca43f9cfb3aa327c0c926ee88d437e9e64
SHA512 ef6e5010d3ccbb8e83f91decdbcda3d3efcefcf9dafffc2d9f0516063f9292d8b807f9e28d25bc864be2a00877f8f8ae734b9be46732e5192a81fff0ceb985d8
SSDEEP 384:VyEzgoxDAAQNQz2V50yAg2tPlJpwKANynsykmL4/y8RtT8j:VD5xDkNmS56uyVLk5y
TLSH
T15CD22C16B76C6441E5DFB47570D00A729AB3B6912F81238706B4C63C4EBBFE6363817A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management_ext.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\management_ext.dll
Size 35KB
SHA256 dec44b3fb6897da1bde308ddd7e1d5535b12a272e8293b06a63196dc46017682
MD5 c0674a4c97b7345acab839114f31a5cc
SHA1 68fd1aecc537557ab9bd07fa3956538c7fa02136
SHA512 ff8df11d94f7d08bc9248074404d7e29f7fad50f2110e743f5ba065ae92322156a309b4149fb9088a7c215c1cbaa2a77e25cf8b8168ff8af076a71e30313d8ba
SSDEEP 384:rwBhTaC3yTC98ItQlvaI8raqkRat+emb0CV8YOdGtoz3VrpwKANynsykmL4/y8RY:rQaCCu9ZtQfGvkATvdGtoj4yVLk5x0
TLSH
T19DF27E17B7790482EC8FD4B9A0950B33D5B1752237A2868F43B0C61A4FB77A3362D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
TLSH
T1FCC40927B74D02A0E195A3B861C34305D7F1BC4A8312A3C752FAD66E2F6B7D5673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\net.dll
Size 58KB
SHA256 c677899b8b4801e7eba2109dd3d1ff1c0c53abec5779ad12f8009a3601e1e7ec
MD5 3c650e7c8ec71ffdf5300e09e3c07625
SHA1 6d1a75336b5dca6c7bddf534f150748d5377a759
SHA512 4b0a4e20946cbd017d23f9ea896300dd7e59aac0025f172d842613614bca495f6b38941de26cb8fbf8624bf1b9bc9d09374a4953d55b08d20c9f8935c6246cbc
SSDEEP 1536:GUy5c3ciAKSbAGq1HrOQ3ge6toud7NyHzX:hysaAhlD3x6toud7Nyz
TLSH
T164436D06A7E414D1F857CA7885A74E17C7B2B570231087DF4375C6AE6FE73A23629382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\nio.dll
Size 79KB
SHA256 b36401a691525f4ed00ee137685218270a5052a920b8a535a76abc8c4cef6a71
MD5 e4052c0527dce8150a0d17ac4be6d51a
SHA1 880e4063599c43476c80c120e6a2d9fa4bd6b098
SHA512 dc929542d34d881bab2a3affc6c88d213a60894c17b218064b8e5ed0936b8fadb31063768cbf91a6bc9a8ae1270cd583af48f73e112470b1a576a7b80d2405a6
SSDEEP 768:shjeTN3glCgQYV80f3ifHOGu9x9g4mHz/upwGhKJ/PO9kvMIxbVUdKgdfBcp6ZBy:n486ifHnnHz2pb7ceBdfRwYICt/0yg
TLSH
T1F8832AA75360849BE86A7138429A474BE673FC214510A75F5328CB599F2F3B33E3D782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.jsa

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\server\classes.jsa
Size 14.2MB
SHA256 fcfc2b398ce0d4b17dd897c5de0948962a90a4b8de15fa214021b82c68212e7f
MD5 26323326fe5440cd2b92da3d0a0f1e3c
SHA1 8af5c67a58f13402a95bfcb9368e443cfb0c5375
SHA512 12dcaef0b9b12a2546584889d5217ea1e0c2afa57e3dcaa0edee8c1fd49bb15c561c4fe8816689a1c5c37102f9a73b94d80c70af2700eae0791324989f41ce60
SSDEEP 49152:U1rENQNHW/xBKEIWiaAQmnikRkAGgnaApo8UvnmtR26SLXIv+Yg+tgLcD3Ae2DNL:hQ+Vwx/txHbPRv54VY
TLSH
T14DE6F817F68449A3D83D863588DAC3942732F468AA878B033ED0577EDDC31DE4E269D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\server\jvm.dll
Size 14.8MB
SHA256 0b53e1508cc1e9a353ec8e1b1c9d4ebae87120918c029d63af8275a8c4c8b640
MD5 729966be5924f3a761f5bfd27dae7013
SHA1 f3001f40b83837d254089a117f11f2f00617f4ee
SHA512 968ce16e4f28c016283b6ba98163ce323e9a3dc478203827cc590d1e22627f316ade4a9223da3a61e34b651c1e7c08e828e83f4407a7150ef08efeed866a0586
SSDEEP 393216:ti+N6NabQ4taDusMEsa7VEwTPTiD24GKPoRebCByH0EgFCDqT6nXzSQqjb8azklY:+rH
TLSH
T1F4F66C5BB3B500A9D067C0788A2B992FC7F2F8A48B7197CB5560165E2F53BE0693F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\sunmscapi.dll
Size 48KB
SHA256 d0cd50353416039ad7865c230d60a32572c2bc725e6acd7a0d593c73f56dd0e4
MD5 0d6bb895d4d0f742488fe9f6760d1177
SHA1 4042b99d9f723dcb59a419eb99413885044963b0
SHA512 a330612b3c571014203833c85bf0e4358b14fb72fcb98e77ee342cd0ed215a289989f53d245652fa51da4beefc124a4498b5618dd79ca9440dd9168115868a79
SSDEEP 768:sSUGPlnVYLDpHmGPRf+LfwwIPfTXT2Rs0maBUIYwf/yVLk5npH:sSUuY9mGPffTXT2Rs0maBUIYwf/yGpH
TLSH
T11F235A0BD7A100D1FCA3C9BCC06A561BE671B5566132CB8F0361CA0D9F67BA2B63C756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
TLSH
T16EF24B9467B88446D06B86B0C4D3AE57BE3CF9655750938F0BA4C29D1F23BD0AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\bin\zip.dll
Size 82KB
SHA256 898f0012abc07b03e298317d8fbe561d102f71b34b295ff8fec501a9c789af54
MD5 dee5c1812055bd8fd7933025422c89c1
SHA1 aa85f1c05a8f72f7801f4d0d53862110b9ac2864
SHA512 6f9152bd90d28a4cd1e5062952c22e62246b1c9e58a66169e638ddea2e96b9d787ae8b939fa8109cef6006c7d3d76059639faaa05debe7ad5a9ea372e5e02e53
SSDEEP 1536:dCq629S46szxSmyytY/BHmzK29bIOQIO2MjpylA:dCN2kZs1SmtPzd9NG2Mjpym
TLSH
T101839E959E705161DEBA95B0C8E34A2ED3B6B02513D0578B935C839A2F137A13F4C3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\conf\net.properties
Size 7KB
SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
MD5 1f251a36eb37913b696b5be5595e1cd0
SHA1 412fed5d460c414583b16f41e1ebe4262c239af1
SHA512 7a24d898e68c2a7f229220074c510910e7257dd11be33cece3ed4f630552934f6968aa310bcf956a30baf610528cd251f233bad32fd0921ece2c171a7154e2a5
SSDEEP 192:/LVGG4f4z346et5m27Sn1gTe93hf7k9SrnF:ZGxYCU1gY3hzk9+F
TLSH
T142E17283BF46B7354399C291E21EA7EEE32C913D4C33B5B831AC850D2619C76427F4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\conf\security\java.security
Size 67KB
SHA256 778c41102c3a82f92d1717cf0768e5c82bc6d143a10dfa3f084a331b430ddd5c
MD5 c30f95659911d9c14241f556d5fcb196
SHA1 5dfdee19b65b04db079afbf2e597e3cf9b2412e1
SHA512 495c8453a28020d6b652be7e6d154a3c1391290877f42725e9dcd2c923dba7fa5f0992a11ad3f029ff561b121c67d9dfc964a58ece831e5c9b3dee52e77155ac
SSDEEP 1536:rQMy8R78MRjJUp5/LTNHu1UoQ2k/gl0ug6Yz/NndOcA2ZIYyl:J8MfUD/LTNO1UoQDHzFndOcKJ
TLSH
T1B263D422BB897B7206F211A363AEF1D9F76DA12A26325154748D420C7326F71C3736E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\legal\java.logging\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\legal\java.logging\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\lib\jvm.cfg
Size 28B
SHA256 54ac5bb838f64585085f6c04b73431a96b9246cc0090943c48b067ab05086180
MD5 4006564666795c838eed8b7fd958b0af
SHA1 cd6d4f2868725ef7541485719c6ea88d05e43724
SHA512 87643b6f1da35a9a60869ef1f68141b3e4225fc65b256f31f7289c854d0e929e587ab572d4f67f2802aea89958b3a45a23c83bcc60c6b30613c87021ef537b03
MD5 SHA1 SHA512

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\lib\security\cacerts
Size 189KB
SHA256 55fbd8ca4643abcae549945fbdcc9791943b8161033c6d4179b9e86b0affb62d
MD5 c274da320185566b5a300cbcff1f415e
SHA1 0383db6630f3667013b69e4e8e493f5deca7471c
SHA512 abe7ee4c70b267116e80a7f90a44074e97a84214f2693d5d10b40b9a83e4cceabff6899788cbd49055951dda16907b729cb6540ae00e6573a868ed9a69fe5a57
SSDEEP 3072:Y7W50keopPrPXMvfrSuZaZw6hhIJ2ACE9FqnF8aGl1doAXA7BTMly8Jg96p:Yk7pP0uucZw6hhIJ2qIUXNXAlTMl4M
TLSH
T10B144A4B1F3D74057FE2DE48A688DB277DB6F3E42E969527112180E41A91FA07C8D12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\lib\tzdb.dat
Size 100KB
SHA256 7be2a3adf10ff841579629f7725b15f0db41e8856527ec72847b5477073a3d29
MD5 4eb7143fa50aa5537eb0644f468bf695
SHA1 57ce5168a4c09b20b2505ba25ee4e80a875cb203
SHA512 1eb614f1d1bb5be7a2a56e0a8e16acb1853b9110aef8252f3f5b222e7feb9f7639350e61121e17a46640e43ff7e114143e4abbe2e99a9eea297e21d3823886e3
SSDEEP 1536:n0ExeF8dhPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4a3jyxU:nPeqdhPdrcWzbVj0hJzdxuT/6ToU
TLSH
T190A3C3B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\lib\tzmappings
Size 15KB
SHA256 3929ab1380771d0d542d91cfbae02ce519a76678f5f63813739a6c6b98dc6d72
MD5 f2c6e7d7e1856acd650426427dc72cbd
SHA1 42fcb6d986381170cdef3aeaaf9f8ddc124fdec0
SHA512 3fff765acea8b4b2f1d01ee080920db815212ef05a75832a4a01e174886544b1320f85229d43d5077e050bf8309a2d467d784e828b82cfd095fa1caca7780b35
SSDEEP 192:LQW46R4S2t0ZvH4LacPZ5E1DBMpLcnyhAXnEo2nh+E4:LQW46R4jtavQSRqwSL4
TLSH
T15F622585B06622E4C073EC0D3F227AD3F886F3C49AC69A4D2953C366BD059B766D5837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Roaming\GravitLauncherStore\JRE-25\release
Size 1KB
SHA256 3f798bee773880e30400e8c5fa564909edc6a8e1e92fce3000b13e697ca9a3ab
MD5 3ef16af447cfc48300e4cba98e711dd2
SHA1 db0b4e726f2ed74d3b6a869632be75fa02c51c63
SHA512 bbc964dfc3a15cf4d3e8c1d3c77c313ffa0dd5129a3bc5188719ca5f57b5c357a3dc0b850a3a28e8da137abf5083f159ea7568828304faa10ffa99b6f149be50
TLSH
T1B111002F900E84F16A9802C33A784E1EF4EC8D3549C69CD8FD9F5448F0F2B965EB051A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4348-22-0x00007FFA6C5B0000-0x00007FFA6C5B1000-memory.dmp

Download

memory/4696-102-0x00007FFA6C5B0000-0x00007FFA6C5B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads