Analysis

  • user interaction
    yes
  • max time kernel
    84s
  • max time network
    90s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 03:34

General

  • Target
    sakuracat-1.3.4-win64-setup.exe
  • Size 80.8MB
  • Sample260802-d48aystdlg
  • SHA256 580ed83dc73cec7e705a919f8d25c627cdc3b52ffd4840716d274ff53543cecd
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 54 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Drops file in Program Files directory 64 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sakuracat-1.3.4-win64-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\sakuracat-1.3.4-win64-setup.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5860
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';$appName='SakuraCat VPN';$roots=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall');foreach($root in $roots){$path=Join-Path $root $appName;$props=Get-ItemProperty -LiteralPath $path -ErrorAction SilentlyContinue;if($props){$location=[string]$props.InstallLocation;if($location -and (Test-Path -LiteralPath (Join-Path $location 'maintenancetool.exe'))){Write-Output $location;exit 0;}}}foreach($root in $roots){Get-ChildItem -LiteralPath $root -ErrorAction SilentlyContinue | ForEach-Object {$props=Get-ItemProperty -LiteralPath $_.PSPath -ErrorAction SilentlyContinue;if($props.DisplayName -eq $appName){$location=[string]$props.InstallLocation;$uninstall=[string]$props.UninstallString;if($location -and $uninstall -like '*maintenancetool*' -and (Test-Path -LiteralPath (Join-Path $location 'maintenancetool.exe'))){Write-Output $location;exit 0;}}}}"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4304
    • C:\Windows\SYSTEM32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v DisplayName /t REG_SZ /d "SakuraCat VPN" /f
      2⤵
        PID:9608
      • C:\Windows\SYSTEM32\reg.exe
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v UninstallString /t REG_SZ /d "\"C:/Program Files/SakuraCat VPN\maintenancetool.exe\"" /f
        2⤵
          PID:9644
        • C:\Windows\SYSTEM32\reg.exe
          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v QuietUninstallString /t REG_SZ /d "\"C:/Program Files/SakuraCat VPN\maintenancetool.exe\" --silentuninstall" /f
          2⤵
            PID:9680
          • C:\Windows\SYSTEM32\reg.exe
            reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v InstallLocation /t REG_SZ /d "C:/Program Files/SakuraCat VPN" /f
            2⤵
              PID:9716
            • C:\Windows\SYSTEM32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v DisplayIcon /t REG_SZ /d "C:/Program Files/SakuraCat VPN\SakuraCat VPN.exe" /f
              2⤵
                PID:9752
              • C:\Windows\SYSTEM32\reg.exe
                reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v Publisher /t REG_SZ /d sakuracat /f
                2⤵
                  PID:9788
                • C:\Windows\SYSTEM32\reg.exe
                  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v URLInfoAbout /t REG_SZ /d https://example.com /f
                  2⤵
                    PID:9824
                  • C:\Windows\SYSTEM32\reg.exe
                    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v DisplayVersion /t REG_SZ /d 1.3.4 /f
                    2⤵
                      PID:9860
                    • C:\Windows\SYSTEM32\reg.exe
                      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v NoModify /t REG_DWORD /d 1 /f
                      2⤵
                        PID:9896
                      • C:\Windows\SYSTEM32\reg.exe
                        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SakuraCat VPN" /v NoRepair /t REG_DWORD /d 1 /f
                        2⤵
                          PID:9936
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';$appName='SakuraCat VPN';$customKeyName='SakuraCat VPN';$targetDir='C:\Program Files\SakuraCat VPN';$roots=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall');foreach($root in $roots){Get-ChildItem -LiteralPath $root -ErrorAction SilentlyContinue | ForEach-Object {$props=Get-ItemProperty -LiteralPath $_.PSPath -ErrorAction SilentlyContinue;$keyName=$_.PSChildName;if($props.DisplayName -eq $appName -and $keyName -ne $customKeyName){$uninstall=[string]$props.UninstallString;$quiet=[string]$props.QuietUninstallString;$icon=[string]$props.DisplayIcon;$location=[string]$props.InstallLocation;$isMaintenance=($uninstall -like '*maintenancetool*' -or $quiet -like '*maintenancetool*' -or $icon -like '*maintenancetool*');$sameInstall=([string]::IsNullOrWhiteSpace($location) -or $location.TrimEnd('\') -eq $targetDir.TrimEnd('\'));if($isMaintenance -and $sameInstall){New-ItemProperty -LiteralPath $_.PSPath -Name SystemComponent -PropertyType DWord -Value 1 -Force | Out-Null;}}}}"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Hide Artifacts: Ignore Process Interrupts
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:9972
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd /c "taskkill /F /IM SakuraCat VPN.exe || exit /b 0"
                          2⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:10144
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM SakuraCat VPN.exe
                            3⤵
                            • Kills process with taskkill
                            PID:10184
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';$appName='SakuraCat VPN';$customKeyName='SakuraCat VPN';$targetDir='C:\Program Files\SakuraCat VPN';$roots=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall');foreach($root in $roots){Get-ChildItem -LiteralPath $root -ErrorAction SilentlyContinue | ForEach-Object {$props=Get-ItemProperty -LiteralPath $_.PSPath -ErrorAction SilentlyContinue;$keyName=$_.PSChildName;if($props.DisplayName -eq $appName -and $keyName -ne $customKeyName){$uninstall=[string]$props.UninstallString;$quiet=[string]$props.QuietUninstallString;$icon=[string]$props.DisplayIcon;$location=[string]$props.InstallLocation;$isMaintenance=($uninstall -like '*maintenancetool*' -or $quiet -like '*maintenancetool*' -or $icon -like '*maintenancetool*');$sameInstall=([string]::IsNullOrWhiteSpace($location) -or $location.TrimEnd('\') -eq $targetDir.TrimEnd('\'));if($isMaintenance -and $sameInstall){New-ItemProperty -LiteralPath $_.PSPath -Name SystemComponent -PropertyType DWord -Value 1 -Force | Out-Null;}}}}"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Hide Artifacts: Ignore Process Interrupts
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5016
                      • C:\Program Files\SakuraCat VPN\SakuraCat VPN.exe
                        "C:\Program Files\SakuraCat VPN\SakuraCat VPN.exe"
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:3668

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            Qt6Core.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6Core.dll
                            • Size 6.6MB
                            • SHA256 11e6605b8dc988163d58b66d36e63263fa38c584778f68c0a8ff6646125a5eb6
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6Gui.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6Gui.dll
                            • Size 10.4MB
                            • SHA256 e291ee18547d7578de01029ce6577a8a7f1208c14de8c4040847e4e2c104b0f8
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6Network.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6Network.dll
                            • Size 1.9MB
                            • SHA256 03ef9d38cd31c45a0585a9bb739854ae8a0467dc4c9feeea5444b2f956fd8233
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6OpenGL.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6OpenGL.dll
                            • Size 579KB
                            • SHA256 d7e63d140e486593280c8e78f5369183abcc9730f78c6346afcc74228f95965e
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6Qml.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6Qml.dll
                            • Size 5.6MB
                            • SHA256 c8b9043faeab0afbd1b776fe2572982aad1de1c2ce857449b36b04601efb338d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6QmlMeta.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6QmlMeta.dll
                            • Size 162KB
                            • SHA256 7cf3f6993d73ffb2e9c999af79a7e9c09545b65fa0ec4823648ad46f3bb52646
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6QmlModels.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6QmlModels.dll
                            • Size 793KB
                            • SHA256 853eebf1c80017e0b22fe8c8416694915c70eba6c16ea811c714a1ea6ef1f617
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6QmlWorkerScript.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6QmlWorkerScript.dll
                            • Size 78KB
                            • SHA256 1b970f19f4c9f5aed458d6a0a9562bff20a0ccf15ecaffbdeb849251d408d3e5
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6Quick.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6Quick.dll
                            • Size 6.7MB
                            • SHA256 1ce9b363498dc44fba250eb80c6394182ce34694d6b20de7e37d522bf3da0b39
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6Sql.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6Sql.dll
                            • Size 320KB
                            • SHA256 a94b9f4c24df7dbdf267da38258a38c992f698eae32cdf67cf0eabde11a5c297
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6Svg.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6Svg.dll
                            • Size 483KB
                            • SHA256 3a0a37258ca472c5fe781b5126aa40032d01ed3f5c411ce4d1d80a8aee9c8de8
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Qt6Widgets.dll

                            • Path C:\Program Files\SakuraCat VPN\Qt6Widgets.dll
                            • Size 6.7MB
                            • SHA256 487751ea99d859802ad23dd1667266edb1ad5b9c29dffcff87a1a5c110164714
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            SakuraCat VPN.exe

                            • Path C:\Program Files\SakuraCat VPN\SakuraCat VPN.exe
                            • Size 31.5MB
                            • SHA256 898c72ba63e75395e55641623a74d42872bfaa74e5c9589efb0e68dbb1996049
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qsvgicon.dll

                            • Path C:\Program Files\SakuraCat VPN\iconengines\qsvgicon.dll
                            • Size 71KB
                            • SHA256 e7fecd1df6d5467c0e48e8fcf9292c10fca6ed7bca523a8b4c345a132a59bc42
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            libgcc_s_seh-1.dll

                            • Path C:\Program Files\SakuraCat VPN\libgcc_s_seh-1.dll
                            • Size 106KB
                            • SHA256 5e27589147caa6d7a30f4cc058a14c455dc62233901ffff9a1797ede425e9f86
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            libstdc++-6.dll

                            • Path C:\Program Files\SakuraCat VPN\libstdc++-6.dll
                            • Size 2.1MB
                            • SHA256 8013488c5528bad7966ca07f3ea2e7a9b743cacb258fe76b46a326f821cc83b0
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            libwinpthread-1.dll

                            • Path C:\Program Files\SakuraCat VPN\libwinpthread-1.dll
                            • Size 52KB
                            • SHA256 c7c7dced65fff71c7bb61f80c771c562f533d26d72722d9d6091129a3b03d5ce
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            maintenancetool.ini

                            • Path C:\Program Files\SakuraCat VPN\maintenancetool.ini
                            • Size 4KB
                            • SHA256 7c90a5ca4b0460c7f7762aa465461cfc7e1565de149b050f6ba7a76dae5f9b7c
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qwindows.dll

                            • Path C:\Program Files\SakuraCat VPN\platforms\qwindows.dll
                            • Size 1.0MB
                            • SHA256 193848a07853f8ababccd97b027622d234f51ca46feadd8c5f10eee415552165
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            combobox-indicator-open-pressed.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\combobox-indicator-open-pressed.png
                            • Size 120B
                            • SHA256 dda8d0d5444670f0a82f7b7aabf1f771d94d0c418f15be75b120137758932c7a
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 167B
                            • SHA256 6d584df93b6785277a090e3c2d46ebba057d262253dfcebbb81585a9f48658c1
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 177B
                            • SHA256 340dfb8f5d90ee5d986eb4b3570a2b3481ca50048a1a5eb38144e13a598d9bc9
                            • MD5 SHA1 SHA512 TLSH

                            slider-handle-disabled.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\slider-handle-disabled.png
                            • Size 442B
                            • SHA256 e04fbcc696a2ea2a326a1b7bc57f25a0e1b33091e588889da5a9d7015c595022
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 698B
                            • SHA256 caf54e636473e19db45d86b01fb79142bf28e916030ec3b60272a14643313460
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 935B
                            • SHA256 60f757e557455aef99ad54ae55c3e8d18347fdef0bdc5af176055e154e7b8f38
                            • MD5 SHA1 SHA512 TLSH

                            slider-handle-hovered.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\slider-handle-hovered.png
                            • Size 493B
                            • SHA256 4d5d16a9ef3db072309d531e11057076bfa7b03f4f47f6bd8a7d89d1fe0bd39b
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 875B
                            • SHA256 6001207502a85ce95a405c9100e575994dab92e04fd28c1c66eefc69c52dc3ad
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 1KB
                            • SHA256 f38227a12d179e016f9b2696d3dc8ec4c6c96c275cfccbe839dd5ba0c51d9b26
                            • MD5 SHA1 SHA512 TLSH

                            spinbox-background-up-pressed.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-background-up-pressed.png
                            • Size 317B
                            • SHA256 237ff3516492b63b2ed41562ea6e3b983f277a2375f12d427a0a7769cec15043
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 683B
                            • SHA256 349cb567bded99187024758d0cb9cda60b55227a4d7fe1763f7f41753f692d7c
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 1KB
                            • SHA256 4c9186092eabc6788e704b074423e009cd3b80a8d5de0bb1ada6f7599f91bb9c
                            • MD5 SHA1 SHA512 TLSH

                            spinbox-indicator-down-icon.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-down-icon.png
                            • Size 118B
                            • SHA256 33f189b55282b1a6d904fd2424cdc051fbd3af17b942899942fc6daf46280146
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 164B
                            • SHA256 e2ee0ed4ccf6d0e468b02b83598f0487cc3167d508c6e08e6490b925d8305474
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 211B
                            • SHA256 d712f165711bf5e0f265607705a4e83452c8fcbc59e106238663664f791f28e5
                            • MD5 SHA1 SHA512 TLSH

                            spinbox-indicator-up-icon.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\spinbox-indicator-up-icon.png
                            • Size 118B
                            • SHA256 7109a067ad00c3cdd31365c76ea8e24264910fe9b1350a292fc00dd7d2b97e5b
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 150B
                            • SHA256 50e45c5bc1f41a265ccdb7106571d751b4a875577d19c5409009fcdd0e82cfc1
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\dark\images\[email protected]
                            • Size 210B
                            • SHA256 f85b2a74823a54b1d904d44b638204ae78301a91eabacfc1dc7f07508c384057
                            • MD5 SHA1 SHA512 TLSH

                            combobox-indicator-open-pressed.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\combobox-indicator-open-pressed.png
                            • Size 125B
                            • SHA256 0941ec5da06f1cafe91004c1b035997609ab1eef1f39a9ac5f0bb558dd8f93eb
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 171B
                            • SHA256 840b43337d232f04aed0b3209a43a0b25bb5f4bb53920620c7e0bcc155743daa
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 184B
                            • SHA256 b74cf0894a7b42aae0630586e321e3cea282724a16e1ed40322cb39014c0041f
                            • MD5 SHA1 SHA512 TLSH

                            slider-handle-disabled.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\slider-handle-disabled.png
                            • Size 343B
                            • SHA256 d0f2f23ce73f6559fa3a61f4e7c068875e321dc6aca3a0eb6a423ae94054b92a
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 590B
                            • SHA256 5d2c7b18155db2f3583896fde0addccc481a816a9b36531b201bc5e31bbb35ab
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 780B
                            • SHA256 7afea33b4b6109fccad617fc05ba2ffc422bc60b02e805303e129ca9954953a1
                            • MD5 SHA1 SHA512 TLSH

                            slider-handle-hovered.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\slider-handle-hovered.png
                            • Size 513B
                            • SHA256 3bd1cba7b0517257de59ea097e188ebaa706b7bbfca338a29ddbec2d944c5567
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 1KB
                            • SHA256 caf1dc9e14b96d649fbc00a5210fbd0e209fee56c724ba746ea7a22edf73d5ac
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 1KB
                            • SHA256 34a47dc79f253f27a7757d747f3402559294fe080d1409890ffaeaad1a3d7b1e
                            • MD5 SHA1 SHA512 TLSH

                            spinbox-background-up-pressed.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-background-up-pressed.png
                            • Size 438B
                            • SHA256 b690ff71125077a35907ee9df97bb986fbebb2ee82b1f443d86e25fd15738204
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 992B
                            • SHA256 9b1916e06dd0605a1cb61052de50cda49723e08f280dfce484b8b06d54cb1a17
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 1KB
                            • SHA256 ac3911723fbc5dbd7831c4049036f4f9d5b290a52164143d9e4846fc3fa5ceb0
                            • MD5 SHA1 SHA512 TLSH

                            spinbox-indicator-down-background-up-pressed.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-down-background-up-pressed.png
                            • Size 83B
                            • SHA256 8285acc7fe450d3a72eed1432566f7aa90af7ee33a154aa7402dc707018979b7
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 92B
                            • SHA256 4a812392a115a37694707507b84dc3c789fb3880c298cce2a7d31f1d837f601f
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 101B
                            • SHA256 02530ad19a6a050f2813c5d801a9fe75c9b0fbf4508491c6abb1bbdb72b28734
                            • MD5 SHA1 SHA512 TLSH

                            spinbox-indicator-down-icon.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-down-icon.png
                            • Size 138B
                            • SHA256 6291f9c78c77f1fb89dd0b43c51daa98c2ab6c98ca737c2ef1f61f1f201b4514
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 180B
                            • SHA256 6fd283b8c8f1c96a7b0084a475dc0915cc7db16c938858b6c2fc42a2c286107a
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 215B
                            • SHA256 bfdd4f412de35ced17a26b6090b41befbf11e97578a244798a475c35f1b81685
                            • MD5 SHA1 SHA512 TLSH

                            spinbox-indicator-up-icon.png

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\spinbox-indicator-up-icon.png
                            • Size 131B
                            • SHA256 95bc4afbc55494f30ec3553ae051c73b535e9aad45426eb373cb788f25f88caa
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 164B
                            • SHA256 d5a68925a3626dabc5a773663cd0134ae03c908c0c8adb4381578078c3fc056e
                            • MD5 SHA1 SHA512 TLSH
                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\FluentWinUI3\light\images\[email protected]
                            • Size 206B
                            • SHA256 9bef876bbd6193e05e5e0ad50706ee454d1ea71da782a6f9e9bf8e5e71bb920d
                            • MD5 SHA1 SHA512 TLSH

                            QuickControls2ImagineStyleImpl.qmltypes

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\Imagine\impl\QuickControls2ImagineStyleImpl.qmltypes
                            • Size 215B
                            • SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
                            • MD5 SHA1 SHA512 TLSH

                            qmldir

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\qmldir
                            • Size 650B
                            • SHA256 003bd12670f67c7780924f104dd72b8ee5fda6a9fe79c63babe59e8989be375e
                            • MD5 SHA1 SHA512 TLSH

                            qtquickcontrols2plugin.dll

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Controls\qtquickcontrols2plugin.dll
                            • Size 47KB
                            • SHA256 b4a0213d2688c8dc835ad238ba50404985d4f0ed3959b490629aa9b68fbb248e
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qmldir

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Window\qmldir
                            • Size 213B
                            • SHA256 cf518c3574e25f91acaec7ad8831e28c18fccfe15411672ea56809b2eb94077c
                            • MD5 SHA1 SHA512 TLSH

                            quickwindowplugin.dll

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\Window\quickwindowplugin.dll
                            • Size 31KB
                            • SHA256 20694a713d2f1e712a2e33205dc7488996eb8aada6298d9ea6a46ef8d3604ad2
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qmldir

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\qmldir
                            • Size 215B
                            • SHA256 137c386f9b2ba49fb3a3417b55096f6f1bd15a794a98613a862b490a6fe4fa79
                            • MD5 SHA1 SHA512 TLSH

                            qtquick2plugin.dll

                            • Path C:\Program Files\SakuraCat VPN\qml\QtQuick\qtquick2plugin.dll
                            • Size 30KB
                            • SHA256 cf37a765fcadc6ba58055943211442525eb180920829660ad3431acfc97843f3
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            singbox.dll

                            • Path C:\Program Files\SakuraCat VPN\singbox.dll
                            • Size 34.4MB
                            • SHA256 54985cb1f775c1340c176b44d1d09d95b80d1718bf22575aa40285343daf6400
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qsqlite.dll

                            • Path C:\Program Files\SakuraCat VPN\sqldrivers\qsqlite.dll
                            • Size 1.4MB
                            • SHA256 4ceb3dfd8f9d5d113b33ffeb58c3c90ae711bece01ea5bbcef772576ac2d34d2
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qsqlmimer.dll

                            • Path C:\Program Files\SakuraCat VPN\sqldrivers\qsqlmimer.dll
                            • Size 93KB
                            • SHA256 8b0d6303ea3f272343e3c7fac4ca2054dafade8e77374c73668e5ca5ac6aa685
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qsqlodbc.dll

                            • Path C:\Program Files\SakuraCat VPN\sqldrivers\qsqlodbc.dll
                            • Size 130KB
                            • SHA256 7193b471964f8e6cc5fae2cdd122b450e3f9e9b0417f868ed0e66678caee159e
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qsqlpsql.dll

                            • Path C:\Program Files\SakuraCat VPN\sqldrivers\qsqlpsql.dll
                            • Size 104KB
                            • SHA256 bf77a4a2be2f21302bd731e84cd04a73e186852279f0e3bacc5a672d1c36e51d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qmodernwindowsstyle.dll

                            • Path C:\Program Files\SakuraCat VPN\styles\qmodernwindowsstyle.dll
                            • Size 234KB
                            • SHA256 6bf6dbac5921260b8227b51d79f774b97de3fd98c8f4d182f28e9a3bb6aab3ee
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qcertonlybackend.dll

                            • Path C:\Program Files\SakuraCat VPN\tls\qcertonlybackend.dll
                            • Size 101KB
                            • SHA256 b32cf4af957248135607648f6538d169bda26765f803213457112d90b8dc7811
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qschannelbackend.dll

                            • Path C:\Program Files\SakuraCat VPN\tls\qschannelbackend.dll
                            • Size 251KB
                            • SHA256 7d5a708541a5359c1738bf0d9c29d1006c57871a9e15e8aab6e7904f317d14a8
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            qt_en.qm

                            • Path C:\Program Files\SakuraCat VPN\translations\qt_en.qm
                            • Size 33B
                            • SHA256 494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf
                            • MD5 SHA1 SHA512

                            StartupProfileData-NonInteractive

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                            • MD5 SHA1 SHA512 TLSH

                            StartupProfileData-NonInteractive

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 d88dd9fa42a06b3318f7d1edbe206b8e71a885579ef2dc68128447912841a5b8
                            • MD5 SHA1 SHA512 TLSH

                            __PSScriptPolicyTest_jodupe55.3qv.ps1

                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jodupe55.3qv.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH

                            sakuracat.ini.lock

                            • Path C:\Users\Admin\AppData\Roaming\sakuracat\sakuracat.ini.lock
                            • Size 66B
                            • SHA256 268df60c8eb2bab2757204d4beda06d6402b4c6e1b9bc2f3beaf4e9cd8d6222e
                            • MD5 SHA1 SHA512 TLSH

                            memory/3668-1542-0x00007FFC2B220000-0x00007FFC2B23B000-memory.dmp

                            memory/3668-1585-0x0000017887180000-0x0000017887181000-memory.dmp

                            memory/3668-1632-0x00007FFC2B300000-0x00007FFC2B322000-memory.dmp

                            memory/3668-1636-0x00007FFC2B240000-0x00007FFC2B256000-memory.dmp

                            memory/3668-1532-0x00007FFC2B240000-0x00007FFC2B256000-memory.dmp

                            memory/3668-1529-0x00007FFC2B2A0000-0x00007FFC2B2F7000-memory.dmp

                            memory/3668-1531-0x00007FFC15260000-0x00007FFC1548A000-memory.dmp

                            memory/3668-1530-0x00007FFC12AE0000-0x00007FFC13197000-memory.dmp

                            memory/3668-1528-0x00007FFC1F610000-0x00007FFC1F802000-memory.dmp

                            memory/3668-1527-0x00007FFC13C30000-0x00007FFC142CC000-memory.dmp

                            memory/3668-1629-0x00007FFC13C30000-0x00007FFC142CC000-memory.dmp

                            memory/3668-1633-0x00007FFC2B2A0000-0x00007FFC2B2F7000-memory.dmp

                            memory/3668-1631-0x00007FFC1F610000-0x00007FFC1F802000-memory.dmp

                            memory/3668-1635-0x00007FFC15260000-0x00007FFC1548A000-memory.dmp

                            memory/3668-1634-0x00007FFC12AE0000-0x00007FFC13197000-memory.dmp

                            memory/3668-1639-0x00007FFC26890000-0x00007FFC268D2000-memory.dmp

                            memory/3668-1554-0x00007FFC27F10000-0x00007FFC27F32000-memory.dmp

                            memory/3668-1640-0x00007FFC2B220000-0x00007FFC2B23B000-memory.dmp

                            memory/3668-1641-0x00007FFC20450000-0x00007FFC204D1000-memory.dmp

                            memory/3668-1642-0x00007FFC27F10000-0x00007FFC27F32000-memory.dmp

                            memory/3668-1643-0x00007FFC26820000-0x00007FFC2683A000-memory.dmp

                            memory/3668-1644-0x00007FFC1E990000-0x00007FFC1E9A1000-memory.dmp

                            memory/3668-1645-0x00007FFC158F0000-0x00007FFC15905000-memory.dmp

                            memory/3668-1646-0x00007FFC158D0000-0x00007FFC158E5000-memory.dmp

                            memory/3668-1648-0x00007FFC15190000-0x00007FFC151A3000-memory.dmp

                            memory/3668-1582-0x00007FFC1E990000-0x00007FFC1E9A1000-memory.dmp

                            memory/3668-1630-0x00007FFC131A0000-0x00007FFC13C21000-memory.dmp

                            memory/3668-1628-0x00007FFC142D0000-0x00007FFC1487D000-memory.dmp

                            memory/3668-1586-0x0000017887180000-0x0000017887181000-memory.dmp

                            memory/3668-1588-0x00000178871A0000-0x00000178871A1000-memory.dmp

                            memory/3668-1589-0x00000178871A0000-0x00000178871A1000-memory.dmp

                            memory/3668-1591-0x00000178871B0000-0x00000178871B1000-memory.dmp

                            memory/3668-1592-0x00000178871B0000-0x00000178871B1000-memory.dmp

                            memory/3668-1593-0x00000178871B0000-0x00000178871B1000-memory.dmp

                            memory/3668-1594-0x00000178871B0000-0x00000178871B1000-memory.dmp

                            memory/3668-1584-0x0000017887180000-0x0000017887181000-memory.dmp

                            memory/3668-1599-0x00000178871C0000-0x00000178871C1000-memory.dmp

                            memory/3668-1602-0x00000178871C0000-0x00000178871C1000-memory.dmp

                            memory/3668-1603-0x00007FFC158F0000-0x00007FFC15905000-memory.dmp

                            memory/3668-1604-0x00007FFC158D0000-0x00007FFC158E5000-memory.dmp

                            memory/3668-1601-0x00000178871C0000-0x00000178871C1000-memory.dmp

                            memory/3668-1608-0x00000178871C0000-0x00000178871C1000-memory.dmp

                            memory/3668-1609-0x00000178871C0000-0x00000178871C1000-memory.dmp

                            memory/3668-1613-0x00000178885D0000-0x00000178885D1000-memory.dmp

                            memory/3668-1614-0x00000178885D0000-0x00000178885D1000-memory.dmp

                            memory/3668-1612-0x00000178885D0000-0x00000178885D1000-memory.dmp

                            memory/3668-1611-0x00000178885D0000-0x00000178885D1000-memory.dmp

                            memory/3668-1607-0x00000178871B0000-0x00000178871B1000-memory.dmp

                            memory/3668-1606-0x00000178871C0000-0x00000178871C1000-memory.dmp

                            memory/3668-1605-0x00007FFC15190000-0x00007FFC151A3000-memory.dmp

                            memory/3668-1600-0x00000178871C0000-0x00000178871C1000-memory.dmp

                            memory/3668-1597-0x00000178871B0000-0x00000178871B1000-memory.dmp

                            memory/3668-1596-0x0000017887180000-0x0000017887181000-memory.dmp

                            memory/3668-1595-0x0000017887180000-0x0000017887181000-memory.dmp

                            memory/4304-21-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-15-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-30-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-29-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-28-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-16-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-14-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp

                            memory/4304-17-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-20-0x000001ABE3AA0000-0x000001ABE3AC2000-memory.dmp

                            memory/4304-27-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-22-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-23-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-24-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/4304-25-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

                            memory/5860-13-0x0000016E8BB40000-0x0000016E8BB41000-memory.dmp

                            memory/5860-37-0x0000016E8DD80000-0x0000016E8DD81000-memory.dmp

                            memory/5860-10-0x0000016E8BB40000-0x0000016E8BB41000-memory.dmp

                            memory/5860-1492-0x0000016E8E6B0000-0x0000016E8E6B1000-memory.dmp

                            memory/5860-36-0x0000016E8DD80000-0x0000016E8DD81000-memory.dmp

                            memory/5860-0-0x0000016E8C180000-0x0000016E8C5C2000-memory.dmp

                            memory/5860-9-0x0000016E8BB40000-0x0000016E8BB41000-memory.dmp

                            memory/5860-1502-0x0000016E88F70000-0x0000016E88F80000-memory.dmp

                            memory/5860-4-0x0000016E8C5D0000-0x0000016E8C7D2000-memory.dmp

                            memory/5860-12-0x0000016E8BB40000-0x0000016E8BB41000-memory.dmp

                            memory/5860-11-0x0000016E8BB40000-0x0000016E8BB41000-memory.dmp

                            memory/5860-38-0x0000016E88F70000-0x0000016E88F80000-memory.dmp

                            memory/5860-1-0x0000016E88F70000-0x0000016E88F80000-memory.dmp