Analysis

  • max time kernel
    139s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 17:25

General

  • Target
    SKlauncher-4.0.29-web-setup.exe
  • Size 838KB
  • Sample260816-vzmbcsshnd
  • SHA256 62b2d500c04740285f9723071aa3dafc762246ba64205c98a10012748861a14b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 13 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SKlauncher-4.0.29-web-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\SKlauncher-4.0.29-web-setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1640
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3768
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\sklauncher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4244
  • C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallationType
      2⤵
        PID:1900
      • C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe
        "C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,11636738756560105211,1796534006948998895,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6797763330172353013,10839888265747747117,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1824 /prefetch:2
        2⤵
          PID:1480
        • C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe
          "C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --standard-schemes=starship-screenshot --secure-schemes=starship-screenshot --bypasscsp-schemes=starship-screenshot --fetch-schemes=starship-screenshot --streaming-schemes=starship-screenshot --field-trial-handle=1828,i,11636738756560105211,1796534006948998895,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6797763330172353013,10839888265747747117,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2000 /prefetch:3
          2⤵
            PID:4844
          • C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe
            "C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --standard-schemes=starship-screenshot --secure-schemes=starship-screenshot --bypasscsp-schemes=starship-screenshot --fetch-schemes=starship-screenshot --streaming-schemes=starship-screenshot --app-user-model-id=pl.skmedix.sklauncher --app-path="C:\Users\Admin\AppData\Local\Programs\sklauncher\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1828,i,11636738756560105211,1796534006948998895,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6797763330172353013,10839888265747747117,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2672 /prefetch:1
            2⤵
              PID:2188

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                powershell.exe.log

                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
                • MD5 SHA1 SHA512 TLSH

                StartupProfileData-NonInteractive

                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 16KB
                • SHA256 e7c1abf7ddc5a0ddb97208c628db619657a58e31f3c99d023f6a3d148917fc3f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                StartupProfileData-NonInteractive

                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 16KB
                • SHA256 57cea04f29860850646831f04cdcdbc79763dae3ba7dc92ee4d3ce9d6eb24e47
                • MD5 SHA1 SHA512 SSDEEP TLSH

                dxcompiler.dll

                • Path C:\Users\Admin\AppData\Local\Programs\sklauncher\dxcompiler.dll
                • Size 24.5MB
                • SHA256 d0bfe18b1fe15a2eb40f8955f3d1a7d54040e8c321158207803668e892727c2d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                app.asar

                • Path C:\Users\Admin\AppData\Local\Programs\sklauncher\resources\app.asar
                • Size 29.8MB
                • SHA256 8d442a2970c436bdbcd612856c020803267f9de35364f6fb387b6be10fd2c7b5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                __PSScriptPolicyTest_yclwdryk.pok.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yclwdryk.pok.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH

                LICENSE.electron.txt

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\LICENSE.electron.txt
                • Size 1KB
                • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                • MD5 SHA1 SHA512 TLSH

                LICENSES.chromium.html

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\LICENSES.chromium.html
                • Size 18.6MB
                • SHA256 62e3b53be6bbbb2e7747b7a55c8b4f4a3cf38b95e0fff594737b3bfdac8cf373
                • MD5 SHA1 SHA512 SSDEEP TLSH

                chrome_100_percent.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\chrome_100_percent.pak
                • Size 113KB
                • SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
                • MD5 SHA1 SHA512 SSDEEP TLSH

                chrome_200_percent.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\chrome_200_percent.pak
                • Size 183KB
                • SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
                • MD5 SHA1 SHA512 SSDEEP TLSH

                d3dcompiler_47.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\d3dcompiler_47.dll
                • Size 4.5MB
                • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                dxil.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\dxil.dll
                • Size 1.4MB
                • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ffmpeg.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\ffmpeg.dll
                • Size 3.0MB
                • SHA256 33559a766ca7b5f0768145eeefa53b6fe2eb0d651629bdefd4786b4569a9aa84
                • MD5 SHA1 SHA512 SSDEEP TLSH

                icudtl.dat

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\icudtl.dat
                • Size 10.3MB
                • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
                • MD5 SHA1 SHA512 SSDEEP TLSH

                libEGL.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\libEGL.dll
                • Size 510KB
                • SHA256 ea6abea4b5520ee55d5bc7b2743855397f7d58906ec2d95bce0cd5cc41fd7eaf
                • MD5 SHA1 SHA512 SSDEEP TLSH

                libGLESv2.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\libGLESv2.dll
                • Size 7.6MB
                • SHA256 276f69a4b413c7f78658591a8b1abeda9d19a5ecd7df9388fb3ff1181a5d5cf5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                af.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\af.pak
                • Size 596KB
                • SHA256 7bf59977f051c1ccb19cb8c48a8efd57922d088ad26cd51a85a671000c845a4e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                am.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\am.pak
                • Size 966KB
                • SHA256 a387f4af550667980c7631532b5c8f50a20ecf2c2f45392a7e0bf23f8f6c91fc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ar.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ar.pak
                • Size 1.0MB
                • SHA256 e8f4b9b64235893bbee95c8360c739e5ba09687072dd4b7d706cee9ae4032887
                • MD5 SHA1 SHA512 SSDEEP TLSH

                bg.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\bg.pak
                • Size 1.1MB
                • SHA256 da36ef0cde92b2021ff39b6c3341f4d2832c1129d13248aa371573812140db9a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                bn.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\bn.pak
                • Size 1.4MB
                • SHA256 4f246bc78ddfc2cc249ae99990470e2d470a13a2d7599ab8787400c4fd179cdc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ca.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ca.pak
                • Size 671KB
                • SHA256 b232cebcb102bf03c81286f1ec082e80d0e399d09d9251c3e574ef24fb15b68b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                cs.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\cs.pak
                • Size 697KB
                • SHA256 58b2d7c81430bec91ff72560acd604df82ff0090e2c4e3d1ce8cac2b69bc40e9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                da.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\da.pak
                • Size 626KB
                • SHA256 66de87f60ce23d82457271b34da1baed85bf0f3f63b04d90610a20c4ebe66c23
                • MD5 SHA1 SHA512 SSDEEP TLSH

                de.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\de.pak
                • Size 672KB
                • SHA256 dadd0439167371607d9a82222f248f268d9e27669c1d87ca09d8751c07a90d01
                • MD5 SHA1 SHA512 SSDEEP TLSH

                el.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\el.pak
                • Size 1.2MB
                • SHA256 9a9db32904381a6eda169f56099313a494dae63f2795678449c4ad87cd3a69fb
                • MD5 SHA1 SHA512 SSDEEP TLSH

                en-GB.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\en-GB.pak
                • Size 543KB
                • SHA256 7bbcf19623b0a34524d75a3211d305d6b01150b3ecf2bff3b140189a13c29eb4
                • MD5 SHA1 SHA512 SSDEEP TLSH

                en-US.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\en-US.pak
                • Size 549KB
                • SHA256 446a0f711467b162cced38128932f712e4a53fe344a165110196c366fd3d87ea
                • MD5 SHA1 SHA512 SSDEEP TLSH

                es-419.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\es-419.pak
                • Size 662KB
                • SHA256 337a0ef8be48fcf7d120026d8dd9970737604ad177df1709fefa5cca79c70079
                • MD5 SHA1 SHA512 SSDEEP TLSH

                es.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\es.pak
                • Size 659KB
                • SHA256 b32a3073e0e749b8b1f0f3e082343a8ca192cf3b7244847387526a5cd8beef7f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                et.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\et.pak
                • Size 602KB
                • SHA256 740a4632aa00dbc07251c10cdef1480739069a6456fa9a642eef387fba935e09
                • MD5 SHA1 SHA512 SSDEEP TLSH

                fa.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\fa.pak
                • Size 996KB
                • SHA256 7d13dfa4bc6ea7ae996f0696eb328de26b35e1ec7e606fb0c4f8192d4bfcbaec
                • MD5 SHA1 SHA512 SSDEEP TLSH

                fi.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\fi.pak
                • Size 612KB
                • SHA256 53cca3552a8bf4ccc516103cdf929b5f10ba1859ccebe644bb080082faff6878
                • MD5 SHA1 SHA512 SSDEEP TLSH

                fil.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\fil.pak
                • Size 695KB
                • SHA256 3503fbfa400b23a3019005a2f1d7a31d623b056889a66abcaeb1558ad4316924
                • MD5 SHA1 SHA512 SSDEEP TLSH

                fr.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\fr.pak
                • Size 716KB
                • SHA256 a8db41476a1103bc5bfb617b150c6b6e2ca1eb24f534872c9c15e353649cd0bc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gu.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\gu.pak
                • Size 1.4MB
                • SHA256 947324c6aada6255df0c702114796436215f8012634a58b065b7ff3fc92162bd
                • MD5 SHA1 SHA512 SSDEEP TLSH

                he.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\he.pak
                • Size 871KB
                • SHA256 d06fb5dc66cc104503a861d2e4e6ef53e9172549c862aadeddcc2b5bb856f25c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                hi.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\hi.pak
                • Size 1.5MB
                • SHA256 a775f5724ccbe9bdfeefc448b42e3b48402f81404d94dea4252bfb765a314b96
                • MD5 SHA1 SHA512 SSDEEP TLSH

                hr.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\hr.pak
                • Size 671KB
                • SHA256 84c6bd6ce5bcd81a89b0908f22576725128e27688f6578d13d8b2f0e7fa6335f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                hu.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\hu.pak
                • Size 717KB
                • SHA256 cd1026c6596610617d8a313b899e9d2e2514d0cd1fbf97790f2c450309ede792
                • MD5 SHA1 SHA512 SSDEEP TLSH

                id.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\id.pak
                • Size 592KB
                • SHA256 4de71f7c766db79412dcc1f5521c5f3e678cf343327cc31b0fc28472102e0247
                • MD5 SHA1 SHA512 SSDEEP TLSH

                it.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\it.pak
                • Size 648KB
                • SHA256 ac12cbbdeeea05f0cf90cc57df1f6ef299444b1f499157eef8aa089f73da25f9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ja.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ja.pak
                • Size 791KB
                • SHA256 c737584f4b525c4d17cc2a79f0318640a7a666c43ef7aa24753551d1b75d7d7f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                kn.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\kn.pak
                • Size 1.6MB
                • SHA256 3eb9b3dda74b5e21abf7d7726cc2e682afd87141ee30a488e288695d48a5352e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ko.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ko.pak
                • Size 671KB
                • SHA256 bcc64be2004522a68a12dcfb6efb45f030d0badfe048220d2830b188e7f4135d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                lt.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\lt.pak
                • Size 729KB
                • SHA256 a7eae3ba06229763b85b29eb64e011b992679952165bb7239a9ece1d441de4ab
                • MD5 SHA1 SHA512 SSDEEP TLSH

                lv.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\lv.pak
                • Size 727KB
                • SHA256 8a4c31840217419f608b15eca1490bb4e83c5a896556a045f95af7f1390f5f8a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ml.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ml.pak
                • Size 1.6MB
                • SHA256 434221a29e71a6dfc6c14a5843713df51b2afe8cc3114cb9fedfbfdfc590ce4d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                mr.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\mr.pak
                • Size 1.3MB
                • SHA256 ae12ff8ac009a4991d71363ff442abb3beaef772d08e72f4ccd685403a02f332
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ms.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ms.pak
                • Size 624KB
                • SHA256 77912adf05407adf3dfd2b0eba269b1cb99d980dd0a16fae74dabea3a584a869
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\nb.pak
                • Size 598KB
                • SHA256 81b5a935f83a49ef4faf7132876e500a6cd49909c1d2b45d4bf1336769874b86
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nl.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\nl.pak
                • Size 623KB
                • SHA256 afc9e6696a40b0318ba96e786fe0b286c3ea9a2d548479c1fa43d96b1c137c62
                • MD5 SHA1 SHA512 SSDEEP TLSH

                pl.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\pl.pak
                • Size 696KB
                • SHA256 f92f6bff33a975e189b78a4cf0e153e85743dda432347745ebf8f1b4ff51a99b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                pt-BR.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\pt-BR.pak
                • Size 652KB
                • SHA256 d1aba0dbde99231d3096b7ef9ec62ed017c72804257de62ffb649d45cf234f9d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                pt-PT.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\pt-PT.pak
                • Size 656KB
                • SHA256 1326efcde830a8b29541c98fb51e3b5e5428d2a59e1b21a11a677317d08b2bbd
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ro.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ro.pak
                • Size 681KB
                • SHA256 7fd5b85509f67394eee48b07339c9a3a77fb1fb99b6204bae3209f9f0ffab3b1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ru.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ru.pak
                • Size 1.1MB
                • SHA256 23166d431d70048e248e3ff47732642cb1ab73f9516384e33ef3c1979574f2ff
                • MD5 SHA1 SHA512 SSDEEP TLSH

                sk.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\sk.pak
                • Size 708KB
                • SHA256 91037f2ecb636857b92a2729b7c116d8dd98082b068e4f78b0fdab06f27d2eb7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                sl.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\sl.pak
                • Size 678KB
                • SHA256 321ab341e3225dddcac858448367d43677c20e739b2ccab52f8c86aa0727d868
                • MD5 SHA1 SHA512 SSDEEP TLSH

                sr.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\sr.pak
                • Size 1.0MB
                • SHA256 7b337dcad390a9f08c3bd1d27235898e588827fa8da8808f4bc7012011578ef0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                sv.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\sv.pak
                • Size 605KB
                • SHA256 f10b4db7184a14f28bfdad82597d2d43b4ec859ab6eab59a5c3891aa6070f3ed
                • MD5 SHA1 SHA512 SSDEEP TLSH

                sw.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\sw.pak
                • Size 640KB
                • SHA256 726ba26363103920712874418cbfc23ce899c46ca8a6dc3ec9da0bf48355622b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ta.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ta.pak
                • Size 1.6MB
                • SHA256 fd8fe5c21a10e6542599e9148c8a30557c4d437b9606d6b29b685d474d89534d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                te.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\te.pak
                • Size 1.5MB
                • SHA256 28b85fa550df913e970fac8a599ec4963b1466e3b610350924518de107e41602
                • MD5 SHA1 SHA512 SSDEEP TLSH

                th.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\th.pak
                • Size 1.3MB
                • SHA256 cfd9e6651e9335fbc0483aed1098112234e973303bf7101d88e0518d3fb16ffe
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tr.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\tr.pak
                • Size 651KB
                • SHA256 4b047663f169169f3ccd33923782ae33348c37e5107314d3324f1850f3c5fb42
                • MD5 SHA1 SHA512 SSDEEP TLSH

                uk.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\uk.pak
                • Size 1.1MB
                • SHA256 3ebafedd5f6005f56a2d7a500e59bcb435e58a6013c7e075b241a91ab1c605ed
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ur.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\ur.pak
                • Size 981KB
                • SHA256 51c318f3df2673cb34d0df9235021dd1794073cddf59d14433620da1141ec650
                • MD5 SHA1 SHA512 SSDEEP TLSH

                vi.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\vi.pak
                • Size 774KB
                • SHA256 45c351251b938ea6f46305f2c324e8144bdf7500e08d430f8280b7db9e2ce52d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                zh-CN.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\zh-CN.pak
                • Size 554KB
                • SHA256 78837eb8a17d34e371ed72b7c7d9262876592f409fc66b293461c5468386834c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                zh-TW.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\locales\zh-TW.pak
                • Size 547KB
                • SHA256 fb77ff841f652f0ac8be02ce625559ae516c63081a45bde96f9277f241172eca
                • MD5 SHA1 SHA512 SSDEEP TLSH

                resources.pak

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\resources.pak
                • Size 6.5MB
                • SHA256 096373b7b5a9535b5ba60a37883d1d2010d28dafd90d4c819a902db09aef4ad1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                app-update.yml

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\resources\app-update.yml
                • Size 172B
                • SHA256 ff275def080229bfc8a75a08b67c072cacdc7a538fb01104c3c2e6a89e741e5d
                • MD5 SHA1 SHA512 TLSH

                app.asar

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\resources\app.asar
                • Size 44.8MB
                • SHA256 8c6febbdf83461bd8b0a2ea5209423857d52b807c778f850e4a7960989cb2968
                • MD5 SHA1 SHA512 SSDEEP TLSH

                icon.png

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\resources\app.asar.unpacked\resources\icon.png
                • Size 132KB
                • SHA256 ceb2210260fc5846582030fac047cf70fa012beb080d1b4c8c1ad0e9d2fa9783
                • MD5 SHA1 SHA512 SSDEEP TLSH

                trayTemplate.png

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\resources\app.asar.unpacked\resources\tray\trayTemplate.png
                • Size 535B
                • SHA256 4618ef51f1bade1b1f3662a0a28ff63a9534944a567ee9f815285cf9866a48af
                • MD5 SHA1 SHA512 TLSH
                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\resources\app.asar.unpacked\resources\tray\[email protected]
                • Size 787B
                • SHA256 5b509bb2dc0ae257405e2c35dd62138f123decf424174b37e99c9bcece79af69
                • MD5 SHA1 SHA512 TLSH

                elevate.exe

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\resources\elevate.exe
                • Size 105KB
                • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                • MD5 SHA1 SHA512 SSDEEP TLSH

                snapshot_blob.bin

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\snapshot_blob.bin
                • Size 333KB
                • SHA256 a578866594759d3c20b8fc40ca8f312c283a09113920ac14aea9c88ce0e8d9ba
                • MD5 SHA1 SHA512 SSDEEP TLSH

                v8_context_snapshot.bin

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\v8_context_snapshot.bin
                • Size 698KB
                • SHA256 ed5e979db2aef4a152758f2b9b7b06349a1d3d5dd687fdb96e2b3fb730a465e0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                vk_swiftshader.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\vk_swiftshader.dll
                • Size 5.4MB
                • SHA256 3738844133e89dc951e2167aac92e1491f34a385e54f36ad751ce604e5ee7964
                • MD5 SHA1 SHA512 SSDEEP TLSH

                vk_swiftshader_icd.json

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\vk_swiftshader_icd.json
                • Size 106B
                • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                • MD5 SHA1 SHA512 TLSH

                vulkan-1.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\7z-out\vulkan-1.dll
                • Size 932KB
                • SHA256 d8bd2d92c82fa28141fb911a7cacadd8dd7082b98258975727930ee571a43cb5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                INetC.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\INetC.dll
                • Size 238KB
                • SHA256 ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                StdUtils.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\StdUtils.dll
                • Size 100KB
                • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                System.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\System.dll
                • Size 12KB
                • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                • MD5 SHA1 SHA512 SSDEEP TLSH

                UAC.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\UAC.dll
                • Size 14KB
                • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
                • MD5 SHA1 SHA512 SSDEEP TLSH

                WinShell.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\WinShell.dll
                • Size 3KB
                • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                • MD5 SHA1 SHA512 TLSH

                nsDialogs.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\nsDialogs.dll
                • Size 9KB
                • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nsExec.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\nsExec.dll
                • Size 6KB
                • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nsis7z.dll

                • Path C:\Users\Admin\AppData\Local\Temp\nsk4439.tmp\nsis7z.dll
                • Size 424KB
                • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                • MD5 SHA1 SHA512 SSDEEP TLSH

                index

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\DawnGraphiteCache\index
                • Size 256KB
                • SHA256 afce6d3cd69ba6fd00fd1eebeb738b4fb5ebda69097537071d65ee96a1f2e469
                • MD5 SHA1 SHA512 SSDEEP

                data_0

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\GPUCache\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP

                data_1

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\GPUCache\data_1
                • Size 264KB
                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                • MD5 SHA1 SHA512 SSDEEP

                data_2

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\GPUCache\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP

                data_3

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\GPUCache\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP

                electron-log-preload.js

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\electron-log-preload.js
                • Size 959B
                • SHA256 06e0feb5d0a1232d31d93b9f3fd356951abd92beda7e99acd5dbbcb5a11a873b
                • MD5 SHA1 SHA512 TLSH

                sklauncher_logs.txt

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
                • Size 4KB
                • SHA256 f2c9b9b4dafdc0bc43c61d305d4f28cc4c45c8d9c60fc7d48e7b840315580265
                • MD5 SHA1 SHA512 SSDEEP TLSH

                sklauncher_logs.txt

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
                • Size 1KB
                • SHA256 47cb495b0867c44f5d4e617f66fc5ce2c696cec7611b65462142d5db29c2e77b
                • MD5 SHA1 SHA512 TLSH

                sklauncher_logs.txt

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
                • Size 2KB
                • SHA256 84f8a6f147973265b113a010574e716ff0e1aaaeab76392a0123857164fecb9b
                • MD5 SHA1 SHA512 TLSH

                settings.json

                • Path C:\Users\Admin\AppData\Roaming\.sklauncher\settings.json
                • Size 556B
                • SHA256 3f044be56f74b0d62d9e1079f55a32cb6d8170f0540ab1b9bd28f3f2110d6fbc
                • MD5 SHA1 SHA512 TLSH

                default.dic

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                • Size 2B
                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                • MD5 SHA1 SHA512

                memory/1480-989-0x0000021B3B7A0000-0x0000021B3D026000-memory.dmp

                memory/1640-44-0x000000007FA90000-0x000000007FAA0000-memory.dmp

                memory/1640-42-0x00000000065D0000-0x00000000065EE000-memory.dmp

                memory/1640-56-0x00000000077F0000-0x0000000007893000-memory.dmp

                memory/1640-57-0x0000000007F60000-0x00000000085DA000-memory.dmp

                memory/1640-58-0x0000000007910000-0x000000000792A000-memory.dmp

                memory/1640-59-0x0000000007980000-0x000000000798A000-memory.dmp

                memory/1640-60-0x0000000007B00000-0x0000000007B2A000-memory.dmp

                memory/1640-61-0x0000000007B30000-0x0000000007B54000-memory.dmp

                memory/1640-62-0x000000006FA50000-0x000000006FDA4000-memory.dmp

                memory/1640-29-0x0000000002FF0000-0x0000000003000000-memory.dmp

                memory/1640-28-0x0000000003000000-0x0000000003036000-memory.dmp

                memory/1640-27-0x0000000002FF0000-0x0000000003000000-memory.dmp

                memory/1640-31-0x0000000005D60000-0x0000000005D82000-memory.dmp

                memory/1640-32-0x0000000005F00000-0x0000000005F66000-memory.dmp

                memory/1640-33-0x0000000005F70000-0x0000000005FD6000-memory.dmp

                memory/1640-39-0x0000000005FE0000-0x0000000006334000-memory.dmp

                memory/1640-46-0x000000006F2D0000-0x000000006F31C000-memory.dmp

                memory/1640-49-0x0000000002FF0000-0x0000000003000000-memory.dmp

                memory/1640-55-0x0000000006B60000-0x0000000006B7E000-memory.dmp

                memory/1640-45-0x0000000006BA0000-0x0000000006BD2000-memory.dmp

                memory/1640-30-0x0000000005700000-0x0000000005D28000-memory.dmp

                memory/1640-43-0x0000000006660000-0x00000000066AC000-memory.dmp

                memory/3768-90-0x0000000007B50000-0x0000000007B61000-memory.dmp

                memory/3768-89-0x0000000007BE0000-0x0000000007C76000-memory.dmp

                memory/3768-81-0x000000006F2D0000-0x000000006F31C000-memory.dmp

                memory/3768-79-0x0000000006010000-0x0000000006364000-memory.dmp

                memory/3768-70-0x0000000002C10000-0x0000000002C20000-memory.dmp

                memory/3768-71-0x0000000002C10000-0x0000000002C20000-memory.dmp

                memory/4244-112-0x000000006FA50000-0x000000006FDA4000-memory.dmp

                memory/4244-104-0x000000006F2D0000-0x000000006F31C000-memory.dmp