5d7f6d20b4de8c600f81d64b4608bb65bccf92bfc72a727831c8785a63b68997

Analysis

user interaction
yes
max time kernel
1798s
max time network
1800s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SKlauncher-3.2.18_Setup.exe
Size 3.6MB
Sample260819-zepm7sshqa
SHA256 5d7f6d20b4de8c600f81d64b4608bb65bccf92bfc72a727831c8785a63b68997
MD5 ce6c0a2efa3acce48318f5576dfd8fcc
SHA1 aa01d1f64c0e189231b81eeaadd3697161b0eae5
SHA512 e7d29e3922824e871a427fd3914d3c7d6d29d41a8376e45c0bdcf2b74082a033238dea63b7ab0418ab3b02e974bc32391511142263576c3e246552eb5c59a8e0
SSDEEP 98304:8N663wSNFEOQwfBLbRn4QySeqtpTb9jytw27WUSrnsB:43w5OQwJLbVSGFn2SUB
TLSH
T17A060133B28A673EF06E4A3B56B2D2105D3B7A51A51F8C4696F44C4CCF2A0A01E7F657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

microsoft discovery installer phishing

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5104	SKlauncher-3.2.18_Setup.tmp
4380	javaw.exe
4704	javaw.exe
5792	javaw.exe
8008	javaw.exe
6292	javaw.exe

Loads dropped DLL 64 IoCs

pid	Process
5104	SKlauncher-3.2.18_Setup.tmp
5104	SKlauncher-3.2.18_Setup.tmp
5104	SKlauncher-3.2.18_Setup.tmp
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe
4380	javaw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1716	GameBarPresenceWriter.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
141	5896	msedge.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1965373649\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_871627598\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1956229038\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1956229038\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_577112518\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1373449919\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1994982857\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1186237218\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_522455980\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_479431874\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_479431874\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1328813553\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1170100374\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1186237218\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1965373649\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1956229038\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_479431874\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1328813553\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1186237218\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1186237218\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1965373649\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1994982857\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1965373649\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_479431874\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1504538019\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1328813553\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1186237218\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1186237218\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_522455980\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_871627598\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1956229038\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1170100374\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1170100374\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_814891950\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1956229038\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1504538019\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1170100374\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_522455980\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_522455980\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_814891950\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1008281276\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1008281276\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_577112518\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping292_1328813553\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SKlauncher-3.2.18_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SKlauncher-3.2.18_Setup.tmp

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3988	msedge.exe
5896	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4956-2-0x0000000000F00000-0x0000000000FDD000-memory.dmp	innosetup
behavioral2/memory/4956-12-0x0000000000F00000-0x0000000000FDD000-memory.dmp	innosetup
behavioral2/memory/4956-1444-0x0000000000F00000-0x0000000000FDD000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\	javaw.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	javaw.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316457583686950"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\discord-831593107883032657\shell\open\command	javaw.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\discord-831593107883032657\shell	javaw.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\discord-831593107883032657\shell\open	javaw.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{D6B711D1-A54B-4490-A820-47A827D9D8F1}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\discord-831593107883032657\URL Protocol	javaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\discord-831593107883032657\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\.minecraft\\runtime\\java-runtime-epsilon\\windows-x64\\java-runtime-epsilon\\bin\\javaw.exe"	javaw.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{8FE43DC6-FD01-4529-BA39-F1DA03CD9400}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\discord-831593107883032657	javaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\discord-831593107883032657\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\.minecraft\\runtime\\java-runtime-epsilon\\windows-x64\\java-runtime-epsilon\\bin\\javaw.exe"	javaw.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\discord-831593107883032657\DefaultIcon	javaw.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{43FFE136-2FCA-490E-9E55-67B271AC0FE0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\discord-831593107883032657\ = "URL:Run game 831593107883032657 protocol"	javaw.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
5104	SKlauncher-3.2.18_Setup.tmp
5104	SKlauncher-3.2.18_Setup.tmp
292	msedge.exe
292	msedge.exe
3236	msedge.exe
3236	msedge.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe
8008	javaw.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	8008	javaw.exe
Token: SeBackupPrivilege	8008	javaw.exe
Token: SeDebugPrivilege	8008	javaw.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5104	SKlauncher-3.2.18_Setup.tmp
3908	msedge.exe
3908	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4380	javaw.exe
4380	javaw.exe
1368	ShellHost.exe
4380	javaw.exe
4704	javaw.exe
4704	javaw.exe
4704	javaw.exe
6292	javaw.exe
6292	javaw.exe
6292	javaw.exe
8008	javaw.exe
7848	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 5104	4956	SKlauncher-3.2.18_Setup.exe	89
PID 5104 wrote to memory of 4380	5104	SKlauncher-3.2.18_Setup.tmp	92
PID 4380 wrote to memory of 1412	4380	javaw.exe	107
PID 4380 wrote to memory of 1828	4380	javaw.exe	109
PID 1828 wrote to memory of 4472	1828	rundll32.exe	110
PID 4472 wrote to memory of 3908	4472	msedge.exe	111
PID 3908 wrote to memory of 1236	3908	msedge.exe	112
PID 3908 wrote to memory of 5896	3908	msedge.exe	114
PID 3908 wrote to memory of 2292	3908	msedge.exe	115
PID 3908 wrote to memory of 2292	3908	msedge.exe	115
PID 3908 wrote to memory of 2292	3908	msedge.exe	115
PID 3908 wrote to memory of 3288	3908	msedge.exe	116
PID 3908 wrote to memory of 3288	3908	msedge.exe	116
PID 3908 wrote to memory of 1064	3908	msedge.exe	119
PID 3908 wrote to memory of 1064	3908	msedge.exe	119
PID 3908 wrote to memory of 1064	3908	msedge.exe	119
PID 3908 wrote to memory of 4628	3908	msedge.exe	118
PID 3908 wrote to memory of 4628	3908	msedge.exe	118
PID 3908 wrote to memory of 4628	3908	msedge.exe	118
PID 3908 wrote to memory of 4844	3908	msedge.exe	120
PID 3908 wrote to memory of 4844	3908	msedge.exe	120
PID 3908 wrote to memory of 4844	3908	msedge.exe	120
PID 3908 wrote to memory of 1448	3908	msedge.exe	121
PID 3908 wrote to memory of 1448	3908	msedge.exe	121
PID 3908 wrote to memory of 1448	3908	msedge.exe	121
PID 3908 wrote to memory of 5460	3908	msedge.exe	122
PID 3908 wrote to memory of 5460	3908	msedge.exe	122
PID 3908 wrote to memory of 3816	3908	msedge.exe	124
PID 3908 wrote to memory of 3816	3908	msedge.exe	124
PID 3908 wrote to memory of 3816	3908	msedge.exe	124
PID 3908 wrote to memory of 2980	3908	msedge.exe	125
PID 3908 wrote to memory of 2980	3908	msedge.exe	125
PID 3908 wrote to memory of 2372	3908	msedge.exe	126
PID 3908 wrote to memory of 2372	3908	msedge.exe	126
PID 3908 wrote to memory of 4388	3908	msedge.exe	129
PID 3908 wrote to memory of 4388	3908	msedge.exe	129
PID 3908 wrote to memory of 2756	3908	msedge.exe	132
PID 3908 wrote to memory of 5828	3908	msedge.exe	134
PID 3908 wrote to memory of 5828	3908	msedge.exe	134
PID 3908 wrote to memory of 5828	3908	msedge.exe	134
PID 3908 wrote to memory of 1528	3908	msedge.exe	135
PID 3908 wrote to memory of 1528	3908	msedge.exe	135
PID 3908 wrote to memory of 1528	3908	msedge.exe	135
PID 3908 wrote to memory of 5328	3908	msedge.exe	136
PID 3908 wrote to memory of 5328	3908	msedge.exe	136
PID 3908 wrote to memory of 4972	3908	msedge.exe	155
PID 3908 wrote to memory of 4972	3908	msedge.exe	155
PID 3908 wrote to memory of 4972	3908	msedge.exe	155
PID 3908 wrote to memory of 292	3908	msedge.exe	139
PID 292 wrote to memory of 260	292	msedge.exe	140
PID 292 wrote to memory of 3988	292	msedge.exe	141
PID 292 wrote to memory of 2380	292	msedge.exe	142
PID 292 wrote to memory of 2380	292	msedge.exe	142
PID 292 wrote to memory of 2380	292	msedge.exe	142
PID 292 wrote to memory of 5724	292	msedge.exe	144
PID 292 wrote to memory of 5724	292	msedge.exe	144
PID 292 wrote to memory of 3080	292	msedge.exe	146
PID 292 wrote to memory of 3708	292	msedge.exe	147
PID 292 wrote to memory of 5404	292	msedge.exe	148
PID 292 wrote to memory of 4108	292	msedge.exe	149
PID 4704 wrote to memory of 5252	4704	javaw.exe	154
PID 292 wrote to memory of 5372	292	msedge.exe	156
PID 292 wrote to memory of 5372	292	msedge.exe	156
PID 292 wrote to memory of 3236	292	msedge.exe	157

C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.18_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.18_Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\is-MR2OXEM2J5.tmp\SKlauncher-3.2.18_Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MR2OXEM2J5.tmp\SKlauncher-3.2.18_Setup.tmp" /SL5="$401C4,2154364,841216,C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.18_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe
    "C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe" -Xmx512M -jar "C:\Users\Admin\AppData\Roaming\sklauncher\SKlauncher.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\SYSTEM32\reg.exe
      reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
      4⤵
      PID:1412
  - - C:\Windows\SYSTEM32\rundll32.exe
      rundll32.exe url.dll,FileProtocolHandler https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A26669%2Frelogin&scope=XboxLive.signin+offline_access&prompt=select_account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A26669%2Frelogin&scope=XboxLive.signin+offline_access&prompt=select_account
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A26669%2Frelogin&scope=XboxLive.signin+offline_access&prompt=select_account
        6⤵
        Checks SCSI registry key(s)
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x260,0x264,0x25c,0x324,0x7ffb73ffc188,0x7ffb73ffc194,0x7ffb73ffc1a0
        7⤵
        
        PID:1236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,6454384292022352217,809416253645374756,524288 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
        7⤵
        Detected potential entity reuse from brand MICROSOFT.
        System Time Discovery
        
        PID:5896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,9447209319570182693,18085279756039456020,262144 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
        7⤵
        
        PID:2292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,5449173608982887156,13229717055477492677,524288 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
        7⤵
        
        PID:3288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,9384576433282473943,8249990854599538371,2097152 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        7⤵
        
        PID:4628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,7060957677025818452,13997268554216049079,2097152 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
        7⤵
        
        PID:1064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,7702026852320761089,15041994791937562414,2097152 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
        7⤵
        
        PID:4844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,16770676226503992333,14302043210789169996,2097152 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
        7⤵
        
        PID:1448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,1958530076671801026,2061180151538589064,524288 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
        7⤵
        
        PID:5460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5460,i,17652738876404036430,8872822959870906337,2097152 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
        7⤵
        
        PID:3816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,15080970693033057418,5235970904516907035,524288 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
        7⤵
        
        PID:2980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,4916529381875342157,11493366416871110660,524288 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
        7⤵
        
        PID:2372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,3415332151206448438,2668873778711471015,524288 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
        7⤵
        
        PID:4388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,17838585277069778104,13126871704833297475,524288 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
        7⤵
        
        PID:612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,17838585277069778104,13126871704833297475,524288 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
        7⤵
        
        PID:2756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6896,i,4671642051995910108,11512761601406744892,2097152 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
        7⤵
        
        PID:5828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3692,i,4329014075127828877,1504481006648182718,2097152 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
        7⤵
        
        PID:1528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,11231920346688935344,6105265285061986931,524288 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
        7⤵
        
        PID:5328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7092,i,14659137114897606188,13196916450638584646,2097152 --field-trial-handle=2508,i,3906453152552487581,5202125587768153570,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
        7⤵
        
        PID:4972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb73ffc188,0x7ffb73ffc194,0x7ffb73ffc1a0
        8⤵
        
        PID:260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,10891134324695026185,10554559581892851381,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:3988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,7812496987374802350,7683067497605734782,262144 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
        8⤵
        
        PID:2380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,14121065201220843778,12971397817768422717,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
        8⤵
        
        PID:5724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,16714145732069267328,16562114861509718086,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
        8⤵
        
        PID:1412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,16714145732069267328,16562114861509718086,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
        8⤵
        
        PID:3080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,6234565217966255176,8054318865401865330,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:14
        8⤵
        
        PID:3708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,1131020460822839980,3170093610896658883,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
        8⤵
        
        PID:5404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,11654735111325868596,3587018890477109111,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
        8⤵
        
        PID:4108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,6181085188100036536,16620985949522274015,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
        8⤵
        
        PID:5372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3208,i,784025680216516481,5387331925291820583,262144 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,5176436469186034493,7698924396043005077,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
        8⤵
        
        PID:3284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,18432466581060532830,14758012042945981655,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
        8⤵
        
        PID:7092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,12226482395196461186,16311471186101953131,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:14
        8⤵
        
        PID:5776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,10104431946334654876,6719648216446617531,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
        8⤵
        
        PID:5696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,15391831283901053436,2349962101787504595,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
        8⤵
        
        PID:5060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,14098956430457565441,3768916428894954222,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
        8⤵
        
        PID:2872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13787326595036591046,5702833967506677005,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
        8⤵
        
        PID:3728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3308,i,2895496130000691403,10473418789517072975,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
        8⤵
        
        PID:7064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,9755031598244450539,13666004754299565019,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:14
        8⤵
        
        PID:7620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,15240078426663594773,9564604241382365586,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:14
        8⤵
        
        PID:8064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,18011910152827749369,16237425922777023519,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
        8⤵
        
        PID:204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1108,i,3937247754026969785,10137635640678544637,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
        8⤵
        
        PID:6184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,9241545603963695391,14147830012900907814,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
        8⤵
        
        PID:7064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,14521235031852108916,6978557809650033464,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
        8⤵
        
        PID:7752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,16796520402373321128,16919400100081904254,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
        8⤵
        
        PID:5852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,11349728965677077322,61931899675235833,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
        8⤵
        
        PID:6244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,6114709571908973143,16650347157632246846,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
        8⤵
        
        PID:7076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3196,i,396786343099875571,14000315606445167236,524288 --field-trial-handle=2472,i,1106259458324614768,212897969343419542,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
        8⤵
        
        PID:7352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:3864

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D8
1⤵
PID:3856

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4240

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\60420e8d9c1a492c97797a70d15b2993 /t 3836 /p 4380
1⤵
PID:4064

C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe
"C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe" -Xmx512M -jar "C:\Users\Admin\AppData\Roaming\sklauncher\SKlauncher.jar"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SYSTEM32\reg.exe
  reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
  2⤵
  PID:5252
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4972
- C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\bin\javaw.exe
  C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\bin\javaw.exe -XshowSettings:properties -version
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5792
- C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\bin\javaw.exe
  C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\bin\javaw.exe -Xdiag -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=16M -Xmx4096m -javaagent:C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar -DMcEmu=net.minecraft.client.main.Main -Dlog4j2.formatMsgNoLookups=true -Djava.rmi.server.useCodebaseOnly=true -Dcom.sun.jndi.rmi.object.trustURLCodebase=false -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false -Dsklauncher.discordrpc=true -Dsklauncher.gametype=vanilla -Dsklauncher.minecraft=26.2 -Dsklauncher.dns=true -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump --sun-misc-unsafe-memory-access=allow --enable-native-access=ALL-UNNAMED -Djava.library.path=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550/java -Djna.tmpdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550/jna -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550/lwjgl -Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550/netty -Dminecraft.launcher.brand=java-minecraft-launcher -Dminecraft.launcher.version=1.6.93 -cp C:\Users\Admin\AppData\Roaming\.minecraft\libraries\at\yawk\lz4\lz4-java\1.10.1\lz4-java-1.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\azure\azure-json\1.4.0\azure-json-1.4.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\github\oshi\oshi-core\6.9.0\oshi-core-6.9.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.14.0\gson-2.14.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.3\failureaccess-1.0.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\guava\33.6.0-jre\guava-33.6.0-jre.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\ibm\icu\icu4j\78.3\icu4j-78.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\microsoft\azure\msal4j\1.24.1\msal4j-1.24.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\authlib\9.0.75\authlib-9.0.75.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\blocklist\1.0.10\blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\brigadier\1.3.10\brigadier-1.3.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\datafixerupper\10.0.21\datafixerupper-10.0.21.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.0.37\jtracy-1.0.37.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.0.37\jtracy-1.0.37-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\logging\1.7.12\logging-1.7.12.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\patchy\2.2.10\patchy-2.2.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\text2speech\1.19.12\text2speech-1.19.12.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-codec\commons-codec\1.22.0\commons-codec-1.22.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.20.0\commons-io-2.20.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-buffer\4.2.15.Final\netty-buffer-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-base\4.2.15.Final\netty-codec-base-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-compression\4.2.15.Final\netty-codec-compression-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-http\4.2.15.Final\netty-codec-http-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-common\4.2.15.Final\netty-common-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-handler\4.2.15.Final\netty-handler-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-resolver\4.2.15.Final\netty-resolver-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-epoll\4.2.15.Final\netty-transport-classes-epoll-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-kqueue\4.2.15.Final\netty-transport-classes-kqueue-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-native-unix-common\4.2.15.Final\netty-transport-native-unix-common-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport\4.2.15.Final\netty-transport-4.2.15.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\it\unimi\dsi\fastutil\8.5.18\fastutil-8.5.18.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna-platform\5.17.0\jna-platform-5.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna\5.17.0\jna-5.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-compress\1.28.0\commons-compress-1.28.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-lang3\3.20.0\commons-lang3-3.20.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-api\2.26.0\log4j-api-2.26.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.26.0\log4j-core-2.26.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-slf4j2-impl\2.26.0\log4j-slf4j2-impl-2.26.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jcraft\jorbis\0.0.17\jorbis-0.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\joml\joml\1.10.8\joml-1.10.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jspecify\jspecify\1.0.0\jspecify-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.1\lwjgl-freetype-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.1\lwjgl-freetype-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.1\lwjgl-freetype-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.4.1\lwjgl-freetype-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.4.1\lwjgl-glfw-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.4.1\lwjgl-glfw-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.4.1\lwjgl-glfw-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.4.1\lwjgl-glfw-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.1\lwjgl-jemalloc-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.1\lwjgl-jemalloc-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.1\lwjgl-jemalloc-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.4.1\lwjgl-jemalloc-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.1\lwjgl-openal-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.1\lwjgl-openal-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.1\lwjgl-openal-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.4.1\lwjgl-openal-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.1\lwjgl-opengl-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.1\lwjgl-opengl-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.1\lwjgl-opengl-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.4.1\lwjgl-opengl-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-shaderc\3.4.1\lwjgl-shaderc-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-shaderc\3.4.1\lwjgl-shaderc-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-shaderc\3.4.1\lwjgl-shaderc-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-shaderc\3.4.1\lwjgl-shaderc-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-spvc\3.4.1\lwjgl-spvc-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-spvc\3.4.1\lwjgl-spvc-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-spvc\3.4.1\lwjgl-spvc-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-spvc\3.4.1\lwjgl-spvc-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.1\lwjgl-stb-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.1\lwjgl-stb-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.1\lwjgl-stb-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.4.1\lwjgl-stb-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.4.1\lwjgl-tinyfd-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.4.1\lwjgl-tinyfd-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.4.1\lwjgl-tinyfd-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.4.1\lwjgl-tinyfd-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-vma\3.4.1\lwjgl-vma-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-vma\3.4.1\lwjgl-vma-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-vma\3.4.1\lwjgl-vma-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-vma\3.4.1\lwjgl-vma-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-vulkan\3.4.1\lwjgl-vulkan-3.4.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.1\lwjgl-3.4.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.1\lwjgl-3.4.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.1\lwjgl-3.4.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.4.1\lwjgl-3.4.1-unsafe.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\slf4j\slf4j-api\2.0.17\slf4j-api-2.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2.jar net.minecraft.client.main.Main --username robertinhoguloso --version 26.2 --gameDir C:\Users\Admin\AppData\Roaming\.minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.minecraft\assets --assetIndex 32 --uuid eb7641e5d4143d29b9e22f5e26eca1ba --accessToken - --clientId 0 --xuid 0 --versionType release --width 854 --height 480
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:8008

C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe
"C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe" -Xmx512M -jar "C:\Users\Admin\AppData\Roaming\sklauncher\SKlauncher.jar"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:6292
- C:\Windows\SYSTEM32\reg.exe
  reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
  2⤵
  PID:6632

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:1716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5916

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\.openjfx\cache\versionless\amd64\api-ms-win-core-console-l1-1-0.dll
Size 20KB
SHA256 89384f8f64a9b7f67c8deccaa721e2d76b8a17026d8083630859ed0cd1a9b58b
MD5 2c146bc8d73b8944f35506241b9953a9
SHA1 ac64abd745418cea35c0506b9cb0331b171b51ea
SHA512 02713948a156baccb2e7c38646193e82fef65400c086644866b698bc3e0a8c155a8eab829463e3868ce2b8a06608c5ea6de1e390bff976c5f92e2e42dd6c04f1
SSDEEP 384:WyWfhWoLm0Gf21MgKlx+YEL1MgKlx+YybT:AVRig8Xg8yf
TLSH
T151923AC38EBC9443EE976DB017A8D9837C3C9BC72910916515BAF5A91CC37D6EB0462C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 60f072ed20ea81d31dded90063848c3d97e0e03e1a70ca4e5ae53964d511cc4d
MD5 d2baf8df366dae2dddef46c559f7de74
SHA1 a45b7a24e762425a201edf2840d687ab22b62a7b
SHA512 5ab3fb201d7bb8ac581f96c336b4a434ffcde238ba2877d05db85d1b20c6b956d62d6720a8fe985d2dd511621dd3d400723d5cb009506f6cf2ea3ea9b0f4e011
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b27d5926cfe2be0df2c3ab0a124f348c5eb253e973fc38a3ca03eaadcf7cbef3
MD5 6563ca326dd50a243300796da9d50c31
SHA1 0d4d43573b95f9d9e1c65ad2f7c92f6b32990ced
SHA512 9deb1f97d55324c2ff327bb7db10c31b75b7273615d8da5bf9406145a33357de641f2ff564e30306b3b7170c1069a35d61484c42e78e5846e9636019c596dfd0
TLSH
T13FD0A76069E9F6E1E116153D8210021071996A92AA57620BA250451D9E3E1C356D94A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cf86feadd56e6ce2fbd82eccd0a5956e66f311646085c984381c10494e8dc40b
MD5 4609396f1778710c4a68f65de25473fc
SHA1 37c72f57019a17a1bf201b298c6b462224178719
SHA512 91ee7aa3990f242d19986637c0d852e44542538e690be154038c09d88f3427602dd1cd584d2e0997893b546304ea85d7a012923f6457fe246afbc82afcc9d53e
TLSH
T164D097B066EAA810C1070039C1102225319E6A90A823620BA140020D5D3F1C2A2CC027
MD5 SHA1 SHA512 TLSH

Submit Download

1f869447-aeb5-4297-8bd6-8acda866bcac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f869447-aeb5-4297-8bd6-8acda866bcac.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 aa0c2deb39f8aa74379a2251264d570e504df4611548fe6ab986834b0d872838
MD5 fc42dbb54224e8d2b6824c3a3602c626
SHA1 0298bb5e396e7d81a1cb49684f04a75c4d2ad38f
SHA512 08c5efd10a5e7fe96917efa9c9793f90f92795825cb7b35bd4c2fb0532456a6a5fb24b0f016cae68de5cf77c1a62c3f1bc769cab71dfca8ddeab32787652a685
TLSH
T156E026CE05CCC72EEA48695792BE470CC3813A1F92CCF9CA2B0C84887101848E3C7EB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d33a03b3e31f4b299d440ca8b65c00cf56f865a1e9a4e43e296f73b0eb18faa2
MD5 aee4bbae961a92337e3b782b85c3946b
SHA1 e9ab6df5e51af95b2dac643a16322513d64207f9
SHA512 66643b5684a392cba632e49d78b6c406b3040a1667abd417dbf0acc96d14246daec6abd2bbfc3693b5babb9af35e15af26def521f498bcf42944e1537646fc66
TLSH
T172E0208D04C8C71D7B44644791B9474CC39D3A4F96CCF9C5274C84C57105444E6CFA70
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6678ba83f4af23e51f704ded72359a7ee132467b6baae504908c48cfefe9bcda
MD5 91b5cecc3dc98bd18417cb6185ed61cc
SHA1 60cf2300172e6d2916545b364b8d4e0a2cc7e308
SHA512 baceb7321e1904ff6bccb14448001fe95e160bded74a688b62c28e392e4a42fe370ce9211e0a018b9161eaba108bb4b5541a91afe98da9e7863b7f002d6e1223
TLSH
T189615E0D6B2D85E8D73628B9A1E77849BAF08A7EA6C35A40C3805C708D57FF524D20E7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bffe8e3ec4e6155b0ced314d39358dd709bb26129dbafc4797bcff565d227718
MD5 4a097dc775be633a83433761898def86
SHA1 1c933bbd268236c769a04531070aad4903914b2e
SHA512 e9ef9c7372e2354cb3f9f109a4394ceb99133ffbea70c542a53246951feae279415ec5946ad9eda582d6f83192c8249c796d743e2147f9a72f562a2b4035bdd3
TLSH
T1A3719BF787B4867EDA1192F0EA086F1F8E1C0552432C795A85E0AE27D3F64B1E181B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5e7089685502bcdc61e346d12c4997831ba854925c59ceb67684b0ba63a3e013
MD5 90db1f101f57d24a2232f3915d2f39b1
SHA1 642c1c8a5fb4dbf7a3b0b9857698f2f4231a9d05
SHA512 40b23af25d31bf0190dba69d576ca0615ee930dbd6ee21163b8b6a4944f4ad0008574784d6af98de903453cfa1f36a6601ece238971b1c93a23f788369e32582
TLSH
T16C61ACF787B4867EDA1192F4EA086F1F8E1C0512431C785A85E0AE27D3F64B1E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f6c87a888825e2ba30a1b3273bdb8b4fdebb475b00754f95d2e97b0deaafbbfe
MD5 5b065303ca04eb2172c39a6f81d9bc81
SHA1 b18c4205319f0d0b6d698b5046e692a1016f7227
SHA512 a5df10f1cd964d397154f0741730d3690b1d6167271960c4413632b337ce03cf920dd914e28a4eadea02c9aef15629776b6b2353f45493a0a00b3932c161aed4
SSDEEP 192:sxRcRVyM/jK1Ml8wCC/fBsCuwGxzoA8ptR/g6+WNIrskg/Yo76CYOG6IgVPJ:sxRch8C/fBsCups3/5Ik/ddP
TLSH
T15162EB166A349D77CCD7D21DFA55BF93D2F5156392941E44AAFC8A0C00EABED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b5530ced1045ed2b106af40f515457d69a39f9ff8688f3f1bcd6688dbf074d6a
MD5 4f56effde0bf9606a245601a0bed4995
SHA1 4a68025af0e4bbc4c603ce9b9e9188bfe8f9ed84
SHA512 4a4c2359c73c0d98c67016ff7fa4cd024830d0c46cd0278e4708d2769ad2cc1e07f2b111e375747497d5937fecf82313fbddf305b90167617e96445654c64872
SSDEEP 192:sxR7RVyM/jK1Ml8UCC/fBsAWpVwu0ZmkLzoA8ptR/g6+WNIrNekg/Yg3eCY0g6Ic:sxR7TmC/fBsAWvwuKmkq3/5IM/TRP
TLSH
T12872D805A9349D7BCCDBD21DFA55BF53D6F91423A1901E44AAFC8A1C00EABED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7e74bad8cb2936fa2882fa77c77ba0de34394b728462089e35bdf42a88f856b2
MD5 fe863b82023849c82e1205643dcaa605
SHA1 456f1e69863f4e980e7c9b8990fb5aef776be1f9
SHA512 b27b4a294b0ace429c93ad507d36ad7a0778dbd1e04ce6f9b81a3ba6df4dc9504157aa31ce5d2926b922f593fc6d0a9635611305397abbe01f09fc9b08288bf6
SSDEEP 768:jXwHEo7pLuL7gRWgs2f728F1+UoAYDCx9Tuqh0VfUC9xbog/OVDVuGarockpe0Uu:jXwHEUE7gRWgs2f72u1ja84GRdCS
TLSH
T1F5E2FD7B680CCBBE4F404A9DEC29BD9F6D9802CB56D88D9447FA840C03C6BEB55164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c7a23f98d929420c6ba8d5f680e36172b6a20bca4a98bdad6899ff486452a068
MD5 e2352ce48d6439b6e491f12566861162
SHA1 afdac3b07f41f66ea6fa864cc952acce3f65a008
SHA512 b41ec0a5b2563405d5e7320121ba2ca592256060007ed7214a310ab6ffc42ff97f9c7cd608596e1e4c3072331cbb64796a7e07eec082f0b7a3667b23c89653e6
SSDEEP 96:KR8H8Q818x8H8F818ZW8B8u80g858ZK48wg838Zc8/83828p818qH8d8q8j8X8NW:CWLa2Q445IdGWWrgEN+W10m/Hc9oMmqN
TLSH
T193B14F01747A12543C7F6A4C81BE996AC2923463311CE46B7BB919B60F6BE224CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3f752a1-68cb-4f3d-97d3-f4c957ac453e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3f752a1-68cb-4f3d-97d3-f4c957ac453e.tmp
Size 414B
SHA256 5a2bc6571529aa31c4f51d4347488ed9e13f0fd14806a400ca224253e790b12d
MD5 7c41b0af839a237bb21d24d47f27c916
SHA1 e5a930fc2e25a52b02b58a0892eea309f0dffd80
SHA512 4da246ece90ed3b322e01ff541218b16d677936b4aa8ae168ddb9e054e62a4b446b1a4707a89948bdfd9dd1c3f34626ed49518bb685a0e4fed7ff88925d2d3b4
TLSH
T169E02BA5CC21EC3B59FD471854500B8BFB51136B2A424D0F3A3C860C8FB5637428781C
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5e3806.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5e3806.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 8f2aeda183dd4c287f8510ebef752efb354611ca24d88ee921c3393814867680
MD5 101800e360c50f8651c7c34d5bef1b0b
SHA1 eb3e334257512995c74e048da180c7c42acf72ff
SHA512 e21338419689507f63cccfe8804c064b269e2405b02509ba4bd7c13225974893be482c8b175b5676e793725ef4d1139b9678165092f3b088a0feb8362924ad17
SSDEEP 768:uFKM3RwgAqORpsOWPfONXyer1IRCzniez4MbCjhH6uHW:xM3wOfSIqnx4eCNH6SW
TLSH
T11B1318F988D3893BC8AEA387A33D6E0659BCC023B1984590FBD91E4DCC565BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c825578b09e6989bdfdb0710f4a2e00b35b4177950516c6feff27d08069b9240
MD5 b9794ffbdcdcb5079c846f91d1a34929
SHA1 d7a8940a75744c8095400cd10bc77d5058e91b8f
SHA512 92cfffbf862853ef71f8b403833ec3f08afafcf4b93096d05ff026a2e7b2377135f89ffa0d506003e58dd7b6bef46639c573c0a7e13912475aa628e6d69b1fb1
SSDEEP 768:hrv+4UNbdz31N/TBOWc8IONXyer1IRCzniBBeVH1SK7:hbsbV3vCSIqneEH1l
TLSH
T17203BF32A4A89E338DE2A3C5B14777477FB86057C6800B90EDDE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 995a3206cf40dcde5fcefff0dea5227f8ba03fdce4589f236569e123e27ae347
MD5 8585a19bde28ca8c8eb248c7521d0096
SHA1 7d842c2ca0809612f71f9e442b98f0f10014c925
SHA512 baf99bde5d835d2ceb7501653ca2d8544434b5b69824e1d042196a8581971fa16653baebed62c3736043556dfcee6d93e9b56d469ce329d26786a94c36a3c802
SSDEEP 768:CM3dky/TBOWc8nIONXyer1IRCznierf6uHW:CM37KSIqnZf6SW
TLSH
T135F2BE30E9959D334CE6E3C6B20777837FB82067C9C54A40DDEA6F5D048BA5E230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 69319d978c7431d2072099cd34680d133d9fa208720d2ea8627adb1d84403d64
MD5 7dd3e3020c5ad9fde3c3189f0b969184
SHA1 237c0ba65fb4abe5998008c2713ca4c2b4e34f9f
SHA512 3f4a5421af549b029fb4aa441b8cde27c5eb04fd7831bc94070a8eff95ad40288616e7bdae73f67d685b89edb2627aff2ab2aa26e89afff6267c342881c54cfa
SSDEEP 768:YM3E1y/TBOWc8nnONXyer1IRCzni9n49vTf6uuH:YM3VpSIqnOQTf6PH
TLSH
T191139C3CDD508D3F4CAEB38AB20E26562EB80237C5B58554EBE91B4DC47A95DF30781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f1f7e682a5e5a2c1b673c6c562eeb81cc4c5c780d894f6695c255240c838a538
MD5 77099083ddd9bd0317101cd34e45820f
SHA1 00ac44a27e092395ddd20f695f24b473ec284c23
SHA512 6732683868f292587d5497bbed5f335254bb3f42ced34853af6ae066dccc78ff6cc46071c4f991fa08186db3fd6706892f9b4a83d24d1bb8559ccbb3d3309ace
SSDEEP 768:OM3GBy/TBOWc8nnONXyer1IRCzni93f6uuH:OM3DpSIqnEf6PH
TLSH
T112F2AE30E9959E334CF6E3C6F10677836FB85027C5C55A409CEE6F5D059BA6E130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 735754bd70701c7e8fcc34c33b827656d31aa23f20ca41dbaf9a664dbe9b4867
MD5 89cdf5d7452384227525881aacd19604
SHA1 4fede1dbd7f006e24c5ed2bec1af490d35cecd92
SHA512 bcec03c364ae533da9265d5f49b7cccde70defba96519b27e3370d745a5c6155e04458915f47173d7d5d2bb1180c4f193963259e2f4cc4db0f105f162acc5f35
SSDEEP 768:lrv+4UNbdz3mM/TBOWc8nIONXyer1IRCzniw3eVH1SK7:lbsbV39OSIqnTEH1l
TLSH
T1C703BF31E5A89E334DE2A3D6B047B2437FB85157C6840B90ECDA2F8D069B59E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7d5acd06d6a282e0d2b464be22bce1eb55b3e341187cd5f7182cde2b7debb62e
MD5 615b2c014121b90e63da08c5e2c60f7b
SHA1 7487c42b6e2856be1a82c2f475e2ac359ebe92e4
SHA512 eb23a4f2de35f212aa89878d9424ad233e479197add1fd63e1bcf1e4cc685bc632d9c7cd5ec6dd0928b93b81fd3edd87e1201dd7694d83f5c8cb905819a53e86
SSDEEP 3:MsEllllkEthXllkl2zEflhTRKX:/M/xT02zeI
TLSH
T1824404447FC00C1DD5101031C053C3707374D4100513574734D14433DDC75400C10014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0e2427c94f170f6dda5a9a85ddaaa0dc0088899c19efbb73c05e3598cb541423
MD5 95ac3c4f8946991b2f4b965a390aa896
SHA1 864730b7c80ff406dcef7eefce17b842687c2bd8
SHA512 b13343c0c56d9943ac874eacdf49f82ad4ffcf8be1ca55600fbc7e0ba55c6203da11354a956eb54c11ee241672e2d8c66d8469e722cfb0c0129f0dbbe3c2167c
TLSH
T1942112E0183E1AC2D5BE0DAFB0872AED50DC9612F8D834382898FD68967E51D2550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
MD5 bc900814bda342e30ca622ecf6edf1a1
SHA1 58549077a989da91156012baf9dbfc98ecfe429d
SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
TLSH
T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 824de99fb2d26a9652ce4d147d41b5f42d8eb58933629e98754b359ef813de81
MD5 c854428d46d0bd8106d3a4b26b2c17af
SHA1 3414466742a52757c163c28cc508953129b9067d
SHA512 1de7dd4e62a741fd98b414fa13966befbe757d57478e2eca3d9d49fc11f15eff8310633888dec1ae7c7fd5ab938d39ed341567261f568dc0a1838e5acd6da636
TLSH
T1E93122E0583E19C2D1BE0EAFB0872AEC50EC9211F49834382899E868967E51D3550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7cffb53aa771e330cf6f2977045f4c8ed1482ca623c76ed54436c17c2fb3bc34
MD5 ee65d1478524f0ac6ac8e7a8633e1f28
SHA1 db2a1937caa4e9bc70d10bb859b484d651b81b83
SHA512 93985d792fc252309e3ef2a80dce6d338aec723461976ac2981393e36be3ec0d737a217f3001e99a8d119bd9ce4f8bcd72a9ea424f5554c2ea0be0c7bae636c2
TLSH
T15A3110E0587D1AD1D0BE0DAFB04729FC44D89212F8A434386899E9689A7E51E255087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
MD5 5791c60bac582e1f169aefd7494e8b65
SHA1 fc220a11a5357f3b3134686ea018f8327ad6720a
SHA512 7ea314ea2431da694bb2d6ab59852e9e0458aedea4693b1d78718c5a54c1c97849afbf8992b044f2295319673c112e8e40e08f8732d473893c556cad7c1d8183
TLSH
T12A2111E11C7E1AD2C5BE0EAFE4833AED50D8A616F4D834381888FD68A63D51D2551C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 eacf1adcab56ea7707951a59a1d5415c83ac02e038089cf23fd24d14c5a52cf2
MD5 13fbadbf74e4028d922652c3b1fb7281
SHA1 2cd5239ea161b2a994b9b84a77f0296997a22ea1
SHA512 c1600d8593594bf33e8eea3c0e9b7153a41c3ed3ee25dc39ca5b63f2eb3a021af51fb979ffea4d93c39aff5ea2b0e6b4348c8eaaec269e725dc1eb353379cb59
TLSH
T1A43153E0583D19D1C07E0DBFB08729FC40DCD212F49434382898EC68967E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

6476c564-fd68-4f07-a25b-86bd013cfc40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6476c564-fd68-4f07-a25b-86bd013cfc40.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

+JXF11634864520207496041.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF11634864520207496041.tmp
Size 405KB
SHA256 0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1
MD5 8f2869a84ad71f156a17bb66611ebe22
SHA1 0325b9b3992fa2fdc9c715730a33135696c68a39
SHA512 3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834
SSDEEP 12288:k9zC2w597PziK+bSvkK3sgUN8HkC48AeIVMhQ/8:e4iK+6I/8
TLSH
T1FF946A1BF701E70ECA562C388AF59BD033B9BC91791EE24B705A3A09DD971B40AD71E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

+JXF1331864276730979161.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF1331864276730979161.tmp
Size 398KB
SHA256 1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1
MD5 ff5fdc6f42c720a3ebd7b60f6d605888
SHA1 460c18ddf24846e3d8792d440fd9a750503aef1b
SHA512 d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3
SSDEEP 6144:oeroPfXwF22mZ8JWPziKSQYfW0LXYveHt+47O3YqF5nxeU2h8jjXVymj3k4yhb18:ovw22mZzPziKYW0jYves4I2n8
TLSH
T159945A17E716D70DDE162D348AF28BD533B9BCA1791AD20BB05E3A59CD831F80A871E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

+JXF17837676604214036214.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF17837676604214036214.tmp
Size 404KB
SHA256 6bdebeb76083e187c7ae59420bfc24e851edb572e1a8d97c1c37b7b2dc26148c
MD5 4154321279162ceac54088eca13d3e59
SHA1 5e5d8c866c2a7abfd14a12df505c4c419a2a56f7
SHA512 04ca175774cbe3f2d83543c01cc388e2715ab7b1378143db41bacdc7e7eddf05d3beef476f6acbe7ddeb34861984efb5fd7f299ec1820697c440b372d258aee7
SSDEEP 6144:s3unFMi82w/+qnJWPziKSQSzzY6XqYQ0rBfmPbPGxGl36DNoAmFFhGj3k4yhP18:s3uV82wWqsPziK4zbBOPb96DNAV8
TLSH
T113945B17E706DB0ED9092D308BF887C433AABC91792AD28BB65A3A54CDD71F41AD71D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

+JXF4426754754119070179.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF4426754754119070179.tmp
Size 397KB
SHA256 64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123
MD5 fdb50e0d48cdcf775fa1ac0dc3c33bd4
SHA1 5c95e5d66572aeca303512ba41a8dde0cea92c80
SHA512 20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53
SSDEEP 6144:sSnv4lXwF22mZ8JWPziKSQUmeKGVOOxAdgwH9evDFDynor51EOO2UAGbzxSr1w7b:sSvJ22mZzPziKwLOOkvH9IQoUf7P08
TLSH
T130845A17E70AD70EDE452E308AF987C133B9BCA1785A924BB59E3A58DD971F409CB0D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

+JXF5214191509635135068.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF5214191509635135068.tmp
Size 393KB
SHA256 4c392dcc8ad916f0f9df7559ab5563b01dd94f9f3b2db34617fe392e00060339
MD5 b97f16379b4c106616f60f702733f5c6
SHA1 85c472fb9a7f256643bc4bba10f158dfaa1d1e8b
SHA512 d124af2c705b97cbb307497f88c47a5f7d320174d48626ea14ac27d42bcf8016f32810cf7ecb6af1261297b8c331a6ea89e2e35c3e2536390d8d6e500ed8d61e
SSDEEP 6144:FZbewyXwv22mZ8JWPziKSQQQbdiJNnL1qIPQyC4JRPeQQFgppInr/qwAWJBIF072:FZCU22mZzPziKPd6PQgcgpa/nMF07J8
TLSH
T1C5844917F702E70EDE4A2D344AF58BD933BABCA1392E9217B45E3A59CD931B409870D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

+JXF8457038614003392644.tmp

Path C:\Users\Admin\AppData\Local\Temp\+JXF8457038614003392644.tmp
Size 401KB
SHA256 1bda81124d6ae26ed16a7201e2bd93766af5a3b14faf79eea14d191ebbd41146
MD5 a473e623af12065b4b9cb8db4068fb9c
SHA1 126d31d9fbb0d742763c266a1c2ace71b106e34a
SHA512 1fbc2841783140fe54f3ab1fa84e1ded2534bcec3549ade2f513491b32178df515bd63a0a4a2c35017a6850ff9c3a24f8602357d912acf8ca92b8d68ba846d3a
SSDEEP 6144:D0RV3jlWkDOh9oC2wuhsJWPziKSQlRiFy34YmkCD9oI0+msvMlwt5BO2x28YzWDQ:D9SxC2wuhDPziK2yIYmkCCIPmsHI8F8
TLSH
T148945A17E706DB0ECE562D34CBF587D033A9BC91781AD247B16A3A19CE931B40AD71E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SKL_TempStyleClass17676293375059206015.css

Path C:\Users\Admin\AppData\Local\Temp\SKL_TempStyleClass17676293375059206015.css
Size 264B
SHA256 203015cc925d561820d225a795e1c6a56e49ff12fe4c874709e717335aa0dc18
MD5 efc4d8d677045102ef5d0c9dad45e9ab
SHA1 b09108160f0b41463c8b49c3154709867803b7ba
SHA512 a67beeafc15cef58cdd0d3d26445ca2cf6eea067320909deaa8a3d05452eec4ea8140b70d67a305ef3a376b5eb52590305240130853e594541bdadb88c226a12
TLSH
T1ECD02B3C2216F0A3D02FD8EA3CDCC2425424B11641F0A64C38819704CF8C42F59F2815
MD5 SHA1 SHA512 TLSH

Submit Download

flatlaf-windows-x86_64-7663574189300.dll

Path C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-7663574189300.dll
Size 33KB
SHA256 390ed515d10c94bb91e30012d4ef5545f9ebf5fc20c5c5c9c28b8ea16bf4af60
MD5 e200ab2783cc152b78cbdb9346eddb08
SHA1 7b612077e66087b91c7dadf47daa702d968f6b02
SHA512 d2847e47b96fafe44b86734f8e5aab3d08a7ea036b33425bdd926ba3e2fe08d6b01e438add406d77d916ead7a90b31c4f623508964fb5c6332dd2816de04e048
SSDEEP 384:ygPOV1Nv9yF7REmEsjAsTuCzlDZcuFODU6eC5C0mB2Qk3tK1RaEypwKNsOfJX9SX:J+s1PE8A9O0uGUT0tg1RfneJs2E
TLSH
T12BF27C566B349894DD5B887CD0E11F5BDEB1307223109ECFB2A4C2586F63BD22A393D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imageio12869374217693556160.tmp

Path C:\Users\Admin\AppData\Local\Temp\imageio12869374217693556160.tmp
Size 1KB
SHA256 face76c9c4fad9476a1d80483d41772c805808a1383012b1c22065e30d32ede6
MD5 4bc22d05b225a34a3ddb4f17d2469b77
SHA1 11a7a273129b3deb9cd2c77ef1834b5643469d3d
SHA512 e00b03ba7550af9676c56c1ae39c00ccbae42a06011b37e3faec174ee1eda3dd16a223194824ba3f11e7d8bea78e74991af31b51a9066c3941864e13c91c45df
TLSH
T1B721E7D109AFB543C80B49738AB60C92DAEE59BB7717A84442F7742D0C1C64921B7B6C
MD5 SHA1 SHA512 TLSH

Submit Download

imageio16246741182977778527.tmp

Path C:\Users\Admin\AppData\Local\Temp\imageio16246741182977778527.tmp
Size 12KB
SHA256 0801cc8ccae927add5f44b56ee8bfef75d638625b05328a9a1ec7bf39589d63d
MD5 a9a4ecf8ee9ceec10cdd956eb1f185b0
SHA1 a96e1b143af505fa7e2416f6d5e21983bdefc605
SHA512 e4f6bbfe67d05cec9e1030eb5f4a0d904447e56a27d55839040ae78798058352ffa800e8e4ab442d6b930044289c8801eb83c3d3d0155945ce84f2157f8b10dc
SSDEEP 384:x5N0luefjglF/2n7HUR2rWUvx4ZmMUcT0KtOqtcZ+ST:JT2ny4L5lLKtOqtcZ+ST
TLSH
T1F942B0E2A0825F55807A18A05649B3F6C6D3076AF7460037536EAA1DDE4B03BB0979FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is7z.dll

Path C:\Users\Admin\AppData\Local\Temp\is-JIQTN0A0K8.tmp\_isetup\_is7z.dll
Size 971KB
SHA256 f97cda058bfe97a7e9ced5cde7018bbc26e35155c3c7405c6146808f8d06806d
MD5 e61d992e2fdcce91e7cefc7f2b4e25ba
SHA1 d3331673e9f0e8bdd6f44774c46f2ba69b94aee6
SHA512 b2213c1b15000fdbb6e5b4e00c916633237397de34799651193c046937b0e01ceb31d8c42c4ce6d63aabd34ce54574f250837e9aecc58d1505943543292e7655
SSDEEP 24576:Vu7+5bgfJ9DpAuwNrpH3XysiHAwor7XVq:wAI3wNKHAzrE
TLSH
T10F25AE12B7EEC1F8CA4E15305A3DAB59167DA39807108ADBA3D02E9E7F309D2D735E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-JIQTN0A0K8.tmp\_isetup\_isdecmp.dll
Size 28KB
SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
MD5 077cb4461a2767383b317eb0c50f5f13
SHA1 584e64f1d162398b7f377ce55a6b5740379c4282
SHA512 b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
SSDEEP 768:BD7FEAbd+EDsIOmF+OiR9rikW/F+M9OAriXiRQU:M07sIOYRiPWkWNl9WXil
TLSH
T197D24CB31E692BA2EDF95E3492C9162FCD72B3811E4504B3707CC5865A933652B291CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jre.zip

Path C:\Users\Admin\AppData\Local\Temp\is-JIQTN0A0K8.tmp\jre.zip
Size 47.2MB
SHA256 a72b61a7902ea2baf940fca8e89913e2347b98c294943632a4f9621c0226e684
MD5 253e308ecfce3be809f2e85d6513791d
SHA1 0f69fa59c5451b47e3ba1bcaf3c1f130e41b3fc7
SHA512 4ff2e9112fcbf5882bacddb5bd1a4a9ec3748a5d399a7184d4f330d97a7877d91d064271d5b60de663bef789f81d43fe4516c572c115f53d3c261d83d5951931
SSDEEP 786432:yShl6HSa8vtYbT0XH4DQ/OGejjjGFMX94Xktl4JuH4KqGsrpQ6hGhjiKzrrrrrr0:yShlXa8FiT0X4fGejjyuX9SkgufsVTgi
TLSH
T135B733101E2C05D2DB0ED9F8E8015E9D50F736C99ACE287A4EF316E429918E4DBEDC5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-1K8MHNNLUO.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JIQTN0A0K8.tmp\zulu21.46.19-ca-jre21.0.9-win_x64\conf\security\policy\unlimited\is-1K8MHNNLUO.tmp
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

is-5MR0K6W5I2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JIQTN0A0K8.tmp\zulu21.46.19-ca-jre21.0.9-win_x64\legal\com.azul.tooling\is-5MR0K6W5I2.tmp
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

is-TXPP8IJKEG.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JIQTN0A0K8.tmp\zulu21.46.19-ca-jre21.0.9-win_x64\legal\com.azul.tooling\is-TXPP8IJKEG.tmp
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

is-YS94V1Z6WK.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JIQTN0A0K8.tmp\zulu21.46.19-ca-jre21.0.9-win_x64\legal\com.azul.tooling\is-YS94V1Z6WK.tmp
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

SKlauncher-3.2.18_Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-MR2OXEM2J5.tmp\SKlauncher-3.2.18_Setup.tmp
Size 3.5MB
SHA256 942c7f45e3ee02dae9acc679d028a7a0322d28107dbd06750e803a9e35a019dd
MD5 f1d9fbe8974225c394a5108ec2a0eac8
SHA1 76a9a0c7ed2cd7d1c8a015b1fcf52385162df3e2
SHA512 493f7cebccd245afd6a26c24f4d76858d3e9917d9f0c8fad161103d2109bd3a2e6c421e12618fd007f7b9107e1cfaed4ff5cf2d26bd94288327f2b06b0605ad1
SSDEEP 49152:W3SA9I3bZxTZElVySH6UNoO7zjQynN4s7UUZyE8eECaN2MD333LM:WCbWroSkynN4sQ+TdMD333Q
TLSH
T19E067D13B388643FE06B1A395837BA54583F767229168C675BF40E8C8F752842E3A777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna16329039595574132588.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna16329039595574132588.dll
Size 267KB
SHA256 5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
MD5 2d2475f1f026dd54e9f3e787ae4f81da
SHA1 27ff882ac271db547aee520b38e3ba9aa91e136c
SHA512 07ef110d202d51f096a8b474d25c66b93b16af8b2ecdbf3ab23138273a0771c94dda6426fb644d43dd26cf53924f37821dca4c539d889d435185fff2198b3e76
SSDEEP 6144:cZkI0LRMj+xkFxdHuGL0x65sz7QZBx4Cp+slm/mgye4:cZX095x65sz7iP42
TLSH
T1BC441917A7B648E5E9B7C03D44236A16F6B178294320EBEB47844A531F73BE09B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3908_1410026416\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_profiles.json

Path C:\Users\Admin\AppData\Roaming\.minecraft\launcher_profiles.json
Size 830B
SHA256 81270d0b8d6bb345e4f264c6b42129231f1a115211b556e856dee53dfb7abec8
MD5 d8a7e60db771e9b1887a7b06f80ca427
SHA1 d03fc8f87e5493fd85614e1940b0116366b15f26
SHA512 d52c90fff1ef0f764119eca433fa9fefbb42715004dec5c34877abbdae4ef932634956cf4db0824c4468bf8868c15d902047381ccb0bf77f5959952fea034880
TLSH
T16501F9A8DCA69C5B088A2976843E0B43E674A453CE193C987FCC411C5F5CE2D087A75A
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_profiles.json

Path C:\Users\Admin\AppData\Roaming\.minecraft\launcher_profiles.json
Size 530B
SHA256 7a4d69f5e58e7382bf0abf9d12d71de503845e8c7333bdb60b9843d017837054
MD5 fb18ad7f77455800f8b906148eeb4481
SHA1 dea878aa9e2fb5a0e76adc3f85268d98381805e9
SHA512 f491c4a7b292ef02c8bda70d20574efd3f91e31625f72cd3eb8a2975a1c1c6c69e5d9aa6d26e041ed25c6a2167844350db3e2fa5f232fc16a2cb152447834fab
TLSH
T11CF0B4A5C8EA5C8B08C929B5D03A4B43F321A843CD193CD8BFCD465C5F4CD1D086A75A
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_profiles.json

Path C:\Users\Admin\AppData\Roaming\.minecraft\launcher_profiles.json
Size 530B
SHA256 3b3b182583b5427ecb7aa59d1e9650ddf0377b22d5d5d38edabd2aac924b38f3
MD5 dc8b448e41cee885b2c6d1fcaeb4d8c3
SHA1 715bc331ac1da927fb4f576ab398fe47f30cc623
SHA512 295cbbfa9c0cbd81cba686035f56bbd293955c9cb6ade611af8ecfaf9121536fa44a2c1def3cd5323ccc521f1d2d89c109a7a638f60d0f8962d482f6cc02c73b
TLSH
T193F0B4A4C8EA5C8B08C929B5D03A4B43F321A8438D183CD87FCD455C5F4CE1D086A75A
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_profiles.json.tmp.1787172193165

Path C:\Users\Admin\AppData\Roaming\.minecraft\launcher_profiles.json.tmp.1787172193165
Size 530B
SHA256 426aa299edbbb0cc5a38a5bb140426642970c3493bec1b58780136afc88c0a8c
MD5 e45c164ae5db5b9a7516408cacc67718
SHA1 98b1a3e8757c5e0a6015c7462947f1452b026f35
SHA512 ccc8d7c573f7fbfeffa7b295011b74b61f8e29ea111fd56b6fab208f5cae7adc6d067fb33f3c73b1e481c0275d89fa0a2850be0e1bf7daf3f0413640cd747f75
TLSH
T172F0B4A4C8EA5C8B08C929B5D03A4B43F321A8438D183CD87FCD456C5F4CD1D486A75A
MD5 SHA1 SHA512 TLSH

Submit Download

jmxremote.access

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\conf\management\jmxremote.access
Size 3KB
SHA256 0c25d26ee212ca1e8c33f67c3c460d43fe849c3a1d23dbe341148517602b280c
MD5 5880f5255cf159b204761cf24be76061
SHA1 db484eb763831db19c089c9820a54cc875e4f624
SHA512 64d33add796d2d3df7ad37aa452ee1d106174be1ade3063d73ba416211629a9a9b05177969404fdc92fcee8458450c9de4a6195744b93131303208cb6f1416ad
TLSH
T17A812007F78607730BC6621B1A0D53E2F611C17EFE630608791CE97877579AE02E7961
MD5 SHA1 SHA512 TLSH

Submit Download

jmxremote.password.template

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\conf\management\jmxremote.password.template
Size 5KB
SHA256 0273b6a6b9e20e6ce54c5aee70164028e0395063b2b7d39060a40b6495543dbf
MD5 ad773cfd53efe03e662f1cf23561f725
SHA1 3bad5b040b6d7117df4c40609ea0f8074339ee47
SHA512 e6794168ba80a8ff733d8c1771930ae8c8fc33030e5e9ca02700f326c88a2f68ff09bc734bfd1e492ef15705b288c7918ce1f3f7174742dee6a62dfe086abd65
SSDEEP 96:MdJb7RT9iQj/y3LNNWoT2Wjb3LpjtzIVSnQDeJuV9uiS2T4Z:059ipz1nlZzIVSnQDeJqpSSO
TLSH
T151C1F0126FC52B620B91E354134EA5E5F718916F6E7B0210266CCA2C332BD6641EE8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\conf\net.properties
Size 7KB
SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
MD5 1f251a36eb37913b696b5be5595e1cd0
SHA1 412fed5d460c414583b16f41e1ebe4262c239af1
SHA512 7a24d898e68c2a7f229220074c510910e7257dd11be33cece3ed4f630552934f6968aa310bcf956a30baf610528cd251f233bad32fd0921ece2c171a7154e2a5
SSDEEP 192:/LVGG4f4z346et5m27Sn1gTe93hf7k9SrnF:ZGxYCU1gY3hzk9+F
TLSH
T142E17283BF46B7354399C291E21EA7EEE32C913D4C33B5B831AC850D2619C76427F4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.txt

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\conf\security\policy\README.txt
Size 2KB
SHA256 6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5
MD5 3d47d94bc4f19d18bcc8b23f51d013af
SHA1 a97cd312d6a2a9c8c780c15e5af51a2f4f97c2cb
SHA512 68a031264cf9442526307364ca74b336af55564c233c2f514cac48e910022767562f8ff6a64bb9cfcbf0fb5e755289273382c9246418a4b9207fc7761d03c64e
TLSH
T17C4174077E4EDB3204E3C0D36A6A92C1D361A29AB2A5121D750D425C3BDCB3083BF193
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\conf\security\policy\limited\default_local.policy
Size 647B
SHA256 2b2627548e61316150d47ffc3e6cad465ca05b3cccd4785eb7d21aa7baa0f441
MD5 6d7b4616a5dba477b6b6d3f9a12e568f
SHA1 7fb67e217c53a685cb9314001592b5bd50b5fbb9
SHA512 a0b98cbbb49184df973bb2c4a506e9bc6e025a696bc0c8054a6352cc3f9b4a38e3baf117c6834ddaddc38498556607ed4eda8f1bc683f662d61da50e0db0c8c2
TLSH
T18AF0310FEE49FA740998C1567B3DDE07D175A11771940B69F31CC0601BD8EA0D791B96
MD5 SHA1 SHA512 TLSH

Submit Download

exempt_local.policy

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\conf\security\policy\limited\exempt_local.policy
Size 566B
SHA256 8c3d7648abcd95a272ce12db870082937f4d7f6878d730d83cb7fbb31eb8b2c9
MD5 4cbb03f484c86cbea1a217baae07d3c9
SHA1 ee67275bc119c98191a09ff72f043872b05ab7fd
SHA512 2bd70518aed6b0e01c520c446830c5f567fa72974548818cac3e1e5c2be6f03db78ce6012f5463b1e19c36243d04cbaad38ec79524635eaae2e427eb1875ccdb
TLSH
T1F7F0811FFB19E5F564C4DB920776B84DA3319AD270B0431CF546C1942B94911C3325B5
MD5 SHA1 SHA512 TLSH

Submit Download

sound.properties

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\conf\sound.properties
Size 1KB
SHA256 299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
MD5 4f95242740bfb7b133b879597947a41e
SHA1 9afceb218059d981d0fa9f07aad3c5097cf41b0c
SHA512 99fdd75b8ce71622f85f957ae52b85e6646763f7864b670e993df0c2c77363ef9cfce2727badee03503cda41abe6eb8a278142766bf66f00b4eb39d0d4fc4a87
TLSH
T11A213B3F770AA55F17D600B839BC8A2F91CC0A3E5D63A4C028AC4301BF4A8876D51E46
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.base\ADDITIONAL_LICENSE_INFO
Size 2KB
SHA256 a69bce275ba7a3570af6579cb0f55682cd75fedfcd49e0e8e9022270c447c916
MD5 71bb3ad0017bf36d14bb96a8d4b32c45
SHA1 1a5c553e71bdb7d94995b206bc9eaa49abd1e888
SHA512 9f658dfea71bdc3cc1549edfb5ad3171dbfa0082b2d91e820c09abe0b376b6bcd8b5170442a5e25e72274e98f130176bbdecfa7997c59705782b214f02136a20
TLSH
T129413262958513731BD200EA2E1C58DEB29D65BCB3190960B8D9C15D335E826C7BF3EE
MD5 SHA1 SHA512 TLSH

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.base\ASSEMBLY_EXCEPTION
Size 1KB
SHA256 75292f03bf23d3db7c985aecc191029b93883200721ed23ed34a2e601463df33
MD5 d54e5b1b11ce92d8abc22e8e756f54bd
SHA1 515a539c34f00a4bd68500033ea60f5a45e3adfc
SHA512 5516e2e9eb3a555562f600cc3cd85ae01004962a8af8c49d2598281ce622bcbee7a4bc513b94b05e3b611bb50611360171e21bae9c1b3ed7d05a0867de7d3bb2
TLSH
T13931FD36C28416734AC314625E182ADAD7AF5C2D3FD00561B89CC2CC1699A35D33A7E7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.base\LICENSE
Size 18KB
SHA256 4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
MD5 3e0b59f8fac05c3c03d4a26bbda13f8f
SHA1 a4fb972c240d89131ee9e16b845cd302e0ecb05f
SHA512 6732288c682a39ed9edf11a151f6f48e742696f4a762c0c7d8872b99b9f6d5ab6c305064d4910b1a254862a873129f11fd0fa56ff11bc577d29303f4fb492673
SSDEEP 384:sY2fSz/rGvS/66YsaZdIP3Lf4vAkMVhPGkupdDdicW:7vuvVmjkbylupdDdiZ
TLSH
T10182A62F770503F205C302A16A4F68DBA32BD5B9722E11646859C19D236FE35C3BFAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aes.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.base\aes.md
Size 1KB
SHA256 45c6d4da48325edfbff3dcf71c704e504c057904435ed23c6d57046d551eb69d
MD5 2e33468a535a4eb09ef57fc12a2652d0
SHA1 e64516f3fa1e72f88caa50f14b8046dd74d012b6
SHA512 4d14b5ddbb4d09797264ed29ba71fab6986b4a9e75efb9402c1476e0a9e2884813d6a922dea125643b4f74e1f3e458f4e48d6c840e0f4d16ed72ffbc4611dbb2
TLSH
T1FA31776B114447F752E21AE5399299C4608DD03F3F235D083C7AA289673F03EE4F7015
MD5 SHA1 SHA512 TLSH

Submit Download

c-libutl.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.base\c-libutl.md
Size 1KB
SHA256 bef40679922d6fdfb7e4ddb223ad6722300f6054ba737bbf6188d60fcec517f9
MD5 2e89a282a50f8702e52703464e6937ca
SHA1 cfc22a6f5b17cd539234d5b3160a5224abefadb9
SHA512 ae459d8ce5581ea57e203088373c1ce86d122d0e27eb871ee1383e0e64cd8a184fa207eee0e835347316e70afa24a1c95aec30def3e09d15ee19a0b2c3ad2095
TLSH
T16831456715405BA75AD30A913DA75EC4A08D903F3E277D04346EF2555B3F32FD8BA094
MD5 SHA1 SHA512 TLSH

Submit Download

siphash.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.base\siphash.md
Size 8KB
SHA256 5a792b5a74ad2a5f3d6a7ad8b7a841116e58a772c18bc6e392320a365b222c76
MD5 2e9741435c8abf33accc005f6ffe5aef
SHA1 a666fb9d1d19d713ee9055dbaec4adc1dff03dae
SHA512 4dc96c93e28152c6a832bf58bc912ada7d399d0e3180ae5a53a30de0332672c25a2606ea9ea5333a9b6a83f9f42428a08f761b68d41ba087d7e8eee65dab45c6
SSDEEP 192:jlQHnQrKIp4nw+ymHidjV20EaPdmzL9pq1:BWtImilzmf61
TLSH
T17902C5AFA308133616D60297611755C5F77B64683B1B14E024AC91EC274BDB2827FBEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wepoll.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.base\wepoll.md
Size 1KB
SHA256 3ac2992770080453b98c42afa807ba4b2c1738ef756b92a55c645f55e7df48f0
MD5 cef1d92ff8ace278bd32ac5e18735b86
SHA1 6c7d15e2b8f3e99527458c8ea33420ee1d34af7b
SHA512 12aa61ae93fc626a230f39f44ca11c75086fd9bb50f2794fb9fec29b9bef924545fc19d9cb38fda631560ca78ae8e587144cf3cf3c83a6b336bb4711611393bf
TLSH
T17D31749722841FE74AD2169135E6AE84A09DD03E3E33AD08187BF381533B43ED97B041
MD5 SHA1 SHA512 TLSH

Submit Download

zlib.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.base\zlib.md
Size 1010B
SHA256 809b62ba648e02302f7d9ea6b6886c10d5253ac86ad528038a50c73eada5fce2
MD5 018777dc4651ac69c58d3facb3cdd1c0
SHA1 16825413e498c113d88fc2a716dcb4c8c7609b98
SHA512 d5441b256ea55b68fb28a3546a8d5bd24d89a551222745933c23c02b917a3955469064eeed3ccbe2764ff158f2a472aad5b9b3f91190ffefab9f6b2682a75a4d
TLSH
T1C811021B7399937129E706FE7946CDD1B7272E14A34E46D5707D8088376722102344A8
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.datatransfer\ADDITIONAL_LICENSE_INFO
Size 48B
SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
MD5 512f151af02b6bd258428b784b457531
SHA1 84d2102ad171863db04e7ee22a259d1f6c5de4a5
SHA512 1a305bc333c7c2055a334dc67734db587fd6fda457b46c8df8f17ded0a8982e3830970bee75cc17274aa0a4082f32792b5dbff88410fa43cc61b55c1dce4c129
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.datatransfer\LICENSE
Size 32B
SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
MD5 663f71c746cc2002aa53b066b06c88ab
SHA1 12976a6c2b227cbac58969c1455444596c894656
SHA512 507b7d09d3bcd9a24f0b4eeda67167595ac6ad37cd19fb31cd8f5ce8466826840c582cb5dc012a4bd51b55e01bb551e207e9da9e0d51948e89f962ba09606aab
MD5 SHA1 SHA512

Submit Download

freetype.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.desktop\freetype.md
Size 29KB
SHA256 65ee85395dc7a1521da39be7672e8902f1cf3411fd32ed1560d0e5dac11580f7
MD5 d1a5e5c9e182cb8076ea4cb241011a1d
SHA1 832b670c4f944b08ee8b37e7f5fb6e5c761c036f
SHA512 014ecb5ae895190416ae2a8d630b5fe44c0bb1056167f993602b00bd9184283e75cdded0a76256f9596b482fbc20ff11c5a475d85e1023aeb8fb412f0043164c
SSDEEP 384:PG8K3zZxGw7hiVPEUwi5rPL67cyV12rPd34FomzM2/R+dWR72gUEKvzlOR:PGFGKw7F4ExGFzedw72gUEK8R
TLSH
T109D2A51E7F0803B20AC202A16A4F5DDAF32A80BD726A5495745DD25D332BE35D2FF794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

harfbuzz.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.desktop\harfbuzz.md
Size 3KB
SHA256 b3f327a8b36d56beb152b3fd1bb5a7f245362cbea123ebbc68f8907f741b552a
MD5 032b0398b45a7ac0e9a5fedfd84aec84
SHA1 3dbfe0c4b7e2b781e828db31537ff85647c8ccf9
SHA512 9bd8faff0f8e6bc460d14f9bd25c818ff4ea76036db944893fee31b2a4df3d9c29762ef34e99181ea42e30f3948c514a2477bc851c029184c178c46e63eb0210
TLSH
T1D571A7A66F4917A82AD1CBD33C06FD4FE19CB129A51B6E953498E344966283CA5FD008
MD5 SHA1 SHA512 TLSH

Submit Download

jpeg.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.desktop\jpeg.md
Size 3KB
SHA256 c1dfb9719a71ad9f861f8728550542d681e25c8ef40e6393606e6e2a0c1d653a
MD5 3e68688d9331ac69296cf8fa57d7d2cb
SHA1 a937a169636558dc52f2e9c474af269a6b254f2b
SHA512 7e82da825499b1b4c5ddb09d17bdda584f52739b504786f8126df2fe914d97111189fb7829ebb5285d11cf2a18977f377e0d89a16c82d5e574a5b5b83aca1b3a
TLSH
T18761A639B3599F7118A303D3760EB0F8F71EB9A9BA7A0145741D722C270EC25823E3A5
MD5 SHA1 SHA512 TLSH

Submit Download

libpng.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.desktop\libpng.md
Size 7KB
SHA256 4e4c0ecd9795b9181538ea94fa63e6817e6e1f4b51481d720adaee0fde409c20
MD5 c2f1fc23fced6739364bee85ddcba5f3
SHA1 bed2c4b04273d976ff1a6654becf7cc9cb84da4f
SHA512 7cfbdcecd98da271a93fba7191258382c5f5c133047c5aea5872bdf00a937cda56fc8fb388b15c7a2b65eef3a2200e76346021a60de1724d9d646a1e757c2181
SSDEEP 192:guVlzhu3psX8aB9Mo3AWobRafweOm/rQyyi:guzhu3psX8aB9Mo3kafweOm/rQyyi
TLSH
T1B8E1082BBE0D0732BAD2C3C7994E89D5F108557A230AAA64745C520C0F2BB3641FFAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mesa3d.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.desktop\mesa3d.md
Size 5KB
SHA256 63f4e6f75caebbccb95d903fb43e46ac7111b3624d0a34f146b276d7d9e7b152
MD5 c7e0d19c8f4eff11e97f0eb9afd3f7f4
SHA1 6a98ee2703132e181f37d162452f073fb64ced83
SHA512 9c4111728ab9472f0b160cb11ce1e4ebd75a83cfddca0b3cb87243d15afc5a7fa34dc6006e6b92084648cbad1426f70b405259f589cdef758442643e1618dff4
SSDEEP 96:tqsVQHfoGKlxESLI1GXVsCGQHlzQUGP+0nWeHGT+weUGP+0nWeHGT+wI:pQHfh4hE1GX1GQH9pqnWeHGySqnWeHGK
TLSH
T146C1A61D7E041F7218A2D3B0696828CAF06AB15F777F2688745DF288232E42CD5FF494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.net.http\ASSEMBLY_EXCEPTION
Size 43B
SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
MD5 bd468da51b15a9f09778545b00265f34
SHA1 c80e4bab46e34d02826eab226a4441d0970f2aba
SHA512 2c1d43c3e17bb2fca24a77bea3d2b3954a47da92e0cdd0738509bffcdbe2935c11764cd5af50439061638bba8b8d59da29e97ea7404ea605f7575fc13395ca93
MD5 SHA1 SHA512

Submit Download

santuario.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.xml.crypto\santuario.md
Size 11KB
SHA256 d08690d25f660f145c73365d260ed522cd0aace8a0e1396706551b7a1ae8c9a3
MD5 bf427bb3a92dcd6441865254e1e8137c
SHA1 1b291256aed6f0afe2775246fa8a91b33f492de2
SHA512 8c1da143d6eefdb92ac62ffa2a1e56f2cd95d0f93cc11a4875f26eca61111142ff11dcc6b1005aa2df8077aa0b0113a8135ffcfc2daff39464026e5de43c160c
SSDEEP 192:FEASdeYFPVRQUM9o1XDFMKdFSvJZN+0G04Hrc3Pv8KIHKxF9Nmu3Dzt1XkTYst3d:SxNRrM21TiA+8VL+EKdXNt9xkTYE3d
TLSH
T14432526E7A48037706C201A2BB5B64CBF31EA03D3B562564315CC0782F6B96583FB6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcel.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.xml\bcel.md
Size 10KB
SHA256 853a1e7ce397bb10de0e2b3bde0844bcc651f17d983decd07d2d003c0304c311
MD5 daae908a4dd474afec9c010d416acb2d
SHA1 a59717166af2e8fa9ecd6d622fd6b82b835acce9
SHA512 25f2189643a113616f53cd87fc96df01b55602bfc3f6653e48c310de03f6d79ccbbec58936d54b88052e32d68c646017bf75b8a179f59fb9d2c5f6938e351a4d
SSDEEP 192:g4EASdeYFPVRQUM9o1XDFMKdFSvJZN+0G04Hrc3Pv8KIHKxF9Nmu3Dzt1XkTYstb:exNRrM21TiA+8VL+EKdXNt9xkTYE3L
TLSH
T16832643E7A48037706C20162BB5B64CBF31E903D3B562564315CD0782F6B96553FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dom.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.xml\dom.md
Size 3KB
SHA256 6686e8877667584a3a7c07344baadca1a03e29f677162d87c3c0811e990d1148
MD5 13952c46b3867103ad7d1e9c6c9e906c
SHA1 4bf3f9908314b05f3b0f6e27be2c1fb7e25fffbb
SHA512 8c71f226f0f07b471aea6b8e715434b5eaa6b4a59a653ec22c2489e743e9288a0c4537f479719f9d58737d0257470c9cceff9ce647a96e79fd757a4cdcfed499
TLSH
T1FF71C82F7368133515A31676A28BB8CDE21FB1A8F7234550241ED1D42352E6D52FB29A
MD5 SHA1 SHA512 TLSH

Submit Download

jcup.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.xml\jcup.md
Size 1KB
SHA256 8d5dcfdf50455a3c34c753a98f21e953248af200415a9084e3f102cb6c43b8bf
MD5 d19594fbf6eab2242dc29257905d8ded
SHA1 fbdcbe5a7e7d91d440c200f5fb00e0cf6a81976c
SHA512 7ed3e58f189f2922f7543d4617308d0c35f8adc2e7cbbb6fbba49d33cdd5da64c6edc022ae9842c28e58d97b056a245245c816003978f1e0152236636ca72ba5
TLSH
T1F8319919F388637952B70381520B78D9F31CE5B4B31195E07818923C3713DF951B66ED
MD5 SHA1 SHA512 TLSH

Submit Download

xerces.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\java.xml\xerces.md
Size 11KB
SHA256 4a6bf6b367193ee68681cb2d9fed30ffc5d62dd2d477bd62e0271707d71b3244
MD5 a8d7dcf5540e0a20066ac48deae71c59
SHA1 94ef9f9f4bd2345bd10d330f3052727f4cf30a92
SHA512 26972bb1fe75ff78ed4afef538e389556ccca2d04af0c50bc6fd0d3dbfa2be6610d259b307cefe29dafb613fa3d324e7734e83873b16a61c90bf6e2514d92566
SSDEEP 192:C9uXsEASdeYFPVRQUM9o1XDFMKdFSvJZN+0G04Hrc3Pv8KIHKxF9Nmu3Dzt1XkT/:CQ7xNRrM21TiA+8VL+EKdXNt9xkTYE3L
TLSH
T1B632636E7A48037706C20162BB5764CBF31E907E3B562664314CC0782F6BB6593FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkcs11cryptotoken.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md
Size 3KB
SHA256 1f36ff1342a581142c858f90064e20633d43529ac82adb85345bd902a14e18b2
MD5 03799ce5e9611d7337650d7a9cef2196
SHA1 b7e8e7d09414d1ed56a1ab512957eb86309ac4b8
SHA512 3e38d24e726e2468c9536bb1ce893f55a30f9e6f77297af63c2db58e24e57a60718d788b0577851c7e7a0d41bb253e8dbb8c60a2861d2cc31f00032f41d8aa65
TLSH
T1548195EE63C4362203C307525656B4D9EA4BD0F8377A2551786CB21C3B82FBA43B65DA
MD5 SHA1 SHA512 TLSH

Submit Download

pkcs11wrapper.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\jdk.crypto.cryptoki\pkcs11wrapper.md
Size 2KB
SHA256 371974b1fca3744a3892c7ee1fcc593b8b4281fc218f4cafd2f709e9df5fd81d
MD5 b77d1951df7a8488eb84ce1d25486a14
SHA1 e35415235ec3bbcb92beeceb03a9a8e7c13a6fce
SHA512 759c75f87309b67c56a5b7088045e04be7c023ecdbaea80842e22b81b0bfb36026191070471f8b08fef47ec73664611ce0453b4a9818f7708c95663733ee5ce9
TLSH
T1B9419707266857630BD313A425169FC07A9D903D373359043C6DE04CBB6F13DA6FB698
MD5 SHA1 SHA512 TLSH

Submit Download

dynalink.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\jdk.dynalink\dynalink.md
Size 1KB
SHA256 17312591cabee3ef6c34ed8897d92e4e361ba9cea41ec00dcd61a322a8fc2cdb
MD5 7c3773c14e9de1161a33902d64854bde
SHA1 bee6874bd3625623c939441c9269f9c6239a9247
SHA512 86ee77d8e129b78173964461cd27200aeab7fb6417fe0f4982d9b126ed2292216d08212be91b53eccb26dd6a8b3e1aab1d1dbab85c2133872ac0027dc87a8223
TLSH
T19431629712844FE65AE25381B65ABAC4B58DD03C3F27AE05186EB284933B42EC4BB455
MD5 SHA1 SHA512 TLSH

Submit Download

thaidict.md

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\legal\jdk.localedata\thaidict.md
Size 1KB
SHA256 c326144a2351c9608fa708b5d7d3c5a3da03e82b66479b128e9db4969539824a
MD5 2ea6eb55ca40902554aaf2fd20a76ba8
SHA1 e5b9e88e174c797c313d6739e7e34772b723bc4b
SHA512 5221112cd8ef83b636dc4364f53b72c5484a5885acb55c2c071c88d23058093caee38578f7e424ecafdb483ccc0bc8e78d7ac13add536ec824a8eac171a576cb
TLSH
T1B121862F327417622A571761812DA8D4613F724AB5AF5E81309CF241337F06986FB888
MD5 SHA1 SHA512 TLSH

Submit Download

fontconfig.properties.src

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\lib\fontconfig.properties.src
Size 12KB
SHA256 74e6c464ae1e63983ada241869fdc66ef8c28cef403ee2301e0a90db9555b00c
MD5 787ed1397bf6df8e73ebb99d5dc14b3a
SHA1 bf4cd86569db3709c27c8bdac71f702b6f61e932
SHA512 5f53b1400fba46cf4d23b8da777c8b51d95926f394a43a0431d6afc97c8b4926590ed65afecd39ec3a63a59ecc2be3d6e72a9a6fc1c55463f811dac22b8eb92c
SSDEEP 192:YTh0CcTkCtTBElDWnsNi8bTM1d5CN59/Ywca9nB2RIhC3PB+Guo7OD:YThBcRnHeR9B2RIh63OD
TLSH
T14142550E220C0BDABBBDA85231F6A9127D1DA47F4282AF4735FC8609DE515D1F692333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psfont.properties.ja

Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-epsilon\windows-x64\java-runtime-epsilon\lib\psfont.properties.ja
Size 3KB
SHA256 5a4bd51b969bf187ff86d94f4a71fdfbfa602762975fa3c73d264b4575f7c78f
MD5 d4c735bf5756759a1c3bc8de408629fc
SHA1 67c15e05a398b4ce6409d530a058f7e1b2208c20
SHA512 8124b25decfa64a65433ff2ce1f0f7bdf304abe2997568abc35264a705f07152aa993b543da37c4132b4b1b606743c825c90a0eb17b268518d478f5cf0889062
TLSH
T15C71EFA04FB8A7191422069571EFBBD8E61A7FD2C235B14794F168029049DFDFB88B37
MD5 SHA1 SHA512 TLSH

Submit Download

accounts.bin

Path C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher\accounts.bin
Size 149B
SHA256 a8238563d20246179fedcd1ea58f01236a1bd104d8f3d56d658ebed8bad42c84
MD5 f2b83facd35ffe7e989f9f36d516d7ad
SHA1 0dfde2d252acda6a339cee79902f90d69de52963
SHA512 22fb9598b36334342a1e5cc1d6d992016ab2f55613bb1f5e8ac2ace882ee917543aad42e81648b0fe625f2ba6ab334d2253ccde4238a7a98b207ad73d5620040
TLSH
T1BCC02BF3B1ADE2C4ED93F12C0470C290133B123435408B07B96885813CE40E8057EC80
MD5 SHA1 SHA512 TLSH

Submit Download

OpenAL.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\OpenAL.dll
Size 1.9MB
SHA256 5d229e267dcdea81a2c20ca2de401df574ae19f2486e2563dafc43decf057615
MD5 327d0f8efb2cbb7c638933b360c206cb
SHA1 4c8d30b2f1e761bc35da48b88628f75aaa7b4831
SHA512 e8d7df1d985615f24f9ed7881bc8d9569b1a31715cd9598a1a271600ed3712233b4f26c123a39f7f885c4499490598f58042b02d1fb6163347c19899c1d3c788
SSDEEP 24576:e3yU9YH8BBYrXL43xy17mJOaKR8YPDAsdiE10xNLfbUakNM1Z8aIh0lhSMXlSp:EyU9YH8q43x/OaKRHL58xaNy1
TLSH
T12A95AF17B2A441E8D1BAC179CA576D17F772340603B0AACF03E04A662F67BE45A7F316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\freetype.dll
Size 2.1MB
SHA256 49aa563541be1df58acd982f3b9586553078dd3e978ea5385281200eb42b6f9b
MD5 9fb262550ef57a22e9f672078c348113
SHA1 9b8fc55c26c6eb7a6097dbb4a366120fdd8669ee
SHA512 c428fc9232c30ea08c94d62b5a4922d4927f7966a802aa403458f9484fb4effe2862ac5efb4033d1e76fd89842b13140886d2676887c4822fca6331b186682eb
SSDEEP 49152:uWi2+37Qhbk8TMtaJz6M5Iq0TTL03lu/Z/twx2+dEi3GCBNHy+sr:P3x0
TLSH
T13DA59D46E2A610E8D97BC174C693960BE3B274010714AFEB56E09795BF23BF51AFE310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glfw.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\glfw.dll
Size 521KB
SHA256 b0548e974e03b1bb597f9696b3f9d75df66af3cbea0b8246adcb2c79de0653af
MD5 2a87d38053c2f9ff493093f6ff285e5e
SHA1 5456daab94d9d7f577ca664261ce66e56d4d1f32
SHA512 30e622844d18fa9e87799de51a978371048a0aa526728ccaa58a67ef538077294bd8c2a204fd7e146e8e30e1c2ed85961048db5dcf191959880bf17cff5f597b
SSDEEP 6144:qXrheMJZDAYSt2fclQhYBddhKsAYnBkOzyxXW+:qXrhrNdSoVYP/iYnWV
TLSH
T194B4A51967B2064EDF2B4433C6CFB9219477B04C3FDBA49E7E9019E57D21FA180A9B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jemalloc.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\jemalloc.dll
Size 390KB
SHA256 557cc5f6dc2e7b410111afe83a11f3a8da8963ca8eddf0c542559329cbc0a5c2
MD5 0b3dbce09db0a089cb9a202bfb409e3d
SHA1 c333cffa3bd364f12b8918b8755d7155e51b80ee
SHA512 ce89dc3a101f11b5344c54f862bb3f3f207868ee46ac75a7ff14bc071f659f74fb14d768d15aa17a209c415df81fa6ff7a492a62d46b4adc914df73be4513bae
SSDEEP 6144:b9xOYD5LY/t+X/6RWqKE5I5lR4xC1IAeuYNaEv1v66fFeGDn:3OC/6RWFE5I4C6vNaQPRn
TLSH
T1DC843A46F3A944B5D5A7D03889774607E7B2BD284726ABCB13A04B552F33FE95A3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\lwjgl.dll
Size 509KB
SHA256 6a1469be51e2fa8be8c70d8aa7bcaa4a1704055c62291490ea453f3ce3128377
MD5 5fba38b92efa71a21f01d2b0256f72ca
SHA1 eb335b881e81315e93c8bed725d9bab75eb5986f
SHA512 b0f35b4bf9636c9a2db5a1c5f9d8f03d777aa1c442e241d288b7f3a5435fe538fcb521638d5b887324cfb2061be2880f75803c3c5995509aea43ba9b5812de3f
SSDEEP 6144:0mQ2XkbiOWkzsLB5Xn1hEAIvSumvyIAtroFulyhGct8f8XZW:0mQ2XkbiRXnjSvSMIYroF9hG68f8X
TLSH
T17CB4E631DE22C68CDCFB763A60531005EA7678641B1222CB57A79A4BB11B7F093F6F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl_opengl.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\lwjgl_opengl.dll
Size 351KB
SHA256 19882eb95b4c10d23a5e2caf61672cb367e445ae168f7f87bc69b787108b9081
MD5 915ff1007006cbefb55b7ff8b964f9fb
SHA1 1e002182f47d9918ea960dd6302d4e8c5c839a2c
SHA512 c6bd21e2e4821ef8b28f20fd7f930db1ba29e549b23893d017c9095c88b07c9902e994b313ace75c4ef6136ffc2bb97c6a396205b06e0ef251e7fe0adbfb5194
SSDEEP 3072:4Id9tCjbLj7TrDbzaEP2VL+8F9gPh7Z24oof7dUB4Ome2uG+WQxckixrIYQVSuUV:4Cwt6b7x32XpduLQdj
TLSH
T12274533BAF97C4AADF2B3539D1940975E12CA8B447042AC3210CAA86F5CF6F451F7E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl_stb.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\lwjgl_stb.dll
Size 593KB
SHA256 4642e771ff4467baec2176632103e0fa6f0fb8817954c59606944a2e746042d0
MD5 e3142e48a5eaa2bc6319d60833026e24
SHA1 9fc7ace36ade66213ca556bd849e438ed13b297f
SHA512 fdcaf30323ccff577faf6be15ff39300462834b79c96d94240c09bd4338b63b20c3e814b20c68311f5e420913325ad915cb9b62bfc027daeb0c6be32c9d51a3a
SSDEEP 12288:XHbFZ1z7FpEoI2hTzSUX26iYahBeHzJqC51sMDQPOtoxMod:XHbFZt7FpEoI2hTzSUX26iYah4d1sMDC
TLSH
T16BD48D44FAF684E9E42790385167650BF632341903609AFB43909A6F7F67BE01F3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl_tinyfd.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\lwjgl_tinyfd.dll
Size 249KB
SHA256 a68bca84a9f40b8059db58042db3271a6dfea76826162d4103be6916cc6905b7
MD5 e74e12a8b8658237e1ce5a5c71b8b8c8
SHA1 40cf932243fe28cfb2fb92876954758b2f7e6855
SHA512 a3fc7c59a21e935d2ce81cd66ef4e36972543e557c985f4f8265e3cd60e2eb76504929f6a6048683b6af3729f28b6daae9afdbe773dca568242054dcc0f594e2
SSDEEP 6144:wyNMKj0dKNrsiywhofX8iwyIrRkYNvdt5uApuoG0+4Y:wyNMKYdKNrsiXof8ie9nvv1usY
TLSH
T1D9447C5473E408F9E9A7A23C89A35906E7F37C160770DADF03A0466A6F237E1553EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl_vma.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\lwjgl_vma.dll
Size 251KB
SHA256 de91b82250ba19d44d2d455bad0a75afe6e30c4b0f55c5e012ec198220963743
MD5 6747e099ec53cbc8b0799ea2654e6c3b
SHA1 3f8795930c7a1754f0f61921b64491b748ce5731
SHA512 d78319593b0e78c2db6d63f4e52ffd8ac60252378e45dc58ec3f0e42d67990d1e7b58ff30a99140ec6ca6b6cdc6aa611453a4fd23f724493b119e8b091ba7805
SSDEEP 3072:V7vjdfP4cGsbRBa9XxTPaYqEakoGTm+xIMzo1L9IjjUGnUCL/M9PN7:VrjMsbRmPa+SS2MM1OQb
TLSH
T11C445B5AB2A50CBCD867817C8AA39607E7F278554730E7DF03A086175F2BBE1953E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shaderc.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\shaderc.dll
Size 5.9MB
SHA256 36ca29c50b0878841abb5a0aef030fc18e5023915dd3452e6e199e7743669155
MD5 f1937d93e66164e9a37f60b7eb1ceb19
SHA1 c1b3e61b6083b33d4edaa3e8fdc6f3c65a4e3368
SHA512 de50c0803b745fae46ab6d28807429e9fd3111e4e076701d120c31b4e086241fcc497ae70378d799d1f9aa06628dd112864b947db5db8aa81c4f2eab658048d8
SSDEEP 49152:boItmf54wTK3muOukwhUlb2AGBbYmIzgB6fgOqWTr0V3OPji2/Ie9EEpkBGenFmM:4JuOulWvro8kUi2/FpL2TK7rxHTt
TLSH
T19F568D23B3A401A8D07BD178CE5B8A13E7B2B855037057DF11A0466A5F6BBF05F7AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spirv-cross.dll

Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\26.2\26.2-natives-1041724564550\lwjgl\3.4.1+2\x64\spirv-cross.dll
Size 2.2MB
SHA256 e5d7b499c6b8322e4ff0e131164df1bfd4d4b9ee4586ea315c3bdb6242ab2173
MD5 da37fbdad078336eb53746b093cecefd
SHA1 cd539b27b00dc8e382de9d5cd099e7a66dc38529
SHA512 a9dd9da9f455a79aa8d70e4b707d88bdf962a87d167de477cadc34650e8e6552bd41abfc308296b3f30e2240b9b6e94f6ef02abc6afeb52837b2f7ca310b05cb
SSDEEP 49152:irEh0WFcMYHkdwRyg1/lVZbw9+dQCO2fD7+LficsyQIzTZDFDS:jrQ7jI
TLSH
T13CA56C2B628801ACE0BBD179CE479953EBB1701603B169EF096049A15F577F4AB3BF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SKlauncher.jar

Path C:\Users\Admin\AppData\Roaming\sklauncher\SKlauncher.jar
Size 1.3MB
SHA256 25a73e3770a1d8d14bce53e8920e2e893aacc3c715d0fb22f878ef2090d03863
MD5 8a65e7d4f9fe599486d06199495671b7
SHA1 df31e13eb2bb08c46d9314d945413a8ee56911a4
SHA512 22160d8db38734daf0723b5f542d5f3dd6fb4bc379cc1977381bdf516ab985d1ebf43059375b96bcbdabecf9706e601d4be4d267a09091636f1e0d5923b17cd7
SSDEEP 24576:4rCYReS8dKChByjZ2XoDw4lwCo/21nIAe5rmQhWwGJZOiYayrjw3IEtxj:4rCYReSUKCyao84OCoYxelmQhcZO6Cwf
TLSH
T14A55F0333FE5C9EDE53782BA925581C2DC1B829C8146D83B56A0068B2CECC4A5B57FDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\VCRUNTIME140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\awt.dll
Size 1.5MB
SHA256 bb338d549c0a83441b876f776b46ee1028309d63314e6ec672d896c07e2dd262
MD5 3d1be8e2d251f8a58d001550a015edcd
SHA1 7b3eb1c28332ac822edc4d013ff1db824de24831
SHA512 469620a64427c5457d18ccfba462d4f070cd9f45b07f29323e5ffb5a733afb2c17372c0de5c1b0e04fc910c360ab77ea3a6feeb67eb5b4dc93f0202fb366250c
SSDEEP 24576:VkyDkUA58rethW8cMm3h3PGsaOirn6PBNOIH5Khg0MkLZCQ:Sik98rOlqaOSn63O6Ggd44
TLSH
T1BD65AE06E39600D5E8AB82B8C05B561BE7B03419034197DF66EEDB1E7F37BE0263A355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extnet.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\extnet.dll
Size 24KB
SHA256 eb3f74cb6ac67cce51dffdc79b3d071f54232cf18f37bfdc438c6a3d9e43ad3a
MD5 00c7f888f59639b5c7dbb5e50a589078
SHA1 f70169c4ee0d4f4a9a95125dde9fa506da7f34ec
SHA512 b6059d54661f82fd27047542e826e6886b555173d3d5a4eaf780e226fe9fcfe1cf2e40173f9d5b8023889869dc37b6880f7bbe435c7b53b4cfb3236111556974
SSDEEP 384:Kqfjn6ZGrbcX8aKPIYidvjNOscy8RbmL4nNy6dTeZ:nj6JnpYiCsc5ALsN2
TLSH
T132B25D4BDA944CD9E8278830A4924A17AD76B5101B91E3EF5314C2590F773C13FBE7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontmanager.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\fontmanager.dll
Size 956KB
SHA256 a30c3feee9d5942800f54671c2863af2f9e610ccc17a29bcf562c8ac60dc216c
MD5 31fe79cfade574b432221ca649676829
SHA1 f47a24d63202e774769927c4dd10e606da2d60d7
SHA512 062695bddda23513a4faffe185707c5a7c9e3ad4d995d57329a9491277a67c4c4d454648785d9cc731032bea82328ac9ba30fdb7feb212988712fced5908da27
SSDEEP 12288:CIBGI61nrBvaRA8WSSXwfe5AZ1lGw6NRN5MYnE5uTSVo4g1lq/b19kObVsETnU08:ynrBvxYSqIl1S0gb82VRnBM5g
TLSH
T127258D49E19794E4D93FD074D6A28807E7F2740213099EFF55F0A649BB27AF12E3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\freetype.dll
Size 542KB
SHA256 07f0707ea6eeac8c941c9eeff83073da2c9f3070358b13a2f5211eb44c58242d
MD5 be69f164ea4b21ce81439554745321fe
SHA1 e0b3ceefd2ac8784565d0b571530a2210f844b9c
SHA512 50a8c27b2aa17789e8479d6a2d194bf9a9cfea9bfe1f7f713ddb57346bfe0d2207b7c02c29fe6b0ab219d56f8dc336aeda0829da78f9dbba289850f463e3a56f
SSDEEP 12288:iH1xy6sHdO9W2NC1eN0g+IgNA3601bzrAU6XAEGRfEWmi82:iH1JWOeeN0qgeHbzrAUSXZr2
TLSH
T10EC48D82F3A81BA8C667C1388317870BE775740513619BDB27E04A6B6F13FE56B3A315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\java.dll
Size 126KB
SHA256 30be3e831787caaae87922a1a611e0ca51811e1552031f3c3ed045eddafcb102
MD5 d7a8dddd178f665e39ab2fb2956bf498
SHA1 129de0250ba1148a70d85a1edb40bd950ad396b1
SHA512 1fd01efea19d5611b92c543b51019212168f172e30c32ce4ee74381e1f4116256b6bfcd8b48e4b1efb4c309c3d36eb51f57b315afad62aa55e7d0bf8e506de8f
SSDEEP 3072:2EIyecWNIvAFDm4ULTeivHnl/v3yNG3avHnMlEr9Idg4k:sjNioKTdHlEHMBe
TLSH
T1A5C3191BA7654456F46AB1BC8423864BD371B0600381A7CF4329CA4E8F9FBE17D39BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe
Size 49KB
SHA256 a3a771996ffc7fd62fdba27b3bca8be51ffe6da50e4f9dd21bcee329a76ea358
MD5 3616224be845c6ed30cc7c7881aadd6d
SHA1 c8aa88e983eb3f2c301f39b81fb2185847f04fab
SHA512 cb9f50a0812f9a6505f12193d5049c574d2242eadf4cd33d5a121d31fe7e1e2ca84e52a9b655b4b78a03b5e53dd0acf877baf7f0ba4731126723f8e5dd70d85c
SSDEEP 768:rviWR82DHPNM5R2TyJ5R3s8D/bkt5Ruz3Vb3pj59YiQGQ5ALsl:OWRlvNM5RdJ5R3sozkt5RA3pj597tAl
TLSH
T1E3336D876A182C81F02F84F058A7792755B4BD032BD172EB7DCAB21E0D71391A9276DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\jimage.dll
Size 33KB
SHA256 e3829acbb109a1c79cfb21189f544f7d3df759489c6488637a14a30d739f726e
MD5 0518e82dc34030fa69651914a2adff51
SHA1 953d8c966f3fe3083616b7ca0d38a13b450fb05b
SHA512 34b910057106b8c7887a24c58e2f4d98922fba68adacd2155705ff66629ec7a8b410050a80659a9355792d5ed7813dfd17a78f65241f383c2ddad6c9311cbe3e
SSDEEP 768:oOayHxg1tISE9nvM6Hi/vgST7Yiuv55ALsDml:IKHr9nXi4A77KjCl
TLSH
T1B7E26D86DB588858ED2BD538D4964A1FEBB6F8025B51D3CF2724434E0F333C06A7A7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\jli.dll
Size 92KB
SHA256 8934a508aef04ea6aa9dbe1972618f1f525abf6720511ae04f4f9e14534f2bca
MD5 4897ee6b452eab0fa6a43055365d75ea
SHA1 014a76419bed8ad50f28c7d8179cf8a0906fe5c1
SHA512 c737da8d661d4d689f7e7ea0949dd736d78d1a44c27c05344b7e0b333765e694003e003e3b05fa36f7d008516a773fcf0cb225f4fc413fdce65a4fcb301b608d
SSDEEP 1536:yuqRNM3dVjxw7mI/K+ypSVZG4+XjH/IOpa0jLtiDiQaV7sk:yduVFw7mIlyCj+zRpa0jL/HV
TLSH
T190938E5A179011F1DE76C478DAB14A0BD3F2B416276193DF036C85E60FA36A13E2CBE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsvml.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\jsvml.dll
Size 850KB
SHA256 66a8d2b7a85deebc98f6acffd8a73bb4a22a5acf62d16d2d8e83583a80a1454e
MD5 b65de9618f5729475a42036851067db8
SHA1 121064f01363820ecd24befe429e95dd56f22a0b
SHA512 cac378f1a96b00a3d980ae4fd69f3087d627a64dc7d15e310a7c948671c0b4f846eb47e57caffe6378421a6aebbcac9e62acc3f180ea569aa2ef4200492aaa72
SSDEEP 12288:RRybOUKnvJNeCs5wHucLq/V71AVNV+Ssc3:RobO7JN3qwHRLqN7wj+9O
TLSH
T1D105AF82F81285CDC03534B024FFBD95A91A1CE945BC0EB32732AE9D2AFD7467957A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\management.dll
Size 29KB
SHA256 49ce4f4d365ed1683c577ca9f376740d07c636cbc3c8b739b360fd143d37e57b
MD5 622e74863ebe27e1f03ed9b8b3edfc52
SHA1 c2450e32f2bfbb8fd6a8febeaa11c2aecff0abed
SHA512 9d6eb2cdfd96eded87d61ebf851ec423273de5dc1fb77e6f37aa4bac83fbdebea1b374284a79485ed05a20796e0645d6754b085cce0505dbc893f67c0b240e37
SSDEEP 384:M14tYimDq3OlXHDh8BPz2Ves0bc+KeOpIYidvjFkry8RbmL4nNy6eu3Q:bmIujyVSrGfYiLkr5ALsxA
TLSH
T126D21956A62E5545E0CE7135709306326AB2F5C21F8163C70264C63D5F7BFEA3A381FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management_ext.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\management_ext.dll
Size 36KB
SHA256 defc8d64cddd633b6718dbc340aca6104231a0b6c463380d63763c20bf4611f9
MD5 785365231cbf97365daaf12d4778a8a6
SHA1 59ca0191c5d45f02d8d6dfa33927ff499de41e30
SHA512 29c4b3828a3948d84c78b88d0dbd0b926ffa795c105700d4d09ae4d229bd3dfb56297741c1af459fdaae144e1fd6013ce4a1d20d1937fc1bbdd24db181664177
SSDEEP 768:T7/cIRDYVmJctOIAZ/9wa+ifnPEHsmM+EOxQYizYF5ALsc6:xC0VJ+Fsj+VxQ7zYXc
TLSH
T130F26C6792590896E84F9175A0520A27E6B1786223D0D2CF4360C52F4FB33D37B3D7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\net.dll
Size 60KB
SHA256 a6cc6548685840ae4fac0da5aa2a871ec650958b3078311ab1bdd3b838ca6c4b
MD5 6c7b8256e854ff5ad384bfa2b88768e0
SHA1 a838ef6ac574a04fc8504b932c06e0e8d7ad6dd3
SHA512 4f1f592d6df9ec3ff40b7e4b4b7dc453f50cb98bbf0ffc6f21cc0c47cf02de7e2ff319ee9c6d35aec212e894a863cbf68d20fe0a1cf742eaadf50f238afb3a39
SSDEEP 1536:w3UWbWerNEZAlSCYzHTgVZIzUbnEcWJT0E7+oG:DWct2CAjEcWR0E
TLSH
T1EB535B469BA918D0F966C57C81930517D7B2B860239087CF43B8C99E9FB37F26A397D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\nio.dll
Size 81KB
SHA256 259aa47a3aac56ef4d2eec9480e548358f70b9b29cb7e8cc887e97f702e8cc3f
MD5 78b448d2889e6a960351d8afe3191f92
SHA1 3ffd3d82e618905a6bf5c412f503ee57e005e683
SHA512 83bb659ee79cf714482c4444b2f4238c99f4fbb79caa0bf897fe96e20e305eb9bcac642f56d801e7dbd9510b796a0656cb4dadd30fcc2708b9c090b8081ca3a8
SSDEEP 1536:On8EbD5WHyYY9z7glyhqEaRIDmYHUGw7vr7f:O5x6Y9zWyhqxRIDmOw
TLSH
T1B58319E253A4499BE829713C42DB075BE662BC10470097DF5228875A9F2F6F23E3D7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.jsa

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\server\classes.jsa
Size 12.2MB
SHA256 3465e58c9ef81802f0bbecdf3265cf927b9e8a9defb11dd3d4523e9932b4ae2d
MD5 98a67682827c643aaa30eaa0757fc1d7
SHA1 3e78ec3573d07252adfb3ee98b5e2365abdd0042
SHA512 aec1675e2ae7c9066129337ca17289514596903cee73dd49bb5c1481208fff554ec7fb09267e353b6d4efbc6d664e2807caec9d3d699ca0de83789984afcbab0
SSDEEP 49152:1S/ruk0YOtEfvK9sm5Fs5QBat8dkymLFl:1BkqtEnKs0sbwzmL
TLSH
T112D6D65BF5418793E13DA63588D6C3902332B865BB078B032EC4A37EDEC35958E5B9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\server\jvm.dll
Size 13.5MB
SHA256 2b9a1b32004851eed285193c031e241821ada16d6c5658a99ab4e43e6981a137
MD5 ac7b3fb06da9999d946c872ae016d024
SHA1 1c7e8d109eac9ad81c7b977a16ec8af5abf7c1d4
SHA512 f8858d850b0a0f7ca41bd3bdee922b7806d4d6e366ea2f1e92886a32d54193dad8ec32da35a595a6561b4f575836215fef1874b6861dcc78c8ec8819d13fbc1c
SSDEEP 393216:t9cwvYE69WprirteuAGdNumb+0HDea5f2Jec3u9MOheP7J6wZKGj9UMaP5RMTYCq:lYKQ
TLSH
T1E7E66C57A7A950D5C02BC178891B4A0FE7F2B8955730DBCB52B0265F2F6BBE1193E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\sunmscapi.dll
Size 49KB
SHA256 c397bfe08108a68b2af00764cc8d852f35f9c3b078dad6c40ee7d7c4b06b9c38
MD5 827b4781cfbe27b8633c8521da3d4a93
SHA1 3f8103e263195c0febc66c4a8acbc98d478c2485
SHA512 32fb39678c897c27ef271548ae54e789c4cd8671544fae79dea9b7c452a578e9942abee0a4a0064444ab05e7d125c264c86f353c0e912b4f7c9ceca2e342587d
SSDEEP 768:RQvTAWJOKy+nHHqnGNlvpJGy79Rs0m/3dgTAQjcYi2f5ALsTu:WvTAOy2nWIGe9Rs0m/3KTAQjc72hTu
TLSH
T1BE333A06D7A104D2ECB2C9B8C0635A2FEAB0B4465361D7CF4355C6099FA3BA1B63C795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\verify.dll
Size 54KB
SHA256 8e8170091a9a237597b0784290135a545d68c282f0779d19415d8b097d18cf36
MD5 bd35be4fa876ab383f12c5a4c1e9cd47
SHA1 fda8c755bcd5820baf253c248912cd82cf2e3cea
SHA512 73a8586c4cf420ad1a631d0b51136fceec2556b49d8ef6ece25db52cde2f236c1857407665084d1fca17bf0095e77f0bf3e5c2c1b4eea4d9e7e94555a40429f4
SSDEEP 768:myDizGm4dmINDNI9cNPB/0LNm+iNYF8SCDe2WwPBtKZYist5ALs:myDzcUDjmZm+oYriWwvKZ7sv
TLSH
T14A434A07E5E50872D4838134E5539ED3EAB5FD812B4283CF439085DE7FA3B92AA64778
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\zip.dll
Size 88KB
SHA256 fd7d99732f5ba371964bbc35b67d07cfdf2ddf8d175e6f420f24d1b1f508ed37
MD5 49b9c1bc38a06a864f32fb11cb0c0dad
SHA1 2bcd1726881516a8e2789be487f9d8b422a8866d
SHA512 8c111d4b39911d1f0c47516a43546684d861f30eb0c275a3e7f4a37af7e2b0b464eb14a134c1ce25eab4ae92fc47212ee170aa8937bbcbcb7327fe56b45a523f
SSDEEP 1536:p7KRHBb7KRUWFWqppiAM61mIOQIOhhcvvxbW7SE:p7OK5W8MmEGhhcvJbW
TLSH
T1AB938D918A601662DEB695B0C9E34A2ED3B6B01653D457CB534C839A2F037E13F6C3ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaxp.properties

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\conf\jaxp.properties
Size 7KB
SHA256 7d95c49465d0c836d608d02856d3b097934dfb5dc4bd2279affaf337d045b708
MD5 cc00e2819ca927d4130a5203706baba6
SHA1 2d44f54a9d0f8d41d3e932c585c4e4c56ab29d0e
SHA512 37163a66138973c586c4d59394a1b7f2ed82c9c76a82ed0354fc3a0c96f52abb5d7f8bb3141a747953a4984b62b7efe8f2a3c40b7339ebd81d4a59413403a3a0
SSDEEP 96:pZVkci0zmdCtb9UPiFeZHfqdNENW6A58CZb41F7/AAnyRYB:vmJom0RmsWKjL53t411AAyRe
TLSH
T1F8E13127B64DB771035602D1810E13DEEFA855ADBD3764A874DC263C3229DA823F75CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\conf\logging.properties
Size 2KB
SHA256 b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
MD5 0f00ec3e7a7767a4efeae1875fb5f3d4
SHA1 167808418571e9209b952188ddab2f4e62920e68
SHA512 e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504
TLSH
T13B51EE5EAB4E2D35434E00AA5A7FF6527E1898BC1C23A5F6B35E6304711D83485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\conf\net.properties
Size 7KB
SHA256 56dd1f6095c189c1052f6baa32e457efc09de4832e19cdb82bb236dc8abfee9f
MD5 0c091bb338f924911db463aec454ba8b
SHA1 69e86a02207c1126a0d9faf9362a8d1798b140ad
SHA512 d0d257c7b0fc6059faef88603c07a9e1cfe6692359eb634b3436a02723ff015d36d523e1c2a252649db7cd4d0e24be114c042e3e209ce027ee07b7816466109c
SSDEEP 192:/LVGG4f4z346et5m27SnCgTe93hf7k9SrnF:ZGxYCUCgY3hzk9+F
TLSH
T1DAF17283BF46B7354399C291E21EA7EEE32C913C5C3375B831AC850D2619C76427F4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\conf\security\java.security
Size 65KB
SHA256 c34c3504e41af63639661aedf8d0864d8157df0980dc4c22d014a7170c5897e1
MD5 b27c019e75ffa0b64c873eb4f0051ec8
SHA1 3daed22f7ac0256f4ac6238805d0c2e4d812d4e3
SHA512 bcac97804cb7a2e5b55f1bf714a3605b4ec6dbd268f0de6b7aa3dff27230212c311129991041aa4722332ec7ccff9428982a9c9796377d4a5bbed36e51650d6d
SSDEEP 1536:r+My8Si8MRjJxp5/jTNHu1UoQ2k/gl0ugzYz/NndOck:v8MfxD/jTNO1UoQDczFndOck
TLSH
T17963C322BB896B7106F211A363AEF1E9F76DA12A36325150748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

fontconfig.bfc

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\lib\fontconfig.bfc
Size 4KB
SHA256 c7e2e76b908cb6330823e698889943c162e9861a4575501cbb59c9b830158ab0
MD5 9e80af78b019e2e52287108b50f6cfbf
SHA1 a297f3d435fab11aa3f0fd21eb2666a3ba1340ec
SHA512 b920a3e25e24a9c20d671e8a8520db2e783a5e18c695e46f7ff3851d7931711a73b97deef27c14a766ae6ed5a5519070421e5834da6200fcb6e7371b90b50e6c
SSDEEP 96:oI1KH1oTSNolnCBj7BFBBOPi+XdaWzbssHyad7pm:11Eo+gK5bBEi+xzosxi
TLSH
T1A0A1D040E9FB5308F2F3FB7696B5445A8D63BC56B7B7CA5C1010412E1B626404E12F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\lib\security\cacerts
Size 129KB
SHA256 707312d3e8018928f53d108e4534f628cbbfad18196df1a2e72884300be1a69f
MD5 881adfcde495d7617f386bd5a5e266a3
SHA1 8ac5c4224e29351fb5d1242511652816361be139
SHA512 b56f14cf167ae0f59f6e33fa92b61a8b78346eb7320dbafb37ec220864d42cd484dc87743ce3f1f9e9accf8873a6f1add329a7da99ea6205e167d46ccbba855f
SSDEEP 3072:6W50keopPrPXMvYrSuZe1AXA7BTMly8Jg96K:D7pP0Hus6XAlTMl4L
TLSH
T160D35B8B0F3D7405BFE2DE48A688D7277D76F3E42E9695271121C1E41E92BA07C8D12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\lib\tzdb.dat
Size 100KB
SHA256 7be2a3adf10ff841579629f7725b15f0db41e8856527ec72847b5477073a3d29
MD5 4eb7143fa50aa5537eb0644f468bf695
SHA1 57ce5168a4c09b20b2505ba25ee4e80a875cb203
SHA512 1eb614f1d1bb5be7a2a56e0a8e16acb1853b9110aef8252f3f5b222e7feb9f7639350e61121e17a46640e43ff7e114143e4abbe2e99a9eea297e21d3823886e3
SSDEEP 1536:n0ExeF8dhPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4a3jyxU:nPeqdhPdrcWzbVj0hJzdxuT/6ToU
TLSH
T190A3C3B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\lib\tzmappings
Size 21KB
SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
MD5 4c30d7867505379a18a27d0e8f03198c
SHA1 0cc871d5bd91e061d676a861749af68bbc0ca9c6
SHA512 873d329682ce67267f438b88eee0fc25cecbbcc1f7d694118417ad12756ec2b6ae7502ec4eea0cc9b4ae8b9e68f5f8877762fa13dea89c4a6dcd54fd8bf82c56
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGic3yzA6bbAdOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+qAa9W
TLSH
T1CDA25386B06662D4C073EC0D7B527AD3F886F3C899C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Roaming\sklauncher\jre\release
Size 1KB
SHA256 e7ec64455bb89ac4d09831b6fadbb453a8566499d9819f190f5d86f5915ee795
MD5 fe3c1b6055f7b6182671457e10b8eccc
SHA1 fc7e93f0795765bf34768bd66c5904a19aa6f702
SHA512 107edae32976432e757c0f19ee3926d26c8f801834048f2826e3ee479a4bcbb9097ce07be689747e9a3308306dbcb90fcfed4f45e3a121d5e26fc42303c95fe9
TLSH
T11811461F900F48F15BA903C32864845FF0FDA87146827CD4BD8B9984B17BFA1917411E
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4380-1592-0x0000021629B80000-0x0000021629DF0000-memory.dmp

Download

memory/4380-2604-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2646-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2857-0x00000216295F0000-0x0000021629860000-memory.dmp

Download

memory/4380-2858-0x0000021629B80000-0x0000021629DF0000-memory.dmp

Download

memory/4380-2859-0x00000216220C0000-0x0000021622330000-memory.dmp

Download

memory/4380-2622-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2621-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2620-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2624-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2626-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2644-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2647-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2648-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2649-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2650-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2652-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2656-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2661-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2666-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2645-0x00000216000F0000-0x0000021604D88000-memory.dmp

Download

memory/4380-2674-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2721-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2675-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2672-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2623-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2618-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2607-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2569-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2593-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2596-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2599-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2600-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2594-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2597-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2598-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2595-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2601-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2602-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2643-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2606-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2605-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2603-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2591-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2592-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2590-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2550-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2549-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2548-0x00000216000F0000-0x0000021604D88000-memory.dmp

Download

memory/4380-2547-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2546-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2545-0x00000216220C0000-0x00000216230C0000-memory.dmp

Download

memory/4380-2518-0x00000216000F0000-0x0000021604D88000-memory.dmp

Download

memory/4380-2423-0x00000216000F0000-0x0000021604D88000-memory.dmp

Download

memory/4380-2205-0x00000216000F0000-0x0000021604D88000-memory.dmp

Download

memory/4380-2039-0x00000216000F0000-0x0000021604D88000-memory.dmp

Download

memory/4380-1950-0x00000216000F0000-0x0000021604D88000-memory.dmp

Download

memory/4380-1598-0x00000216220C0000-0x0000021622330000-memory.dmp

Download

memory/4380-1456-0x00000216295F0000-0x0000021629860000-memory.dmp

Download

memory/4380-1577-0x00000216295F0000-0x0000021629860000-memory.dmp

Download

memory/4380-1469-0x00000216220C0000-0x0000021622330000-memory.dmp

Download

memory/4380-1462-0x0000021629B80000-0x0000021629DF0000-memory.dmp

Download

memory/4956-0-0x0000000000FBD000-0x0000000000FBE000-memory.dmp

Download

memory/4956-1444-0x0000000000F00000-0x0000000000FDD000-memory.dmp

Download

memory/4956-2-0x0000000000F00000-0x0000000000FDD000-memory.dmp

Download

memory/4956-12-0x0000000000F00000-0x0000000000FDD000-memory.dmp

Download

memory/5104-54-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/5104-64-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/5104-70-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/5104-35-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/5104-33-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/5104-31-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/5104-14-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/5104-985-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/5104-9-0x0000000000400000-0x0000000000798000-memory.dmp

Download

memory/5104-8-0x000000000072D000-0x000000000072F000-memory.dmp

Download

memory/5104-1443-0x0000000000400000-0x0000000000798000-memory.dmp

Download