Overview

overview

6

Static

static

3

PrismLaunc....3.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    306s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 00:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PrismLauncher-Windows-MSVC-Setup-11.0.3.exe
  • Size 22.8MB
  • Sample260807-afm4bstele
  • SHA256 6c61bd9fef98c21750b021e0450896749cb25e75b91716bf22423d7ca64c1cb4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 27 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.3.exe
    "C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.3.exe"
    1⤵
    • Loads dropped DLL
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM prismlauncher.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2524
    • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe
      C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe /install /passive /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Windows\Temp\{8AAE9ABE-C923-4166-9E76-455694B2D922}\.cr\vc_redist.x64.exe
        "C:\Windows\Temp\{8AAE9ABE-C923-4166-9E76-455694B2D922}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe" -burn.filehandle.attached=776 -burn.filehandle.self=780 /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3840
        • C:\Windows\Temp\{7FF7FABA-87F8-4F1B-B7C5-D6AAD8CE48FD}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{7FF7FABA-87F8-4F1B-B7C5-D6AAD8CE48FD}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{60C3CD18-41C4-4F0F-9F71-C39C888BBA00} {91A06741-AA5E-4654-8D55-F6BB376EB189} 3840
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4400
          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1068 -burn.embedded BurnPipe.{2781A590-C5B1-46DF-80F4-0202BB2696B2} {529FAF39-6D5D-4C85-AFAF-BD72317BD912} 4400
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4172
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=612 -burn.filehandle.self=632 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1068 -burn.embedded BurnPipe.{2781A590-C5B1-46DF-80F4-0202BB2696B2} {529FAF39-6D5D-4C85-AFAF-BD72317BD912} 4400
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5740
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E4785002-F690-405A-B483-14D64D70740D} {0BA19650-D5D1-46DF-9FC6-E57ACAD73D2D} 5740
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:2700
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1008
          4⤵
          • Program crash
          PID:5784
    • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
      "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:3288
      • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe
        C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe --check-only --dir C:/Users/Admin/AppData/Roaming/PrismLauncher --debug
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of WriteProcessMemory
        PID:5952
        • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
          C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe --version
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: AddClipboardFormatListener
          PID:2004
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:476
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:6696
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3060
    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806201053.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:892
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806201053.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:6848
          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1E43C84C-B285-4BC3-ADC3-34820BFEE324} {4CD4E7B9-1A25-4AA1-9692-939EF55AD41F} 6848
            4⤵
            • Adds Run key to start application
            • Enumerates connected drives
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1032
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1100 -burn.embedded BurnPipe.{047BA398-2984-4E62-81E8-6EE8D9663A31} {7176EDB6-3E6F-48FE-ADCA-9D04F3384B48} 1032
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5124
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1100 -burn.embedded BurnPipe.{047BA398-2984-4E62-81E8-6EE8D9663A31} {7176EDB6-3E6F-48FE-ADCA-9D04F3384B48} 1032
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:6524
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 3840 -ip 3840
      1⤵
        PID:1360

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5a4944.rbs
            • Path C:\Config.Msi\e5a4944.rbs
            • Size 19KB
            • SHA256 77459f0461885bf652b2565f8a59be0aa9a6d2bc35d61974914fd91d50256943
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a4950.rbs
            • Path C:\Config.Msi\e5a4950.rbs
            • Size 19KB
            • SHA256 96b537c60811952c130e751d7fc8a99290f30579f7d84022e23465ae5fc9f374
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a4957.rbs
            • Path C:\Config.Msi\e5a4957.rbs
            • Size 21KB
            • SHA256 02f298e18262bcbb77948f14fdd9de49bea1731bc39da14bfa7f2bf4d2cedcc0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a4966.rbs
            • Path C:\Config.Msi\e5a4966.rbs
            • Size 21KB
            • SHA256 f0765af3c70e603164d7c206c6066d8c543b935d53d617f993325847833ba1ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a496a.rbs
            • Path C:\Config.Msi\e5a496a.rbs
            • Size 3KB
            • SHA256 1b8b0ab41f58bead065df04a3cfc46dd2fea65bbd9285dfb97afa181782f9f9c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
            • Size 1KB
            • SHA256 be1aff074126f5bd6b7656055b047fab90828fda7cb89d9f0957e7e7a119b04a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Qt6Core.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Core.dll
            • Size 9.8MB
            • SHA256 e898be1717f33e5be968a5d07c56f6cdf6f236c7888bebf3ada8db55a72dff0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Gui.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll
            • Size 9.1MB
            • SHA256 f872c2b0f6a8aa92c80006dc272f2af0137f1172510a07e5687dd23b9e84d048
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Network.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Network.dll
            • Size 1.7MB
            • SHA256 c99cdc8fe49d4ffef4585616181e977674ffddf5c83e04f8a7bfa710ef7a113c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6NetworkAuth.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6NetworkAuth.dll
            • Size 289KB
            • SHA256 f72beabb77f4212b2121f29fe6a905860922fc96e065e391e606e7edc57a2970
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6OpenGL.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6OpenGL.dll
            • Size 1.9MB
            • SHA256 74bae72a5e3059b47d7213dc0c05319cbf2e27004c96197e35cff6b58f72d83d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Widgets.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll
            • Size 6.3MB
            • SHA256 96e9e1514101f4a4fad67a7e34aa2b8c2ec135f4eeb7f56ec26f3e00bd97c1fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Xml.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Xml.dll
            • Size 159KB
            • SHA256 543669c722f33a40dbafab441e1590a0d8aaa48b17db66a64a7db32e4cccd721
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            archive.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\archive.dll
            • Size 731KB
            • SHA256 812e646111face02ae8492d39582bce216845568513b72ada52cb2c4ca0b3f40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bz2.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\bz2.dll
            • Size 90KB
            • SHA256 39a7d40a7dcf21fc6b09352907465e941a1a6799aa28f6c0d7875785d33e12e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cmark.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\cmark.dll
            • Size 155KB
            • SHA256 85618e723dc422d863765a427c8fb905d2b26aa3f8f7ad6bdf21441dc488c973
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            liblzma.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\liblzma.dll
            • Size 199KB
            • SHA256 1f423fcdc9108b8878156ed27109fbdb17b7b90b758935ef308516f42157fbb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lz4.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\lz4.dll
            • Size 138KB
            • SHA256 91fbd4bd121e1cef7191997ae9cb0027746b3b19641d630f332c1b8df9f5d382
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lzo2.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\lzo2.dll
            • Size 127KB
            • SHA256 14df059d4d9a3199aa884d99d968c34109934fcfb53c1accfa1bf0387b4f8dc2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prismlauncher.exe
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
            • Size 9.2MB
            • SHA256 c24c7c84fce7ff1d12c709e0bcc8993aaa2a8cb662381c960ccb7d93c88bc2e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qrencode.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\qrencode.dll
            • Size 62KB
            • SHA256 3d7ad6fa71b1f258ccf3095a757846d7100370d694de19a4b88b626c153d75b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tomlplusplus-3.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\tomlplusplus-3.dll
            • Size 391KB
            • SHA256 da56668531fe7e4a5f61738276a1d0db0f332c24ef5e7ccb21ea99c96d96502d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe
            • Size 24.4MB
            • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zlib1.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\zlib1.dll
            • Size 103KB
            • SHA256 70a21e2388ceed18e2a99933039f1417cfca50f70a00f32c043ec8cb269ff159
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zstd.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\zstd.dll
            • Size 657KB
            • SHA256 564f5dd7ad96a0c75314fca24cfd615b423edcb2780e734dfb72d1cc72f52097
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIa635f.LOG
            • Path C:\Users\Admin\AppData\Local\Temp\MSIa635f.LOG
            • Size 3KB
            • SHA256 c5b225f74f17041818c353f2584d2c2ed67ad60bc0737fe557676e5f9f1ad095
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dd_vcredist_amd64_20260806201053_000_vcRuntimeMinimum_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806201053_000_vcRuntimeMinimum_x64.log
            • Size 2KB
            • SHA256 a7a10616a681bc24c0bd81d1e41209526333496032fe1dd3f956aa2142d287cb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dd_vcredist_amd64_20260806201053_001_vcRuntimeAdditional_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806201053_001_vcRuntimeAdditional_x64.log
            • Size 2KB
            • SHA256 c63bbf12eea865bef93a17b00e506b2ecd8d27ef201b878b0d568e0b983fb6d5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NScurl.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseA743.tmp\NScurl.dll
            • Size 6.0MB
            • SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseA743.tmp\System.dll
            • Size 12KB
            • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nseA743.tmp\modern-wizard.bmp
            • Size 25KB
            • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseA743.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nseA743.tmp\nsExec.dll
            • Size 7KB
            • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prismlauncher.cfg
            • Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
            • Size 30B
            • SHA256 e7bb8d933ad3397d35cf1706f0364ebab6b7c73b6b6846cdb0383db420c2cb25
            • MD5 SHA1 SHA512
            Submit Download

            prismlauncher.cfg
            • Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
            • Size 93B
            • SHA256 3d66da6fa83007ff0c1e7901840eca8a6b33725d4daf8972160546cd9c71c63f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prismlauncher.cfg
            • Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
            • Size 136B
            • SHA256 ba5bcae132316fce22bc2dfee40ce53c7c9098701744d7ce5836e7478c0c0273
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prismlauncher.cfg.lock
            • Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg.lock
            • Size 66B
            • SHA256 3d6c623f76083573f428c0e8e5e37abe080ba3c6acf12431097fc9c6557e8b34
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSVCP140.dll
            • Path C:\Windows\SYSTEM32\MSVCP140.dll
            • Size 544KB
            • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140.dll
            • Path C:\Windows\System32\vcruntime140.dll
            • Size 121KB
            • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140_1.dll
            • Path C:\Windows\System32\vcruntime140_1.dll
            • Size 48KB
            • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            license.rtf
            • Path C:\Windows\Temp\{580BFECA-FB2D-4EC5-89E2-F9C7E50C3E46}\.ba\license.rtf
            • Size 9KB
            • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{580BFECA-FB2D-4EC5-89E2-F9C7E50C3E46}\.ba\thm.wxl
            • Size 2KB
            • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            thm.xml
            • Path C:\Windows\Temp\{580BFECA-FB2D-4EC5-89E2-F9C7E50C3E46}\.ba\thm.xml
            • Size 8KB
            • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{580BFECA-FB2D-4EC5-89E2-F9C7E50C3E46}\.ba\wixstdba.dll
            • Size 191KB
            • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{7FF7FABA-87F8-4F1B-B7C5-D6AAD8CE48FD}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{7FF7FABA-87F8-4F1B-B7C5-D6AAD8CE48FD}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Path C:\Windows\Temp\{7FF7FABA-87F8-4F1B-B7C5-D6AAD8CE48FD}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Size 5.4MB
            • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab5046A8AB272BF37297BB7928664C9503
            • Path C:\Windows\Temp\{7FF7FABA-87F8-4F1B-B7C5-D6AAD8CE48FD}\cab5046A8AB272BF37297BB7928664C9503
            • Size 964KB
            • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeAdditional_x64
            • Path C:\Windows\Temp\{7FF7FABA-87F8-4F1B-B7C5-D6AAD8CE48FD}\vcRuntimeAdditional_x64
            • Size 208KB
            • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeMinimum_x64
            • Path C:\Windows\Temp\{7FF7FABA-87F8-4F1B-B7C5-D6AAD8CE48FD}\vcRuntimeMinimum_x64
            • Size 208KB
            • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Windows\Temp\{8AAE9ABE-C923-4166-9E76-455694B2D922}\.cr\vc_redist.x64.exe
            • Size 670KB
            • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2004-534-0x00007FFB270A0000-0x00007FFB276E7000-memory.dmp
            Download

            memory/2004-535-0x00007FF7FDD60000-0x00007FF7FE695000-memory.dmp
            Download

            memory/2700-390-0x00000000000D0000-0x0000000000147000-memory.dmp
            Download

            memory/2976-108-0x0000000073AC0000-0x00000000740D0000-memory.dmp
            Download

            memory/2976-172-0x0000000073AC0000-0x00000000740D0000-memory.dmp
            Download

            memory/3060-306-0x000001D48B8D0000-0x000001D48C274000-memory.dmp
            Download

            memory/3288-465-0x00007FF7FDD60000-0x00007FF7FE695000-memory.dmp
            Download

            memory/3288-464-0x00007FFB270A0000-0x00007FFB276E7000-memory.dmp
            Download

            memory/4172-408-0x00000000000D0000-0x0000000000147000-memory.dmp
            Download

            memory/5124-412-0x00000000000D0000-0x0000000000147000-memory.dmp
            Download

            memory/5740-397-0x00000000000D0000-0x0000000000147000-memory.dmp
            Download

            memory/5952-515-0x00007FFB270A0000-0x00007FFB276E7000-memory.dmp
            Download

            memory/6524-411-0x00000000000D0000-0x0000000000147000-memory.dmp
            Download